Privacy Policy

Draft, pending legal review. Text in [BRACKETS] is still to be filled in.

1. Who we are

[COMPANY LEGAL NAME] ("we", "us") provides Brontes to businesses. This policy explains what personal information we handle and why. Effective date: [EFFECTIVE DATE].

2. Two kinds of information

• Customer Data -- what our business customers and their users put into the Service, which may include names, emails and phone numbers of their staff, customers, contacts and subcontractors. The customer controls this data; we process it on the customer's behalf and only to provide the Service.
• Account and usage information -- the information we need to run accounts and the Service: sign-in email, name, hashed password, two-step verification settings, sign-in times, IP address and browser details of sessions, Terms acceptances, billing contacts, and support correspondence.

3. How we use it

• to provide, secure and support the Service (including detecting misuse and keeping audit logs);
• to bill subscriptions (through Stripe, which handles card details -- we do not store full card numbers);
• to send service messages such as sign-in links, invitations and notices you or your company ask for;
• to improve the Service in aggregate.

We do not sell personal information and do not use Customer Data for advertising.

4. Who we share it with

Service providers that help us run the Service, under confidentiality obligations -- hosting, email delivery, payment processing (Stripe), and, when a customer turns them on, the integrations it chooses (for example its accounting or email provider). We may disclose information if the law requires it, or as part of a merger or sale of the business with notice.

5. Support access

Our support staff can see a customer's data only while that customer has granted support access, and every support session is logged where the customer's administrators can see it.

6. Retention

Customer Data is kept for the life of the subscription and the export period in our Terms of Service, then deleted, apart from backups kept for a limited time. Account, security and audit records are kept as long as needed for those purposes or as the law requires.

7. Security

Encrypted connections, a separate database per customer, hashed passwords, optional two-step verification, session limits, audit logs and backups. See our Terms of Service.

8. Your choices and rights

Users can update their own account details in the Service. Requests about Customer Data should go to the customer (your employer or the business that invited you); we will help them respond. Depending on where you live you may have rights to access, correct or delete personal information -- contact us below.

9. Changes

We will publish any update with a new version label and ask users to accept it at their next sign-in.

10. Contact

[COMPANY LEGAL NAME], [ADDRESS]. Email: [CONTACT EMAIL].