Privacy
Last updated 27 September 2026
What we collect, why, and what we do with it. There is no second version of this document for lawyers.
1. What we hold about you
Your name, email address and password hash. Your workspace, its projects, clients, contacts, phases, deliveries, comments, variations, invoices and sign-off records. The audit log of what people in your workspace did.
We never store your password itself. We never store a client’s password, because clients do not have one.
2. What we hold about your clients
A contact’s name and email address, the comments they leave, and the context captured with each comment: the element, the page, the screen size and the browser. On plans that include it, the console errors and failed requests the page logged before the comment, with query strings and access tokens removed and no request or response bodies.
When a client comments, Studio captures a copy of the page as it looked. Anything inside an element you mark as private, and every password, email, phone and number field, is stripped before it leaves the browser.
3. Why we hold it
To run the product you are paying for. That is the whole list. We do not sell data, we do not share it with advertisers, and we do not train models on your clients’ words.
4. Where it lives
In India by default, configurable when your workspace is created. Files and page snapshots are encrypted at rest and reachable only through signed, expiring links.
Page snapshots are deleted ninety days after a project is archived. You can shorten that for your workspace.
5. Who else touches it
A short list of sub-processors: our hosting provider, our database host, our object storage, our email provider, our payment provider and, for Ask Studio, our AI model provider. Each is named in the DPA and each is under contract to handle your data the way we do.
6. Ask Studio
Ask Studio, the assistant in the Console, sends what you type to it, the details of the screen you are on and of what you ask about (names, phases, prices, client comments), and any document you give it, to Ollama, our AI model provider, to answer you. Ollama says it processes this only to answer and does not train models on it. It may be processed in the United States, and Ollama may use other companies’ infrastructure to run the model, under Ollama’s terms. Ollama does not publish a data processing agreement; we have asked for one.
It does not send your clients’ Portal activity, their page snapshots, your password or any card details. Conversations are kept for thirty days so you can go back to them; a document’s file is deleted as soon as it has been read, and what was read from it after seven days. Everything the assistant changes is in your workspace’s Activity and audit log, under your name.
Without anything you wrote, Studio keeps how much each person used Ask Studio (tokens, messages and documents per day, for 25 months, for billing and planning), a note of each message it declined and each instruction it found and ignored in a comment or document (which rule, not the words, for 400 days, for security), each thumbs up or down with its reason (400 days, to improve Ask Studio), and how each request went — whether it succeeded, how long it took, which tools it used and whether you kept, changed or undid what it suggested (400 days, to measure and improve its accuracy). Studio’s operators can see these, never your conversations.
Ask Studio’s suggestions on Console screens (grouping a review’s comments, drafting replies and notes, suggesting features, checking a plan) send the same kind of details to Ollama as the chat; a grouping or a plan check is kept for thirty days so opening it again costs nothing. Notes your team gives Ask Studio are kept until you remove them.
7. Your rights
Export everything at any time, from the admin screen. Delete your workspace at any time, from settings, and it is gone — not flagged.
If you want a copy of what we hold about you personally, or want it corrected, email us and we will do it.
8. When something goes wrong
If your data is exposed, we will tell you what happened, what was affected and what we did, within seventy-two hours of knowing. We will not wait for a press strategy.