Data processing note

Two different relationships run in parallel, and confusing them is the usual source of trouble.

• Your own account data — your name, email, country, billing details. We are the controller. Covered by the privacy policy.
• Data you enter about other people — colleagues you invite, sales contacts, investor contacts, candidates. You are the controller; we are your processor and act on your instructions. This note covers that.

We process it only to provide the service to you: storing it, showing it back to the people in your workspace who are permitted to see it, running the product’s calculations over it, and — only for a specific action you approve — sending the necessary part to the provider performing that action.

We do not use it for our own purposes, we do not sell it, and we do not train models on it. Using it any other way would make us a controller of it, which we are not.

• Having a lawful basis for the personal data you enter about other people.
• Telling those people how their data is used, where the law requires it.
• Handling requests they make to you about their data — you can use the product’s own export and deletion tools, and we will help where we can.
• Not entering special-category data. The product is not designed for it and we do not want it.
• Managing who in your workspace can see what, using the roles available to you.

• Process only on your documented instructions, which the product’s own interface constitutes.
• Keep it confidential and require the same of anyone with access.
• Apply the technical measures described on the security page — per-workspace isolation enforced in the database, private file storage, hashed share tokens, step-up verification for sensitive actions.
• Use only the sub-processors listed in the privacy policy, each under equivalent terms, and tell you before adding one.
• Help you respond to data-subject requests and to regulators.
• Notify you without undue delay if we become aware of a breach affecting your data.
• Delete or return the data at the end of the agreement, subject to records we must retain by law.

The full list is in the privacy policy, which also covers where processing happens and the transfer mechanism relied on when data crosses a border.

This note is a summary, not the agreement itself. If you need a signed DPA — including Standard Contractual Clauses, a sub-processor list as an annex, or a security schedule for your own compliance review — request one through the contact form, or write to [not yet registered — see the notice at the top of this page].

During the invite-only beta these are issued on request rather than published, so that what you sign is the reviewed version rather than a draft.