Privacy Policy for Agencies

Data protection law distinguishes between a controller (who decides why and how data is used) and a processor (who acts on instructions). Both roles appear here:

• We are the controller for the data we need to run your account and our business: your login and profile, security logs, billing status, support conversations and usage metrics. Section 2 lists it.
• You are the controller and we are the processor for everything inside your workspace: your clients’ names and emails, tasks, documents, invoices, time logs, messages, portal uploads and connected-mailbox contents. We process that data only on your instructions, as given through the product, and under the Data Processing Agreement incorporated into our Terms. A signed copy is available on request.

If you are a client, contractor or signer who was invited into someone else’s workspace, that organisation is the controller of the data they hold about you. Direct requests about that data to them; we will help them answer.

• Account data. Name, email address, a hashed password, your two-factor secret and recovery codes (encrypted), avatar, time zone, and the workspace you belong to with your role in it.
• Security and session data. Session identifiers, IP address, browser and device description, sign-in attempts, two-factor challenges, and an audit log of sensitive actions (invitations, permission changes, downloads, deletions, support access). This is how we detect account takeover and enforce IP allowlists.
• Billing data. Your plan, subscription status, Paddle customer and subscription identifiers, invoice history and the country used for tax. Card numbers and bank details are collected and stored by Paddle, never by us.
• Workspace content (processed for you). Clients, projects, tasks, sprints, goals, comments, documents and files, invoices, budgets, time logs, meetings, commitments, portal requests, e-signature envelopes and their signer details.
• Integration data (processed for you). OAuth tokens for Jira, LinkedIn, GitHub, Google and Microsoft, stored encrypted. If you connect a mailbox we store message metadata and the text needed for triage; if you connect a calendar we store event titles, times and attendees.
• AI interaction data. Prompts you send to RoWA, the context the assistant was shown, its answers, your ratings of them, and token counts for metering.
• Support data. Emails you send us, and notes from support sessions.
• Marketing website data. If you join the waitlist we store the email you give us and when you gave it. The website sets no analytics or advertising cookies.

• To provide the Service you signed up for — storing and showing your workspace, sending the emails the product sends (invitations, verification, portal notifications, invoices). Basis: performance of a contract.
• To keep accounts secure — sessions, two-factor, IP allowlists, rate limits, audit logs, abuse detection. Basis: legitimate interest in security, and legal obligation.
• To bill you through Paddle and keep the records tax law requires. Basis: contract and legal obligation.
• To run AI features you use — sending the relevant data to a model provider and returning the result. Basis: contract; for connected mailboxes and calendars, your explicit consent when you connect them.
• To support you when you ask. Basis: contract and legitimate interest.
• To tell you about the Service — security notices, changes to terms or prices, and, if you opted in, product news. Basis: legal obligation for the first two; consent for news, withdrawable with one click.
• To improve the product using aggregated, de-identified usage metrics (which features are used, how often, error rates). Basis: legitimate interest. We do not profile individuals for this.

• We never sell personal data, and never share it with advertisers or data brokers.
• We never use your workspace content, prompts or files to train AI models, ours or anyone else’s.
• We never read your connected mailbox or calendar for any purpose other than the feature you connected it for.
• We never set analytics, tracking or advertising cookies in the app or on the website.
• We never let a staff member look into a workspace without a reason tied to your request, an incident or the law, and without it being logged.

AI features send data to large-language-model providers. Which provider handles a request depends on the platform configuration and on whether your workspace has supplied its own provider keys. Providers we may use are OpenAI, Google (Gemini API or Vertex AI), Anthropic, Groq, OpenRouter, NVIDIA and DeepSeek.

• What is sent. Only the data needed for the request, limited to what the asking user is permitted to see. AI post drafting strips email addresses, phone numbers and tax IDs from the text before it is sent. Mailbox triage fetches a message body only at the moment it is triaged, shows it to the model and does not store it.
• Provider retention. We use these providers under their API or enterprise terms, which exclude training on customer data. Several keep request logs for up to 30 days for abuse monitoring; where a zero-retention option exists we enable it. If you bring your own key, your contract with that provider governs retention.
• Our retention. RoWA conversation threads stay until you delete them. Mailbox triage records are kept for 30 days, message bodies are never stored, and everything is deleted immediately when you disconnect the mailbox. Daily briefs and risk scans keep only the result and the token count, not the input.
• Your control. A connected mailbox or calendar can be disconnected at any time, which deletes what we hold for it.

