This is a template. Have it reviewed by a lawyer and adapt it to your company, your product and the services you use before you publish it.
This policy explains how Acme Ltd handles personal data in Acme. It follows articles 13 and 14 of the General Data Protection Regulation (GDPR).
Who is responsible
Acme Ltd, 1 Example Street, 1000 Example City (the legal notice gives the registration details) is the data controller for the data described in "Data we handle as controller". Write to hello@example.com for any question about personal data.
For the items and files that our customers store through the API, Acme Ltd is a processor acting on the customer's instructions, under the data processing agreement.
Data we handle as controller
- Your account: your name, your email address, a hash of your password (never the password itself), the second factor you set up, and the organizations you belong to, with your role in each. We need it to give you access to the service (article 6(1)(b) GDPR).
- Sessions and security: the sessions you open, the first part of the network address they come from, the browser they use, and the audit log of what members do in an organization. We keep it to secure the service and to show you who did what (article 6(1)(f) GDPR).
- Billing: your organization's plan, its credits, its invoices and the billing details you give Stripe. Stripe holds the card; we never see its number. We keep invoices as long as the law requires (article 6(1)(c) GDPR).
- Messages: what you write to us through the contact form, to answer it (article 6(1)(f) GDPR).
- Abuse prevention: when sign-ups, sign-ins or content are checked against abuse, the details of the request (address, email, browser, the text or file concerned) are sent to our fraud and moderation provider, openshield, which answers with a decision. We keep the decision and its reasons, not the content (article 6(1)(f) GDPR).
Content our customers send us
A customer stores items and files through the API and the dashboard. The customer decides what is stored and is its controller. We process it only to provide the service, under the data processing agreement. We do not use it for any other purpose, and we do not use it to train models.
How long we keep it
- An account is kept as long as it is open. A deleted organization's data is purged after its retrieval window.
- Sessions expire after 30 days without use. The audit log is kept for 12 months.
- Invoices are kept for the period accounting law requires.
Who we share it with
We use the following processors. Each one handles data only on our instructions.
- Cloudflare, Inc.: hosting, database, file storage, email delivery and the bot check (Turnstile).
- Stripe Payments Europe, Ltd.: payments and invoices.
- openshield: fraud and moderation checks, when they are turned on.
- PostHog, Inc.: product analytics, only with your consent.
Cookies
The site sets the cookies it needs to work: the session cookie once you sign in, the language you chose, and the record of your cookie choice. They need no consent.
Analytics cookies are set only if you accept them in the cookie popup. You can change your choice at any time with the "Cookie preferences" link in the footer.
Your rights
You may ask for a copy of your data, its correction, its deletion, a limit on its use, or its export, and you may object to a use based on our legitimate interest. Write to hello@example.com. You may also complain to your data protection authority.