Privacy Policy

1. Who We Are

This policy covers the Astuto instance that we host and operate ourselves ("Service"). Because the Service is self-hosted, we control all processing and act as the data controller. Data stays on our infrastructure unless we intentionally route it to integrations.

2. Data We Collect

Account and profile information such as name, email address, password hash, avatar URL, preferred language, and organization details.
Authentication data including OAuth provider identifiers (if single sign-on is enabled), session tokens, and access logs needed for security.
Feedback content including posts, comments, attachments, votes, roadmap subscriptions, moderation decisions, and metadata submitted through forms.
Administrative data such as tenant/site settings, webhook endpoints, API keys, and billing contacts (if billing features are enabled).
Usage and technical data such as timestamps, browser and device details, referrer, IP address, and application/server logs used for diagnostics and abuse prevention.

We do not intentionally collect sensitive personal data; users should avoid submitting it in feedback.

3. How We Use the Data

Provide, operate, and secure the Service.
Authenticate users, authorize actions, and prevent fraud or abuse.
Display boards and roadmaps, send recap or notification emails, and run community features.
Offer support, respond to requests, and moderate submissions.
Generate aggregated analytics that help improve the Service. Aggregated insights no longer identify individuals.
Comply with legal obligations and enforce our terms.

We never sell personal data or use it for advertising.

4. Legal Bases (GDPR/UK GDPR)

Contract: running user accounts, processing feedback, and delivering requested features.
Legitimate interests: securing the platform, preventing fraud, and understanding usage to improve the Service.
Consent: optional integrations or communications that users opt into (withdraw anytime via settings or by contacting us).
Legal obligation: maintaining records required by law.

5. Cookies and Tracking

We use only essential cookies or local storage entries to keep users signed in and remember interface preferences. No third-party advertising cookies run unless we explicitly add them and update this notice. Blocking cookies may prevent authentication or voting from working correctly.

6. Data Sharing and Processors

Data remains on our servers. We may share limited data with:

Email or SMS vendors configured to send notifications.
Infrastructure partners (for example, hosting providers) bound by contractual safeguards.
Optional integrations (webhooks or APIs) that send specific feedback content to tools such as Jira or Slack, according to our configuration.

We require processors to implement adequate security and never disclose data for unrelated purposes unless legally required.

7. International Transfers

If we host or back up data outside the user's jurisdiction, we rely on safeguards such as Standard Contractual Clauses or choose regions aligned with local privacy laws. Users can contact us to learn where their data is stored.

8. Data Retention

We keep personal data only as long as needed to deliver the Service, maintain legitimate business records, or meet legal obligations. Users may request deletion of their account and related feedback. Aggregated or anonymized data may be retained indefinitely.

9. Security

Safeguards include HTTPS, hashed passwords, role-based access, logging, monitoring, and backups. No system is completely secure, so users should choose strong passwords and keep credentials safe.

10. Individual Rights

Depending on jurisdiction, users can request access, correction, deletion, restriction, portability, or object to certain processing, and may lodge complaints with supervisory authorities. Submit requests via the contact details below; we verify identity and respond within required timeframes.

11. Children

The Service is not intended for individuals under 16 (or the locally applicable minimum). If we learn that a minor has provided data, we delete it.

12. Changes

We may update this policy for legal or service changes. We will revise the effective date and notify users of material updates via the Service or email where appropriate.