Privacy

What we intend to do with personal data, in plain language, pending the reviewed version.

What we hold

Two different things, and it matters which. Account data is what you give us to have a workspace: names, work email addresses, the organisation name, the country, and billing details. Customer data is what your organisation records inside the product — incidents, assessments, training records, uploaded files. Account data is ours to administer; customer data is yours, and we hold it on your behalf.

Why we hold it

To provide the service you signed up for, to bill you for it, to send the transactional email the product depends on (verification, notifications, invoices), and to answer you when you contact support. We do not sell personal data, and we do not use your customer data to advertise to you or to anyone else.

Where it lives

Your organisation's records live in a database and a storage bucket created for your organisation alone. Sub-processors — hosting, email delivery, payment processing, identity — are involved in running the service, and we intend to publish the list of them alongside the reviewed version of this page.

How long we keep it

For as long as your workspace exists, and for a bounded period afterwards so that an account closed by mistake can be recovered and so we can meet our own legal obligations. Nothing is silently destroyed while your workspace is live.

Your rights

Depending on where you are, you may have rights to access, correct, export or delete personal data we hold about you. Write to the privacy address on the contact page and we will act on it. If the personal data in question is inside a customer's workspace, we will route the request to that customer, because it is their record and not ours.

Security

Described in detail on the security page: a database, a storage bucket and an identity organisation per customer, expiring links for file access, permission checks server-side, and an audit log of consequential actions.

Changes

This page will be replaced by a reviewed privacy policy. When that happens we will say so rather than swap it quietly, and material changes affecting existing customers will be notified.