Commitment to Data Protection
SteelSync, powered by Figue (registered in France under 91145383500017), is resolutely committed to safeguarding your Personal Information. In compliance with the European RGPD laws and other applicable regulations, this policy delineates our stringent measures in managing your Personal Information.
Definition and Collection of Personal Information
Personal Information encompasses data that can identify an individual, such as names, addresses, email addresses, and phone numbers. We collect this information through various channels, including social platforms, correspondence, phone, and third-party sources. Our collection is driven by the necessity to provide impeccable services, client communication, and targeted marketing. We are transparent about our collection purposes and methods, ensuring your informed consent.
Sensitive Information Handling
We define sensitive information in alignment with the Privacy Act, encompassing data about racial or ethnic origin, political opinions, religious beliefs, and other categories. Usage of such information is strictly confined to its intended purpose, or as legally mandated. Your explicit consent is a prerequisite for any other use.
Third-Party Interactions
We primarily collect Personal Information directly from you. If third parties provide your data, we take steps to inform you about this collection. Our interactions with third parties are governed by rigorous protocols to ensure data protection.
Disclosure and Security Measures
Your Personal Information may be disclosed only with your consent or as required by law. We employ robust safeguards against misuse, loss, unauthorized access, modification, or disclosure. After its purpose is served, your data is securely destroyed or anonymized. We retain client files for a minimum of seven years for accountability.
Access and Rectification
You have the right to access and correct your Personal Information. Requests must be made in writing, and we may charge an administrative fee for providing data copies. Identification verification is required to protect your data.
Accuracy and Quality Assurance
Maintaining the accuracy and completeness of your Personal Information is a priority. We encourage you to promptly inform us of any changes or inaccuracies.
App-Specific Data Use
Registration for SteelSync is mandatory. Data transmission is encrypted, and we only use personal information for its intended purpose. Third-party integrations follow their respective terms. We collect and use project-related data with stringent controls, especially when shared externally. Highly sensitive data, like API tokens, are encrypted and securely handled.
Board Analytics
When someone visits a board hosted on SteelSync, we count the visit for the board’s owner. To recognise a returning visitor, their browser keeps a random identifier in its own storage on the board’s site for up to 13 months. We never store that identifier: our servers keep only a one-way keyed code of it, different for every board, so a visitor cannot be followed from one board or company to another.
We record the day of the visit, how the visitor reached the board (public link, access code, invitation or single sign-on) and which requests they opened, and we delete these records after 400 days. When a visitor votes for a request, we also record the date of the vote with a one-way keyed code of the voter. Board owners see totals only, never individual visitors.
We do not count members of the board owner’s team, crawlers and automated browsers, or browsers that send the Global Privacy Control signal. To opt out, turn on Global Privacy Control in your browser.
We also show the board’s owner how many requests were posted, comments written, votes cast, requests followed and changelog sign-ups made on each board, day by day. For requests and comments, these statistics keep only a daily count, never who did it, and the counts are deleted after 400 days. Votes are counted from the dated votes described above, and follows and sign-ups from the records those features already keep to send their emails, so nothing new is stored about the visitor. Because each of these is something the visitor chose to do, it is counted even when their browser sends Global Privacy Control. Members of the board owner’s team are not counted. For all of these statistics, the board owner decides what is collected about their visitors, and SteelSync processes it on their behalf.
Weekly Digest Emails
Members of an organisation on SteelSync may receive a weekly summary email about the boards they work on. Every digest email has a one-click unsubscribe link, and members can turn it off in the app.
Audit Log
Organisations on the Scale plan keep an audit log of what happens in their SteelSync account: their team’s sign-ins and failed sign-in attempts, changes to the organisation, billing, members, boards and board settings, and what people do on their boards (for example opening a private board, voting, commenting, following a request, sending a form or subscribing to a changelog). Each entry records who did it (their name or email address when known; an email typed into a form is marked as not verified), when, what changed, the IP address it came from and the browser it used. Only the organisation’s Admins can read it. Nothing is recorded for organisations on other plans.
Entries are deleted after 365 days, and all of them when the organisation is deleted. The organisation decides what its audit log holds about its team and the visitors of its boards, and is the controller of that data; SteelSync processes it on the organisation’s behalf as its processor. To ask for your entries to be shown, corrected or removed, contact the organisation that runs the board, or us at contact@steelsync.io.
Single Sign-On
An organisation on the Scale plan can let visitors open a private board by signing in with their company’s identity provider, such as Okta or Microsoft Entra. We then receive the visitor’s email address from that provider. We keep it in a cookie on the board’s site for 24 hours so the board stays open, and record the sign-in in the organisation’s audit log. The sign-in request itself is deleted within two days. We never see the visitor’s password.
Account Deletion
To delete your SteelSync account, contact our support team. Deletion is irreversible, emphasizing the importance of this decision.
Policy Updates and Inquiries
Our Privacy Policy may evolve, as reflected on our website. For queries or complaints, contact us at contact@steelsync.io.
SteelSync, a Figue initiative, is registered in France and adheres strictly to EU RGPD laws, ensuring a fortified and responsible approach to data protection.
