Privacy policy

1. Who we are

poun is run by [legal name of the business], [postal address] (“poun”, “we”, “us”). For the data described in this policy, we are the controller: we decide why and how it’s used.

For anything about your data, write to [contact email]. A person reads every message.

2. What this policy covers

This policy covers personal data about:

• people who visit this website or join the waitlist;
• our customers once poun opens: the people who sign up, their teammates and whoever manages billing.

Your customers’ data is different

Our customers use poun to run status pages, feedback boards and forms for their own customers. When someone subscribes to one of those status pages, posts or votes on one of those boards, or answers one of those forms, the company running it is the controller of that data and poun is its processor. We only use that data to run the service for that company, under our data processing agreement.

If that’s you, please contact the company whose page or form you used. Their privacy policy applies. If you can’t reach them, write to us and we’ll pass your request on.

3. What we collect

When you join the waitlist

• your email address;
• which tools you ticked, if any (status page, feedback board, forms);
• which of the two sign-up forms you used, and when you signed up.

When you visit the website

Like every website, our hosting provider records technical details of each request so the site can be delivered and protected from abuse: IP address, browser and device type, the page requested, the referring page and the time. We don’t use these logs to build profiles of visitors.

Our fonts are served from our own servers, so loading the site doesn’t send your IP address to a font provider.

When you write to us

Your name, email address and whatever you choose to tell us.

When poun opens and you use the service

• Account details: your name and email address. If you sign in with Google, we receive your name, email address and profile picture from Google. If you use a password, we store only a salted, one-way hash of it (scrypt), never the password itself.
• Billing details: your billing name, address, country and tax ID. Payments are taken by Stripe; we never see or store full card numbers, only the card brand, last four digits and expiry date.
• What you create: your workspace, components, incidents, boards, posts, forms, settings and anything else you put into poun.
• Usage records: which tools you use and how close you are to your plan’s limits, and security logs such as sign-ins and changes to settings.

What we don’t collect

No analytics or advertising trackers, no tracking cookies, no device fingerprinting, and no data bought from brokers or lists.

4. Why we use it, and our legal basis

Data protection law (including the GDPR and UK GDPR) asks us to name a legal basis for each use. Here they are:

Where we rely on legitimate interests, we’ve checked they don’t override your rights. You can object at any time (see your rights).

What we will never do

• sell or rent personal data, or share it for advertising;
• email our customers’ subscribers, voters or respondents for our own purposes;
• use what you or your customers put into poun to train AI models;
• make decisions about you by automated means that have legal or similarly significant effects.

5. Who we share it with

• Service providers that help us run poun, such as hosting, database, email and payments. They may only use the data to provide their service to us. They’re all listed, with what they do and where, on our subprocessors page.
• Professional advisers, such as accountants and lawyers, under a duty of confidentiality.
• Authorities, when the law requires it. We’ll push back on requests that aren’t lawful, and tell you about a request unless the law forbids it.
• A buyer or successor, if poun is sold or merged. They would be bound by this policy, and we’d tell you before your data moved.

6. International transfers

Some of our providers process data in the United States or elsewhere outside the UK and European Economic Area. When that happens, we rely on an adequacy decision (such as the EU–US Data Privacy Framework, for providers certified under it) or on the European Commission’s Standard Contractual Clauses and the UK’s International Data Transfer Addendum, with extra safeguards where needed. You can ask us for a copy of the relevant safeguards.

7. How long we keep it

8. Your rights

Depending on where you live, you have the right to:

• get a copy of the personal data we hold about you;
• have it corrected if it’s wrong;
• have it deleted;
• restrict or object to how we use it, including any use based on legitimate interests;
• receive it in a portable, machine-readable format;
• withdraw consent at any time, which doesn’t affect what we did before you withdrew it.

To use any of these, write to [contact email]. We may ask you to confirm it’s really you, and we’ll answer within one month (45 days where US state law applies). It’s free.

Leaving the waitlist takes one email to us, or a reply to any email we send you. We delete your entry straight away.

If you’re in the UK or EU

You can complain to a data protection authority, such as [data protection authority] or the one where you live or work. We’d appreciate the chance to put things right first.

If you’re in California or another US state with a privacy law

You have the right to know what we collect and why, to delete it, to correct it, and to opt out of its sale or sharing for targeted advertising. We don’t sell or share personal data in that way, and we don’t use sensitive personal information to infer things about you. We won’t treat you differently for using these rights. An authorised agent can make a request for you, with your written permission.

9. Cookies and browser storage

This website sets no cookies. If you switch to dark mode, your browser remembers that choice locally, and it’s never sent to us. When the service opens, signing in uses a strictly necessary session cookie. The details are on our cookies page.

10. Children

poun is a tool for businesses and isn’t meant for anyone under 16. We don’t knowingly collect data from children. If you think a child has given us their data, tell us and we’ll delete it.

11. Security

Every connection to poun is encrypted (HTTPS), data is encrypted at rest by our database provider, passwords are stored only as salted one-way hashes, sign-in attempts are rate-limited, and only people who need access to do their job have it. No system is perfectly secure. If a breach puts your data at risk, we’ll tell you and the authorities as the law requires.

12. Changes to this policy

When we change this policy, we’ll update the date at the top. If a change matters, for example a new use of your data, we’ll email account holders at least 30 days before it takes effect. We’ll never use data collected under this policy in a new way without telling you first.

13. Contact

Questions, requests or complaints: [contact email], or write to [legal name of the business], [postal address].