Legal
What we collect, why we collect it, and how long we keep it.
untactit is pre-launch. This document describes how we intend to operate and is published so you can see it early. It has not been through legal review and is not yet a binding agreement. If you need executed terms before that review completes, contact us and we will handle it directly.
Translations of this page may be provided for convenience. Where a translation conflicts with the English text, the English text controls.
This policy covers personal information we handle as a controller — account data, billing data, and product analytics. Content you upload into your workspace is handled as a processor on your instructions and is governed by our Data Processing Addendum instead.
| Category | What it includes | Where it comes from |
|---|---|---|
| Identity | Name, email address, profile picture, identity provider subject identifier | Your identity provider at sign-in |
| Organization | Workspace name, verified domains, role assignments, invitation records | You and your administrators |
| Billing | Plan, seat counts, invoices, billing contact | You. Card details go directly to our payment processor — we never receive them |
| Usage | Feature usage, credit consumption, error reports, approximate location from IP | Automatically, as you use the product |
| Audit | Who did what and when, including IP address and user agent | Automatically. Retained per your plan |
We do not store passwords. Authentication happens at your identity provider, so there is no credential database here.
We do not use your data to train machine learning models, and we do not sell personal information or share it for cross-context behavioral advertising.
Where GDPR or similar law applies, we rely on:
We share personal information with the subprocessors listed in our subprocessor list, each bound by contract to process it only on our instructions.
We may also disclose information when required by law, to protect our rights or someone's safety, or as part of a merger or acquisition — in which case we will give notice before your information becomes subject to a different policy.
| Data | Retention |
|---|---|
| Account and profile | While your account is active, then deleted within 30 days |
| Workspace content | Until you delete it, or 30 days after account closure |
| Audit logs | Per your plan — 90 days, 1 year, or 3 years |
| Billing records | Seven years, as required for tax and accounting |
| Support correspondence | Three years |
Depending on where you live, you may have the right to access, correct, delete, or port your personal information, to object to or restrict processing, and to complain to a supervisory authority.
Most of this is available directly in the product: you can export your data at any time and delete your account from workspace settings. For anything else, write to privacy@untactit.com and we will respond within 30 days. We do not charge for these requests and we will not treat you differently for making one.
If you are a member of a workspace your employer administers, direct requests about workspace content to them — they control that data, and we act on their instructions.
We operate from the United States and our infrastructure providers operate globally. Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses together with additional technical measures including encryption in transit and at rest.
Enterprise customers can request regional data residency.
We use the minimum set of cookies needed to run the product:
| Cookie | Purpose | Duration |
|---|---|---|
| Session | Keeps you signed in | Session or up to 30 days |
| CSRF token | Prevents cross-site request forgery | Session |
| Preferences | Language and interface settings | 1 year |
We do not use advertising or cross-site tracking cookies.
The service is for organizations and is not directed to anyone under 16. We do not knowingly collect information from children. If you believe we have, write to privacy@untactit.com and we will delete it.
We will post changes here and update the date at the top. For material changes we will notify account administrators by email at least 30 days before they take effect.
Privacy questions or requests:
privacy@untactit.com
Security matters:
security@untactit.com
A registered business address and, where required, an EU/UK representative will be published here before general availability.