Privacy policy
A template for legal review, not legal advice. Replace every «bracketed» value and have counsel read the whole before publishing. The technical claims below are ones this codebase actually makes true; keep them only while they stay true of your deployment.
Who we are
«Company», «address». Questions about this policy or your data: «contact email».
What we process, and why
The full inventory is generated from our own schema and published as our record of processing. In plain language:
- Account data — your name, email address and workspace membership — to operate the service you signed up for.
- Billing data, kept «ten years» because tax law says so.
- Security and audit trails, kept «one year», so we can answer what happened to an account and when.
- Waitlist entries, if you asked to hear when we open: your address, and the record of the consent you gave.
Cookies
Only what the service cannot work without: your session, and your cookie preference itself. Nothing is loaded for analytics or advertising unless you have said yes, and you can change that answer at any time from the footer.
Your rights
- A copy of your data. Settings gives you a machine-readable export.
- Correction. Your name and language are editable in Settings.
- Erasure. Request it in Settings; it is scheduled «thirty» days ahead and you can cancel until it runs. Records we must keep under a legal obligation are pseudonymised rather than deleted.
- Withdrawing consent, wherever we relied on it — including the waitlist, by asking us to remove you.
- Complaining to «your supervisory authority».
Who else sees it
Our sub-processors, listed with their purpose and location in our sub-processor register. We do not sell personal data.
Backups
Deleted records remain in encrypted backups until the backup cycle expires, «N days», after which they are gone from those too.