Privacy Policy
What personal data Everdeck collects, why, and your rights under the PDPA, GDPR and CCPA.
Draft for review. This policy is a draft pending review by a Singapore-qualified lawyer. It is not final and may change before Everdeck launches.
This Privacy Policy explains how FLOW FN PTE. LTD. (UEN 202617303Z), a company incorporated in Singapore ("FLOW FN", "we", "us"), collects, uses, discloses and protects personal data in connection with Everdeck and our website.
1. Who this policy covers
It covers people who visit our website, contact us, sign up for Everdeck, or are invited to an Everdeck account ("you").
It does not cover personal data that our customers process through Everdeck, such as the tasks, emails and customer records their agents handle. Our customer decides how that data is used and is responsible for it, and we process it for them under our Data Processing Agreement. For questions about that data, contact the organisation that uses Everdeck.
2. Personal data we collect
Account data. Your name, email address and password, which we store only as a one-way hash. The organisation you sign up for and your role in it. Your notification choices. If you link your Slack account to decide approvals in Slack, the Slack workspace and member id it belongs to, and your name in Slack.
Security data. Your two-factor settings (authenticator secrets are stored encrypted, recovery codes only as hashes, and passkeys as public keys), sign-in events, active sessions, IP addresses and browser details.
Consent records. Which version of our Terms of Service and Privacy Policy you accepted, when, and from which IP address and browser.
Billing data. Your billing contact, invoices and subscription status. Stripe collects and holds card details; we never see the card number. Of a card used for a free trial we keep only a one-way hash of the fingerprint Stripe gives us, which we use to stop the same card being used for more than one free trial. We also record which account owners have had a free trial, so each person has one.
Messages. What you send us through the contact form or by email, and our replies.
Technical data. Server logs with request details such as IP address, pages requested and times. We remove secrets from logs, such as the tokens in password reset and invitation links.
Cookies. Essential cookies only. See our Cookie Policy.
We do not use advertising trackers, and we do not sell personal data.
3. How we use personal data, and why
| Purpose | Data | Legal basis where the GDPR applies |
|---|---|---|
| Create and run your account and provide Everdeck | Account and security data | Performing our contract with you or your organisation |
| Keep accounts and the service secure, and prevent fraud and abuse, including of free trials | Security and technical data, card fingerprint | Our legitimate interest in a secure, fair service |
| Bill for subscriptions and keep financial records | Billing data | Contract; legal obligation |
| Send service messages, such as verification codes, security alerts, trial reminders, and the notifications you choose, such as approvals waiting for you and spending alerts | Account data | Contract; legitimate interests |
| Reply to your enquiries | Messages | Legitimate interests; steps before entering a contract |
| Record acceptance of our terms | Consent records | Legal obligation; legitimate interests |
| Comply with the law and enforce our terms | Any of the above, as needed | Legal obligation; legitimate interests |
We do not make decisions about you by automated means that have legal or similarly significant effects.
4. AI and your data
We do not use personal data or customer content to train or fine-tune AI models.
When a customer's agents use an AI model, the content they send goes to the model provider the customer chose, using the customer's own key and under the customer's agreement with that provider.
Knowledge and memory search use one embedding provider of ours, OpenAI, listed on our Subprocessors page. When we have switched it on with our own key, we send it the text of the documents a customer adds to knowledge, the memory notes agents save (which can include people's names and contact details) and the search queries agents and people type, so that they can be found by meaning. We choose a provider whose terms do not allow it to train on that content. Without that key, search matches words only and none of this text is sent.
5. Who we share personal data with
- Our service providers, who process data for us under contract. They are listed on our Subprocessors page.
- Your organisation. If you are invited to an Everdeck account, its owners and admins can see your name, email address, role and activity in that account.
- Professional advisers, such as lawyers, auditors and insurers, under a duty of confidentiality.
- Authorities, where the law requires it, or where needed to protect the rights and safety of people or the security of our service.
- A successor, if our business is reorganised, merged or sold, who must keep to this policy.
