Privacy Policy
Last updated
This policy explains what personal data Unhandled collects when you visit this website or use Unhandled, why we collect it, and the choices you have. For personal data inside the telemetry your applications send, we act as a processor for you, and the Data Processing Agreement applies instead.
1. What we collect
Account data: your name, email address, password hash, passkey public keys and, if you sign in with GitHub, your GitHub user id and public profile.
Organization data: organization and project names, member roles, team assignments, invitations and billing contacts.
Usage data: sign-in times, IP addresses and the pages and actions you use in the app, kept in server logs for security and debugging.
Payment data is handled by our payment provider. We receive the billing country, the last four digits of the card and the subscription status, not the full card number.
2. Why we use it
To provide the service and the account you asked for (performance of a contract).
To secure the service, prevent abuse and fix faults (legitimate interests).
To send service emails such as invitations, password resets, alerts and the weekly recap you can switch off in notification settings (performance of a contract and legitimate interests).
To meet tax, accounting and other legal duties (legal obligation).
3. Cookies
We use a session cookie to keep you signed in and a CSRF cookie to protect forms. Your theme choice is stored in your browser’s local storage. We do not use advertising cookies.
4. Sharing
We share personal data only with service providers that help us run Unhandled, such as hosting, email delivery and payments, under contracts that limit their use of it. The current list is in the Data Processing Agreement. We do not sell personal data.
5. Retention
Account data is kept while your account exists and deleted within 30 days after you close it. Server logs are kept for up to 30 days. Billing records are kept for as long as tax law requires.
Our staff keep an append-only record of the actions they take on accounts and organizations. Each entry names the staff member, the account or organization concerned, which can include its email address, and the IP address used. We keep it for as long as Unhandled operates so that staff access stays accountable, and closing your account does not remove it.
6. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict some processing, and to complain to a data protection authority. Write to [legal contact email] and we will answer within one month.
7. Transfers
Where personal data leaves the European Economic Area we rely on an adequacy decision or the European Commission’s Standard Contractual Clauses.
8. Contact
The controller is Unhandled, [registered address]. Contact us at [legal contact email]. We will post changes to this policy on this page and update the date at the top.