Privacy notice

Who we are

{{Company legal name}} ({{registration number}}), {{registered address}}, operates this product and is responsible for your personal data. Contact us about privacy at {{privacy contact email}}.

What we collect

Account data: your name, email address, a securely hashed password, and optional two-factor authentication settings.

Workspace data: the organizations you belong to, your role in them, and the content you or your organization create.

Security and session data: IP address, browser user agent, and sign-in times, used to keep your account secure and to show you your active sessions.

Error reports: technical details of application errors, with personal data removed where possible.

Analytics: only if you allow optional analytics cookies on our marketing site.

Why we use it

To provide the service you signed up for, keep it secure, send essential account emails (verification, password reset, invitations, and security notices), meet legal obligations, and, with your consent, understand how the marketing site is used. {{Add any other purposes agreed in kickoff/SCOPE.md.}}

Who processes it for us

Hosting and databases: Vercel and Railway, with application compute and primary data in Singapore. Transactional email: Resend. Error logs: {{Rootprint host}}. {{List any other processors, such as analytics, AI providers, or WhatsApp, enabled for this project.}} We do not sell personal data.

Some providers process data outside Malaysia. We rely on their contractual safeguards for those transfers.

How long we keep it

Account and workspace data: while your account is active. Deleted accounts are removed immediately from the live database and from backups within {{backup retention period}}. Security logs: {{retention period}}. {{Adjust to the retention decisions in kickoff/SCOPE.md.}}

Your rights

Under the PDPA you may request access to and correction of your personal data, and withdraw consent. You can change your details and download a copy of your data from Settings at any time, and delete your account there after confirming by email.

For other requests, email {{privacy contact email}}. We respond within 21 days.

Changes

We will post updates here and change the date above. Material changes are also sent by email.