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
6. Where we store it
We store Everdeck data in Singapore. Some service providers process limited data in other countries: Stripe and Cloudflare, and our embedding provider, OpenAI, which receives the text described in section 4 in the United States. When we transfer personal data out of Singapore, we make sure the recipient protects it to a standard comparable to the PDPA, through contractual terms. For transfers from the European Economic Area, the United Kingdom or Switzerland, we rely on the applicable standard contractual clauses or another lawful transfer mechanism.
7. How long we keep it
We keep personal data only for as long as we need it for the purposes above, or as the law requires. Our Data Retention Schedule sets out the periods; for example, sign-in history is kept for one year and billing records for five years.
8. How we protect it
Data is encrypted in transit and at rest. Secrets such as authenticator keys are encrypted with keys protected by AWS KMS. So are the credentials a customer gives Everdeck to connect its apps (API keys, passwords, tokens and OAuth app secrets): they are never shown again after they are saved, and they are deleted when the app is disconnected.
Staff access is limited, logged and read-only unless a change is needed. Our staff use a separate console with its own sign-in, a password and an authenticator code. Every staff sign-in and every staff action is recorded in an audit trail that can't be changed or deleted, and every change staff make to a customer's account, and every time staff open the content of an agent's session, also appears in that account's own audit log. The account's owners and admins can read every one of those entries on the Audit log page in Everdeck, and the people in a company see the ones about that company. Our Security Overview describes our controls.
9. Your rights
Depending on where you live, you may have the right to:
- ask for a copy of the personal data we hold about you, and how we have used and disclosed it in the past year;
- ask us to correct data that is inaccurate or incomplete;
- ask us to delete your data;
- receive your data in a portable format;
- object to, or ask us to restrict, certain processing;
- withdraw consent where we rely on it.
You can change your name and security settings in your profile. For anything else, email [email protected]. We verify your identity before acting on a request and reply within 30 days, or sooner where the law requires. Where the law allows us to refuse or limit a request, we will tell you why.
If you are a member of a customer's account and your request concerns data that the customer controls, we will pass it to the customer and help them respond.
10. Singapore (PDPA)
We comply with the Personal Data Protection Act 2012 of Singapore. You may ask to access or correct your personal data. You may withdraw your consent to our collecting, using or disclosing it by giving us reasonable notice; we will tell you the likely consequences, which may include that we can no longer provide the service to you.
Our Data Protection Officer can be reached at [email protected].
If we assess that a data breach is notifiable, we notify the Personal Data Protection Commission within 3 calendar days of that assessment, and the affected individuals where required. If you are not satisfied with how we handle your personal data, you may complain to the Personal Data Protection Commission.
11. European Economic Area and United Kingdom (GDPR)
Where the EU or UK General Data Protection Regulation applies, FLOW FN is the controller of the personal data this policy describes, and section 3 sets out our legal bases. In addition to the rights in section 9, you may complain to your local data protection authority. If we are required to appoint a representative in the EU or the UK, we will name them here.
12. California (CCPA)
This section applies to California residents under the California Consumer Privacy Act, as amended.
What we collect. In the past 12 months we have collected: identifiers (name, email address, IP address); commercial information (subscription and billing records); internet or other network activity (sign-in events and logs); professional information (your organisation and role); and sensitive personal information limited to account sign-in credentials. We collect it from you, your organisation and your browser, for the purposes in section 3, and keep it for the periods in section 7.
What we disclose. We disclose these categories to service providers for business purposes. We do not sell personal information or share it for cross-context behavioural advertising, and have not done so in the past 12 months. We do not knowingly collect personal information from anyone under 16. We use sensitive personal information only to provide and secure the service.
Your rights. You may ask to know, delete and correct your personal information, and we will not discriminate against you for doing so. Email [email protected]. An authorised agent may make a request for you with proof of their authority. We verify requests by matching them to information in your account.
13. Children
Everdeck is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children.
14. Changes to this policy
We post changes here with a new version date. If a change is material, we tell account owners by email at least 30 days before it takes effect.
15. Contact
FLOW FN PTE. LTD., Singapore. Data Protection Officer: [email protected].