Version 38027c5e - first version

Privacy Policy

This policy describes what we do with personal data. It is a draft prepared by the build and is

subject to review and acceptance by the owner and their counsel; the version hash on the page

identifies exactly which text you are reading.

There are two different relationships in this document and confusing them is the usual source of a

misleading privacy page, so they are separated here.

1. Two roles, kept apart

Data about you, our customer. When you sign up, use the application, contact support or read

this site, we decide why and how that data is processed. For that data we are the controller and

this policy is the whole answer.

Data about your customers. Contact records, message history, call recordings and everything else

you load into your workspace belongs to you. You decide why it is processed; we process it on your

instructions to run the service. For that data we are a processor, and the Data Processing Agreement

is the operative document. This policy describes the security and retention practices that apply to

it, but not the purpose - the purpose is yours.

2. What we collect about you

• Account data: name, work email, organisation, role, and the authentication factors you register.
• Billing data: the plan, the balance, invoices and payment status. Card details are handled by our

payment processor and do not reach our servers.

• Usage data: which features an account uses, when, and from what approximate location, derived from

the request. We use it to operate and improve the service and to investigate abuse.

• Support data: what you tell us when you contact us, and the correspondence about it.
• Website data: pages requested, referrer, and the coarse device class. We do not run third-party

advertising trackers on this site.

3. Why we may process it

We process account, billing and usage data to provide the service you asked for and to bill for it.

We process security and abuse-investigation data because we have a legitimate interest in keeping

the platform safe for everyone on it, and because our contract with you requires it. Where we rely

on consent - for a marketing email you asked for, for example - you can withdraw it at any time and

the withdrawal takes effect going forward.

4. Who else sees it

We use service providers to run the platform: hosting and database infrastructure, messaging

carriers, an email sending provider, a payment processor, and error and performance monitoring. Each

is bound by contract to process data only on our instructions. The current list, with what each one

receives, is maintained in the Data Processing Agreement so that there is one list rather than two.

We do not sell personal data. We do not share it with advertisers. We disclose it to a public

authority only where we are legally required to, and where we are permitted to tell you that we have

done so, we will.

5. Where it is processed

Data is hosted in the region selected for your workspace. Where a provider processes data outside

that region, the transfer is covered by the mechanism named for that provider in the Data Processing

Agreement.

6. How long we keep it

Account and billing records are kept for as long as the account exists and then for the period our

tax and accounting obligations require. Operational logs are kept for a short, bounded window and

then deleted. Workspace content is kept while your account is active, retained for a limited

wind-down window after termination so that an accidental cancellation is recoverable, and then

deleted.

7. How we protect it

Access to production data is limited to the people who need it to do their job, is authenticated,

and is logged. Workspace data is isolated at the database layer rather than by application code

alone, so that a defect in one query cannot return another tenant's rows. Staff access into a

customer workspace is time-boxed, recorded, and visible to that customer.

8. Your rights

Depending on where you live you may have the right to access the personal data we hold about you, to

have it corrected, to have it deleted, to object to or restrict some processing, and to receive it

in a portable form. Ask through the contact page and we will respond within the period the law where

you live requires. You may also complain to your local supervisory authority.

If your request concerns data held in a customer's workspace, we will refer you to that customer,

because they decide what happens to it and we are not permitted to act on it alone.

9. Children

The platform is a business tool and is not directed at children. We do not knowingly collect

personal data from a child.

10. Changes and contact

When this policy changes, the previous text stays available at its own address and the version hash

on the page changes. Questions, and any request under section 8, go through the contact page.