Privacy policy

Two roles

For your account (your name, email address, password and sign-in settings) we decide how the data is used, so we are responsible for it.

The content of an organisation (objectives, key results, check-ins, evidence, reviews and its audit log) belongs to that organisation. We process it on the organisation's behalf, under our data processing agreement. Questions about that content are best sent to the organisation first.

What we collect

• Account details: name, email address, a hash of your password (never the password itself), and your authenticator-app secret if you turn on two-step sign-in.
• Membership: which organisations you belong to, your role and team, and when you last used each organisation (used to count billable seats).
• What you add: check-ins, notes, links, files you upload as evidence, and reviews.
• Security records: an audit log of changes in each organisation, and the IP address and browser of signed-in sessions.
• Emails we send you: reminders, weekly summaries, invitations and sign-in messages, and whether they were sent.

We don't use advertising or analytics trackers, and we don't sell personal data.

Why, and on what basis

• To provide the service you or your organisation signed up for (contract).
• To keep accounts secure and investigate misuse (legitimate interest).
• To meet legal obligations, such as keeping billing records once billing starts (legal obligation).

Where it is kept

All data is hosted in the European Union, by Hetzner Online GmbH in Germany or Finland: the database, evidence files and backups. Backups are encrypted and kept with a second provider, [BACKUP PROVIDER], also in the EU.

Who else handles it

• Hetzner Online GmbH: servers and file storage (Germany or Finland).
• [BACKUP PROVIDER]: encrypted backups.
• [EMAIL PROVIDER]: sending our emails.
• Cloudflare, Inc.: network protection in front of our servers.
• Google: serves the Inter typeface, so it sees your IP address when the font loads.
• Have I Been Pwned: when you choose a password, we send only the first five characters of its SHA-1 hash to check it against known breaches. The password itself never leaves our server.

We tell organisations' owners before adding a new provider that handles their content.

How long we keep it

• Organisation content: until the organisation is deleted. An owner can export everything and delete the organisation at any time.
• Deleted data disappears from the live service at once and from backups within 30 days, as old backups expire.
• Your account: until you ask us to delete it. Leaving an organisation doesn't delete your account.

Your rights

You can ask to see, correct, export or delete your personal data, or object to how we use it. Write to [CONTACT EMAIL] and we will answer within 30 days. You can also complain to Ghana's Data Protection Commission, or to the data protection authority where you live.

[ENTITY] is registered with the Data Protection Commission of Ghana under number [DPC REGISTRATION NUMBER].

Changes

If we change this policy in a way that matters, we will email account holders before it takes effect.