Privacy Policy

1. Information We Collect

We collect the following categories of information, most of which you or your organization provide directly.

Account and identity information

• Your name, email address, and password. Passwords are stored only in hashed form using industry-standard algorithms; we never store your plaintext password.
• An optional profile image.
• If you sign in with Google, we receive your basic Google profile information (name, email, profile image) and OAuth tokens used to authenticate you.

Organization and workspace data

• Organization name and identifier.
• Your role and membership within an organization.

Customer relationship data

• Customer and contact records, including names, email addresses, phone numbers, job titles, and company details.
• Deals, including pipeline stage, value, source, and associated contacts.
• Notes, logged interactions, tags, and follow-up tasks entered against customers, contacts, or deals.

Technical and usage data

• Session information, including IP address, browser user agent, session tokens, and related timestamps.
• Cookies used to keep you signed in and to remember interface preferences (see “Cookies” below).

Communications

Records of transactional emails we send to you, such as email verification and organization invitations, and related delivery metadata.

We do not use third-party advertising networks or analytics trackers, and we do not collect special categories of data for advertising purposes.

2. How We Use Your Information

• Provide, operate, and maintain the Service, including customer, contact, and deal tracking.
• Create and authenticate your account, keep you signed in, and secure the Service against fraud and abuse.
• Send transactional emails such as email verification and organization invitations.
• Monitor, debug, and improve the Service.
• Comply with legal obligations and enforce our Terms of Service.

3. Legal Bases for Processing (EEA/UK)

If you are located in the European Economic Area or the United Kingdom, we process your personal information on the following legal bases:

• Performance of a contract: to provide the Service you or your organization have signed up for.
• Legitimate interests: to secure, maintain, and improve the Service, and to communicate with you, provided these interests are not overridden by your rights.
• Consent: where you provide optional information or where consent is otherwise required; you may withdraw consent at any time.
• Legal obligation: where we must process information to comply with applicable law.

4. How We Share Your Information

We do not sell your personal information. We share information only as described below.

Within your organization

Information you enter is visible to authorized members of your organization according to their role. For example, organization owners can view customers, contacts, deals, and tasks relevant to the organization.

Service providers (subprocessors)

• Cloud hosting providers, located in the United States.
• Google (Sign in with Google): authentication, when you choose to sign in with Google.
• Resend: delivery of transactional emails.

Legal and safety

We may disclose information if required by law, regulation, legal process, or governmental request, or where necessary to protect the rights, property, or safety of DataThink, our users, or others.

Business transfers

If DataThink is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to this Privacy Policy.

5. Cookies and Similar Technologies

We use a small number of cookies, all of which are necessary for the Service to function or to remember your preferences:

• Essential authentication cookies set when you sign in, which keep you logged in. These are HttpOnly cookies.
• Functional preferences, such as your selected theme and sidebar state.

We do not use cookies for advertising or cross-site tracking. Because our cookies are strictly necessary or functional, the Service may not work properly if you block them.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service.

When your account is deactivated, we remove your sign-in credentials and active sessions. Certain records, such as customer and deal history, may be retained in the organization on your behalf where necessary for legitimate business, accounting, or legal purposes.

7. Data Security

We take reasonable measures to protect your information, including encryption of data in transit, hashing of passwords, HttpOnly session cookies, role-based access controls, and organization-scoped data access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please use a strong, unique password and keep your credentials confidential.

8. Your Privacy Rights

You can access and update much of your information directly through your profile and settings. You may also contact us to exercise your rights.

EEA and UK (GDPR)

If you are in the EEA or UK, you have the right to access, correct, delete, restrict, or object to the processing of your personal information, the right to data portability, and the right to withdraw consent. You also have the right to lodge a complaint with your local data protection authority.

California (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use and disclose it, the right to request deletion or correction of your personal information, and the right not to be discriminated against for exercising your rights. We do not sell your personal information and we do not share it for cross-context behavioral advertising. You may use an authorized agent to submit a request on your behalf.

To exercise any of these rights, contact us using the details below. We will verify your request and respond within the timeframes required by applicable law. Note that for information entered by an organization, we may direct your request to that organization as the controller of that data.

9. International Data Transfers

We are based in the United States and process and store information there. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. Where required, we rely on appropriate safeguards, such as standard contractual clauses, for international transfers.

10. Children’s Privacy

The Service is intended for use by businesses and adults. It is not directed to children, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us so we can delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above. If we make material changes, we will provide additional notice as required by law. Your continued use of the Service after an update means you accept the revised policy.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at:

mangelsona@datathink.dev
DataThink LLC