These companies process data on our behalf. Each is bound by a data processing agreement, and transfers outside the EU/EEA and UK rely on Standard Contractual Clauses or the EU-US Data Privacy Framework. We will email workspace owners at least 30 days before adding one.

• Paddle.com Market Ltd (UK) and Paddle.com Inc (US) — merchant of record: checkout, payment, tax, invoicing and refunds. Receives your name, email, country and payment details.
• Vercel Inc (US) — hosts and runs the application.
• Managed PostgreSQL hosting — stores the application database, encrypted at rest.
• Cloudflare Inc (US) — object storage (R2) for uploaded files, documents, signatures and generated PDFs. Files are served through links that expire after 15 minutes.
• Upstash Inc (US) — Redis cache and rate limiting. Holds short-lived session and permission lookups, never file contents.
• Resend Inc (US) — sends transactional email: verification, invitations, portal notifications, invoices, security alerts.
• AI model providers — as listed in the AI section above, only when an AI feature is used.
• Integration providers you connect — Atlassian, LinkedIn, GitHub, Google, Microsoft. They receive only the requests the integration needs, under their own privacy policies.

We use only cookies that are strictly necessary, so no cookie banner is needed:

• Session cookie — an opaque token that identifies your signed-in session. It carries no personal data itself; the session lives in our database and can be revoked there. Expires when you sign out or the session ends.
• Pre-authentication cookie — carries you from password to two-factor code during sign-in. Lives minutes.
• Desktop client marker — tells the server you are in the desktop app so it never serves you the marketing site.
• Preferences — theme, collapsed panels and similar, stored in your browser only.

• Workspace content — for as long as the workspace exists. Deleted items go to a trash for 30 days, then are purged, including files in storage.
• Deleted workspace — all records, files, sessions and integration tokens are erased within 30 days.
• Account data — until you delete your account. When a member leaves a workspace their personal account can be deleted at their request.
• Sessions — expired sessions are purged automatically; audit logs of sign-ins are kept for 12 months.
• Audit log — kept for the life of the workspace plus 12 months, so an investigation after an incident is still possible.
• Billing records — as long as tax law requires, generally 7 years, held by Paddle and by us.
• Support emails — 24 months after the conversation closes.

• Encryption in transit everywhere (TLS 1.2+) and at rest for the database, file storage and backups.
• Passwords hashed with a modern memory-hard algorithm; passwords found in known breach lists are rejected.
• Mandatory two-factor authentication for owners and admins; authenticator apps supported for everyone.
• Every database query scoped to one workspace; access checks on every page and every action, not only at the edge.
• Sessions stored server-side and revocable instantly; the god-panel can end any compromised session on its next request.
• Files hashed in your browser before upload, stored in private buckets, and served only through 15-minute signed links.
• Optional IP allowlisting per workspace, rate limiting on authentication and public endpoints, and an append-only audit log.
• Secrets held in a managed secret store, never in source code; dependencies and the codebase scanned before each deploy.

Wherever you live, you can ask us to tell you what personal data we hold about you, correct it, delete it, give it to you in a portable format, or stop using it for a particular purpose. If you are in the EU, EEA, UK, Switzerland, California or another jurisdiction with a data protection law, these are legal rights and we honour them within one month (45 days in California).

• Self-service. Export your workspace as JSON and files from Settings. Delete your workspace from Settings. Change your name, email and avatar from your profile.
• By email. For anything else, write to [email protected] from the email on your account. We may ask you to confirm your identity.
• Complaints. You can complain to your local data protection authority at any time. We would appreciate the chance to put things right first.
• California. We do not sell or share personal information as defined by the CCPA, and we do not use sensitive personal information to infer characteristics about you.

Our sub-processors run mainly in the United States and the European Union. Where personal data leaves the EU/EEA or UK we rely on the European Commission’s Standard Contractual Clauses, the UK Addendum, or the recipient’s certification under the EU-US Data Privacy Framework, together with the technical measures in the security section.

The Service is for business use and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, email [email protected] and we will delete it.

When we change this policy we update the date at the top. For changes that reduce your rights or add a new purpose or sub-processor we email workspace owners at least 30 days in advance.

Privacy questions, rights requests, security reports and DPA requests: [email protected]. Security researchers: please include “security” in the subject and we will acknowledge within two business days.