What we hold, and why

1. Who we are

[LEGAL ENTITY NAME], [REGISTERED ADDRESS], trading as WhoseDesk. Privacy questions go to privacy@whosedesk.app and reach a person, not a queue.

If you are in the UK or EU and need a named data-protection contact for a records request, use the same address and say so — it will be routed to [NAMED DP CONTACT].

2. Two different roles, and which one applies to you

This matters more than it sounds, because it decides who you ask for what.

• Your organisation is the controller of its own content. The cards, notes, comments, attachments and time entries on your boards belong to your organisation. We hold them on its instructions, as a processor. If you want your content changed or removed, your organisation's admins can do it themselves — and they, not we, decide who inside your company sees it.
• We are the controller of the account layer. Your email address, sign-in records, billing state and the security logs that keep the service safe are ours to account for, and this policy governs them.

3. What we collect

Category	What it actually is	Where it comes from
Account	Name, email address, avatar URL, role, organisation name and slug	You, your admin's invitation, or your identity provider
Sign-in	Session records (an opaque token, stored hashed), the IP address and browser user-agent at sign-in, sign-in attempt timestamps, and — only if you set them — a password hash and an encrypted two-factor secret	Your browser or app at each sign-in
Identity provider	For Google sign-in: your Google account identifier, verified email and, for Workspace accounts, your domain. For Enterprise single sign-on: the subject identifier and email your own provider asserts	Google, or your employer's provider
Content	Card titles, pass notes, comments, due dates, labels, time entries and file attachments	Your organisation's members
Usage	Last-seen timestamps and an event record of work moving between people — which is the product, not analytics	Your use of the service
Billing	Your Stripe customer and subscription identifiers, plan, seat count and subscription status	Stripe, when you subscribe

No analytics, no advertising, no third-party trackers. There is no Google Analytics, no advertising pixel and no session-replay tool in the product or on this site. We do not sell personal data, and we do not share it for cross-context behavioural advertising.

4. Why we hold it

• To perform our contract with your organisation — showing your team's boards to your team, sending the sign-in links and notifications you have enabled, and billing for active people.
• Legitimate interests in keeping the service safe — the IP addresses and sign-in attempt records exist to rate-limit brute-force attempts and to let you see, in Settings, every device currently signed in. We keep the minimum that makes that work.
• Legal obligation — billing and tax records.
• Consent — for anything optional, such as marketing email. Product and security email that the service cannot function without is not marketing, and is not sent on consent.

5. Who else processes it

Every sub-processor, in full. This is the list procurement reviews ask for.

Processor	What for	What reaches them
Amazon Web Services us-east-1, United States	Hosting, database, file storage, background jobs, and the sending of transactional email (Amazon SES)	Everything the service holds
Stripe	Payments and subscription management	Billing contact details and payment details, which you give to Stripe directly
Google	"Continue with Google" sign-in only	Only the sign-in exchange itself. Your boards are never sent to Google.
Anthropic	The in-app help assistant	Only the text you type into the help widget, together with our product manual. Your cards, comments and attachments are not sent, and the assistant has no access to them. If you would rather not use it, email support instead.
Apple, Google and Mozilla push services	Delivering push notifications to the device you enabled them on	The notification text — typically a card title and who passed it
Your own identity provider Enterprise single sign-on only	Authenticating your people	Nothing of ours. Your provider tells us who you are; we tell it nothing about your work.

We will update this page before adding a sub-processor, and organisations on annual plans can ask to be notified when we do.

6. Where it is stored

In the United States, in Amazon Web Services' us-east-1 region. Backups are held in the same region.

If your organisation is in the UK or EEA, this is an international transfer, and it is made under [TRANSFER MECHANISM — Standard Contractual Clauses / UK IDTA / adequacy]. [Confirm with counsel before selling into the EU or UK.]

7. How long we keep it

Plainly, including where the answer is not yet what we want it to be.

• While your account is open — your content stays until somebody in your organisation deletes it.
• Deleted cards, boards and organisations are marked deleted and stop being visible or reachable immediately, including through the API. They are not yet erased from the database on a schedule: an automatic purge is not built, so deletion today is reversible by us on request rather than final. If you need a deletion to be irreversible, email privacy@whosedesk.app and we will erase the records by hand and confirm when it is done. [Update this paragraph the day the purge job ships — MASTER-GUIDE known limitations.]
• Sessions expire 30 days after sign-in and can be revoked sooner by you or your admin, from Settings → Security.
• Sign-in links expire after 15 minutes and work once.
• Sign-in attempt records, which exist for rate limiting, are kept for [RETENTION — recommend 90 days].
• Audit and billing records are kept for longer, for legal and tax reasons — [RETENTION — commonly 7 years for tax]. An audit trail that can be erased is not an audit trail.
• Database backups are retained for 7 days and then overwritten. Content deleted from the live service may persist in a backup until it rolls off.

8. Your rights

Depending on where you live, you may have the right to access a copy of your personal data, correct it, delete it, take it elsewhere in a portable form, object to processing based on legitimate interests, or complain to a regulator.

Ask your own organisation first for anything on the boards. Your admins can export the whole organisation from Settings, correct your details, and deactivate or remove your account. For requests about the account layer — or if your organisation cannot help — write to privacy@whosedesk.app. We answer within 30 days, and usually far sooner.

Exercising a right never costs you access to the service.

9. How it is protected

Specifics, because "bank-level security" means nothing:

• Encrypted in transit (TLS) and at rest — AES-256 on both the database and file storage.
• Tenant isolation is enforced by the database itself, not by application code remembering to filter. Every tenant table carries a row-level security policy that the application's own database role cannot bypass, and the service refuses to start if it is connected as a role that could.
• Credentials are never stored in a readable form. Passwords are hashed with bcrypt; session and sign-in-link tokens are stored as SHA-256 hashes, so a copy of the database yields no usable token; two-factor secrets, webhook URLs and SSO client secrets are encrypted with AES-256-GCM under a key held outside the database.
• Two-factor sign-in is available to every account on every plan, and is mandatory for our own staff.

What we do not claim: we hold no SOC 2, ISO 27001 or equivalent certification, and we will not imply otherwise on a sales call. If your procurement process requires one, tell us before you buy rather than after.

10. When our staff can see your data

Rarely, and never invisibly.

• Support staff can look up an organisation's plan, seat count and sign-in configuration to answer a ticket. They cannot read your cards from that screen.
• A staff member can impersonate a user to reproduce a fault. Every impersonation writes a permanent staff-audit record naming who did it, to which organisation, and why. Those records cannot be edited or deleted by the person who created them.
• Staff accounts must have two-factor sign-in enabled before they can reach any of this.

We will tell an organisation's owners if we have impersonated one of their users other than at their own request. [Confirm this commitment before publishing — it is one we intend to keep, not a legal requirement.]

11. Children

WhoseDesk is a workplace tool. It is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has an account, write to us and we will remove it.

12. Changes to this policy

We will post the new version here with a new date. If a change materially affects your rights or how we use your data, we will email the owners of every organisation 30 days before it takes effect, so there is time to object or leave.