Privacy policy
Draft under review: this text is a placeholder until our counsel replaces it.
What we hold
Your name, your work email address and a hashed password, your language and appearance choices, the version of the terms you accepted and when, your sign-in history with the network address and browser of each session, which organizations and teams you belong to and with which role, your visibility in each organization (Public or Private), the requests to join you send, the invitations you send and the addresses they go to, the notifications about events in your organization with which of their emails you want, the address and time of each email we send you about them, what you add inside your organizations, and an audit trail of every change to organizations, teams, membership, roles, invitations, and requests to join. Our cookies only keep you signed in and remember your language, appearance, and an invitation you opened; for an hour after you ask for a sign-in or reset link, one also holds a one-way hash of the address you asked with, so the link signs you in by itself only in that browser and only for that address.
Why
To run the service, to keep it secure, to show the people in your organizations who you are, and to meet legal duties. We do not sell personal data and we do not use it for advertising.
Where it is processed
On infrastructure we rent from hosting and email providers acting on our instructions, under contracts that bind them to this policy. Backups are kept for a limited time and are encrypted.
Who sees it
Members of an organization see the names, roles and work email addresses of its other members, except a Private member, who is seen, with their address, only by the organization's admins and by the managers and members of their teams, and by name only by the managers of a team they ask to join, for that request. Each member chooses Public or Private unless the organization decides for everyone: in a Public organization every member is Public, and in a Private one every member is Private. A notification names who acted only to someone who may see them, except a request to join a team, which names its asker to the team's managers. Its admins also see the addresses of everyone invited to it or asking to join it. Its managers and members see the addresses of the people they invited, and a manager also those of people invited by members of the teams they manage. An invitation names the person who sent it to the person it invites, in the email and on the pages it opens, whether the sender is Public or Private. A person at your organization's email domain is told that your organization exists and whether it accepts requests to join; nobody else learns of it. Nobody outside your organizations sees that you belong to them. If you choose Other as your organization's type, our staff read what you write to decide which types to add.
How long
For as long as your account exists; afterwards only what the audit trail and the law require, and each organization's record of the invitations it sent. A notification is deleted ninety days after its reader read it, a year after it was written if it is never read, and once its reader has left the organization and every email about it has been sent or has failed; our record of an email ninety days after it was sent. Closing an account removes your name from the organizations you left, except from notifications already written to their members, which name you until they are deleted; content you added stays with them.
Your rights and contact
You may ask for a copy of your data, a correction, or deletion, and complain to your data protection authority; you can also delete your account yourself in Settings. Write to the address on the contact page; we answer within a month.