Privacy Policy

This policy explains what personal data Sandlayer collects, why, and what rights you have. The data controller is [Company legal name], [address]. Contact: [privacy email].

What we collect

• Account data: name, email address, password hash or the identifier from your sign-in provider, profile image.
• Workspace data: workspace names, memberships, invitations, files you upload and their metadata.
• Billing data: plan, subscription status and invoice history. Card details are handled by our payment provider and never reach our servers.
• Security and audit data: IP address, browser user agent, sign-in events and a log of sensitive actions (for example role changes or API key creation), kept so you can review activity in your workspace.
• Technical data: server logs and error reports, which may include your user id and the request that failed.
• Product analytics: events such as sign-up, checkout and feature use, with the IP address and browser user agent they came from. We store them ourselves and, when enabled, forward them to an analytics provider.
• Referrals: if you arrived through someone's referral link, which link it was, so they can be credited when you subscribe.
• Messages you send us through the contact form.

Why we process it

• To provide the Service and perform our contract with you.
• To keep accounts secure and prevent abuse (legitimate interest).
• To bill you and comply with tax and accounting law.
• To respond to your requests and send essential service emails.

We do not sell personal data and we do not use it for advertising.

Cookies

We set these first-party cookies:

• Your session and CSRF protection, to keep you signed in and secure.
• A note that you dismissed the cookie notice.
• locale, the language you chose (one year), when you pick one.
• ref, the referral code from a link you followed (30 days), so the person who referred you can be credited.

We do not use third-party tracking cookies.

Who we share it with

• Our payment provider, to process subscriptions and purchases.
• Our email delivery provider, to send transactional messages.
• Our hosting and storage providers, who store data on our behalf.
• An error-monitoring service, when enabled, for crash reports.
• A product-analytics provider, when enabled, for the events described above.
• Authorities, when the law requires it.

Members of a workspace can see the names and emails of other members.

Retention

We keep your data while your account exists. When you delete your account, personal data is removed within 30 days, except invoices and audit records we must keep for legal reasons.

Your rights

Depending on where you live you may have the right to access, correct, export or delete your data, to object to or restrict processing, and to complain to a supervisory authority. You can update your profile, manage sessions and delete your account from Settings, or contact us for anything else.

International transfers

Our providers may process data outside your country. Where required we rely on standard contractual clauses or equivalent safeguards.

Changes

We will post updates here and, for material changes, notify you by email or in the app.