Privacy and data protection
How the software supports the obligations of the GDPR and similar laws. This describes features, not legal compliance: no certification has been obtained and nothing here is legal advice. Each operator must assess its own obligations with a lawyer. [NEED: legal review]
1. Who is responsible for what
| Data | Typical role of the workspace (business) | Typical role of the platform operator | Notes |
|---|---|---|---|
| Contacts, form submissions, orders, emails, page visits of a workspace's own customers | Controller | Processor (hosts and processes on the workspace's instructions) | Needs a data processing agreement between operator and workspace [NEED: DPA template] |
| Team accounts (users of the app) | Controller | Name, email, password hash, sessions, audit entries | |
| Agency access to a client workspace | The client remains controller of its data | The agency acts as the client's processor or sub-processor | Support access is time-boxed, reasoned and logged |
| Sales enquiries from the vendor's website | Controller (the vendor) | Name, email, company, message, hashed network address | |
| White-label operator's customers | Operator is controller of its customer relationships | The owner hosting the white-label platform is processor |
Which operator owns which customer data follows the tenant hierarchy: every record carries the organization it belongs to, and row-level security keeps it there.
2. Data map
| Category | Where | Personal data | Kept until |
|---|---|---|---|
| Contacts | contacts | Name, email, phone, tags, custom fields, source and campaign, consent with its wording and time | Deleted by the workspace, or with the workspace |
| Form submissions | form_submissions | The submitted fields, consent text, hashed IP, visitor id | Same |
| Page visits and clicks | events, affiliate_clicks | Random visitor id, page, source, device, country if the host sends it | Workspace retention setting (Settings → Data and deletion), or RETENTION_EVENTS_DAYS; otherwise with the workspace |
| Orders, subscriptions | orders, subscriptions | Buyer name, email, address if asked, amounts | Same as contacts; bookkeeping laws may require longer retention [NEED: retention per country] |
| Card data | Not stored | Card numbers go straight to Stripe or the test page | |
| Emails | email_messages | Recipient, subject, body, opens and clicks (opens labelled as estimates) | Same as contacts |
| Members and affiliates | members, affiliates, affiliate_commissions | Name, email, password hash, progress, posts, payout details | Same |
| Team users | users, sessions | Name, email, password hash, sessions with user agent and hashed network address, two-factor secret (encrypted) | Sessions until they expire (then removed daily); users until deleted by an administrator |
| Audit log | audit_log | Who did what, when | With the organization |
| AI requests | ai_usage (and Anthropic) | Prompts may contain workspace data; only when AI is switched on | Usage ledger with the workspace |
3. Rights of the people in the data
| Request | How |
|---|---|
| Access (art. 15) and portability (art. 20) | Contact page → Export data: every record about the person as JSON (contact, activities, tasks, deals, form submissions, orders, subscriptions, emails, page visits, member account). The export is logged. |
| Rectification (art. 16) | Edit the contact |
| Erasure (art. 17) | Delete the contact (single or bulk); related events lose the link to the person |
| Objection to marketing (art. 21) | One-click unsubscribe in every marketing email (RFC 8058); the suppression list blocks further sending; consent can be withdrawn on the contact |
| Restriction | Tag the contact and exclude the tag from campaigns and workflows |
4. Consent and marketing
- Forms store the exact consent wording and the time. Marketing email requires recorded consent when the workspace switches that rule on (recommended).
- Transactional emails (receipts, sign-in links) are sent without marketing consent.
- Consent, unsubscribe, bounce and suppression are checked again at the moment of sending.
- The visitor cookie (
rl_vid) is a random id without personal data, used to count unique visitors and connect submissions to earlier visits. Whether it needs consent under ePrivacy rules depends on the country and use[NEED: cookie assessment]. Published pages load no third-party trackers unless a workspace adds them in a custom code block.
5. Deletion and retention
- Workspace deletion: owner (Settings → Data and deletion) or the agency or operator above. Closed at once (pages offline, no sign-in, plan cancelled), restorable for
DELETION_GRACE_DAYS(default 30), then purged with all files by the worker. A purge log keeps the workspace id, name, time, number of contacts and files, nothing else. - Event retention: per workspace (90 days, 180 days, 13 months, 2 years or unlimited), installation default
RETENTION_EVENTS_DAYS. - Operational clean-up (daily): expired sessions and sign-in tokens, rate-limit counters after two days, finished jobs after 90 days, dead jobs after 180 days.
- Backups keep deleted data until they rotate out; state the backup retention in your privacy notice
[NEED: backup retention].
6. Moving data out
- Whole workspace: Settings → Data and deletion → Download export (all data and files, no passwords or provider credentials), importable on another installation. Agencies and operators can export a client's workspace for a move.
- Contacts as CSV, funnels as JSON.
7. Security measures (art. 32)
See acquisition/SECURITY.md: tenant isolation in the database, encrypted provider credentials and two-factor secrets, hashed passwords and tokens, optional two-factor sign-in, session list with sign-out, audit log, rate limits, signed webhooks, outbound requests blocked from private networks.
8. Sub-processors an operator may use
Hosting provider, database provider (if managed), email provider (SMTP, Resend or Postmark), Stripe, Anthropic (only with AI on), S3-compatible storage, DNS and certificate authority. List the ones actually used in the privacy notice and DPA [NEED]. International transfers depend on these choices [NEED: transfer assessment].
9. Breaches
The software records audit entries and health incidents but does not detect breaches by itself. Operators need a process to assess and report within 72 hours [NEED: incident response procedure].