Who this statement is for
This statement explains how Riftjaw handles personal data about you as a customer or visitor: the person who creates an account, logs in, pays or sends us a message. For this data, Riftjaw is the controller.
The companies and contacts you import into your own lead database are a different matter. For that data you are the controller and we act as your processor. How that works is described on the GDPR page.
What we collect
- Account data: your name, login email, password (stored only in hashed form), avatar if you add one, workspace name and preferences such as time zone, date format and theme.
- Billing data: the plan you chose, invoices, company and billing details, and payment status. Card and bank details are handled by the payment provider; we do not store full card numbers.
- Usage logs: technical records such as login times, IP addresses, errors and actions needed to keep the service secure and working.
- Support messages: what you send us through the contact form or by email, and our replies.
What we do not do
- We never sell your data, to anyone.
- We never use the lead data in your account for our own purposes, such as our own marketing or building a database of our own.
- We do not show ads and do not use advertising or tracking cookies.
Why we use your data
We use your data only for these purposes, each with its own legal basis:
- to provide the service and your account (performance of our agreement with you);
- to bill you and keep our accounts (legal obligation);
- to keep the service secure, for example to rate limit logins and detect abuse (legitimate interest);
- to answer your questions and send important messages about your account or changes to our terms (performance of the agreement and legitimate interest).
Cookies
We only use cookies that are strictly necessary, such as the cookie that keeps you logged in and protects forms against misuse. Because they are necessary for the service to work, they do not need your consent.
Processors we use
We use a small number of service providers to run Riftjaw, for example for hosting the servers, handling payments and delivering email. They process data only on our instructions, under a processing agreement, and only as far as needed for their task. We choose providers that meet the requirements of the GDPR.
How long we keep it
- Account data: as long as your account exists. When you delete your account, it is removed.
- Billing data: as long as tax and accounting law requires us to keep it.
- Usage logs: for a limited period, only as long as needed for security and troubleshooting.
- Support messages: as long as useful to help you, and removed when no longer needed.
Your rights
Under the GDPR you have the right to:
- see the personal data we hold about you;
- have it corrected if it is wrong;
- have it deleted, unless we must keep it by law;
- restrict or object to certain uses;
- receive your data in a common format;
- lodge a complaint with a data protection authority.
Much of this you can do yourself in settings: change your details, export your data and delete your account. For anything else, send a request through the contact page and choose "Privacy or a data request". We answer within the period the law sets.
Security and changes
Every account runs on its own private server, all traffic uses HTTPS and logins are rate limited. More on the security page.
If we change this statement in a way that matters to you, we tell you before it takes effect. The date at the top shows the latest version. The terms describe the rest of our agreement.
