Privacy Policy

3.1 Account and profile data

When you create an account or are invited to a workspace, we collect information necessary to establish and manage your identity within the Service.

• Full name, email address, and password or authentication credentials.
• Profile photo or avatar, if you choose to upload one.
• Role assignments and permission levels within workspaces and teams.
• Workspace membership history, including join dates and invitation details.
• Authentication method preferences (email/password, single sign-on, OAuth providers).
• Timezone, language, and notification preferences.

3.2 Billing and payment data

When you subscribe to a paid plan or make a purchase, we collect information needed to process payments and manage your subscription.

• Billing name, billing address, and company name.
• Subscription plan selection, billing cycle (monthly or annual), and plan change history.
• Payment method type and last four digits of card number (we never store full card numbers; payment processing is handled by Stripe, our PCI-DSS compliant payment processor).
• Invoice history, payment status, receipt records, and refund history.
• Tax identification numbers where required by applicable law.

3.3 Customer and operational data

As you use the Service for invoice operations and related workflows, you create and manage different categories of business data.

• Customer records, including names, email addresses, phone numbers, company information, and payment histories that you import or create.
• Invoice data, including line items, amounts, due dates, payment terms, delivery methods, and status histories.
• Transaction records, including payment amounts, dates, methods, and reconciliation status.
• Workflow definitions, including reminder and follow-up workflows, automation rules, triggers, conditions, wait states, and action configurations.
• Workflow execution logs, including run timestamps, node traversal paths, action outcomes, and error records.
• Communication histories, including invoice-related emails and other messages sent through the Service.
• Template configurations for invoices, emails, and other document types.
• Export records and data extraction histories.

3.4 Technical and usage data

We automatically collect technical and usage information when you access or interact with the Service.

• IP address, browser type and version, operating system, and device type.
• Referring URL, pages visited within the Service, and navigation paths.
• Session duration, feature usage patterns, and click interactions.
• Screen resolution, viewport size, and connection type.
• Error logs, crash reports, and performance diagnostics.
• API call logs, including endpoints accessed, request timestamps, and response codes.
• Authentication events, including login attempts, session creation, and session expiration.

3.5 Integration data

When you connect third-party services to the Service, we collect data from those services as directed by you.

• Payment provider data from Stripe and other connected payment services, including transaction details, customer payment method metadata, and dispute information.
• Data from other supported integrations that you choose to connect, which may include client records, billing records, and workflow-related data needed to operate the integration.
• OAuth tokens and API credentials necessary to maintain integrations (stored encrypted).

3.6 Support and communications data

When you interact with our support team or communicate with us, we collect information related to those interactions.

• Support ticket content, including descriptions, attachments, and resolution notes.
• Live chat transcripts and email correspondence.
• Feedback and survey responses.
• Onboarding session notes and setup assistance records.
• Feature requests and bug reports submitted through any channel.

3.7 Cookies and tracking technologies

We use cookies and similar technologies to collect certain information automatically. See Section 6 (Cookies and similar technologies) for full details on the types of cookies we use, their purposes, and how you can manage them.

4.1 Provide and operate the Service

We use your information to deliver the core functionality of the Service, including account provisioning, workspace creation, data storage, and access to features within your subscription plan.

4.2 Authentication and access control

We process authentication credentials, session data, and role assignments to verify your identity, manage workspace access permissions, enforce team-level access controls, and maintain session security.

4.3 Workflow execution and automation

We process workflow definitions, client data, invoice records, and trigger conditions to run reminder and follow-up workflows, send automated communications, apply scheduled actions, and maintain run history for auditability.

4.4 Billing and subscription management

We use billing information to process subscription charges, generate invoices and receipts, manage plan upgrades and downgrades, handle cancellations, process refunds, and comply with tax reporting requirements.

4.5 Customer support and incident response

We use account information, usage data, and communication records to respond to support requests, diagnose and resolve technical issues, provide onboarding assistance, and communicate about service incidents or maintenance.

4.6 Security, fraud detection, and abuse prevention

We use technical data, authentication logs, and usage patterns to detect and prevent unauthorized access, identify potentially fraudulent activity, enforce acceptable use policies, protect the integrity of the Service, and respond to security incidents.

4.7 Product analytics and improvement

We use aggregated and anonymized usage data to analyze how features are used, identify areas for improvement, measure product performance, prioritize development efforts, and improve the overall user experience. We do not use customer operational data (your customers' data) for product analytics.

4.8 Legal compliance and reporting

We process information as necessary to comply with applicable laws, regulations, legal processes, and governmental requests, including tax reporting, financial record-keeping, audit requirements, and responses to lawful subpoenas or court orders.

4.9 Communications

We use your contact information to send transactional communications (account confirmations, password resets, billing notifications, security alerts), product updates and service announcements, and, where you have opted in, marketing communications about new features, tips, and offers. You can opt out of marketing communications at any time through your account settings or by following the unsubscribe link in any marketing email.

5.1 Performance of a contract

We process personal data where necessary to perform our contract with you or to take steps at your request before entering into a contract. This includes providing the Service, managing your account, processing payments, executing workflows, and delivering customer support.

5.2 Legitimate interests

We process personal data where necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms. Our legitimate interests include securing and maintaining the Service, preventing fraud and abuse, improving product functionality, conducting aggregated analytics, enforcing our terms, and communicating product updates. We conduct balancing tests to ensure our legitimate interests do not override your fundamental rights.

5.3 Legal obligations

We process personal data where necessary to comply with legal obligations to which we are subject, including tax reporting, financial record-keeping, responding to valid legal process, and complying with applicable regulatory requirements.

5.4 Consent

Where required by law, we obtain your consent before processing personal data for specific purposes, such as sending marketing communications, placing non-essential cookies, or processing special categories of data. Where we rely on consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6.1 Strictly necessary cookies

These cookies are required for the Service to work properly and cannot be disabled through our cookie settings. They support authentication, session continuity, security safeguards, and traffic routing.

• Session cookies that maintain your authenticated state as you navigate the Service.
• CSRF (Cross-Site Request Forgery) tokens that protect against unauthorized actions.
• Load balancer cookies that route requests to appropriate servers.
• Cookies that store your cookie preferences.

6.2 Functional cookies

These cookies remember settings and help the Service feel more consistent between visits. The Service can operate without them, but some features may not work as expected.

• Preference cookies that store your language, timezone, and display settings.
• Feature state cookies that remember sidebar states, table configurations, and view preferences.
• Recently viewed items cookies that provide quick access to recently accessed records.

6.3 Analytics cookies

These cookies help us understand how people use the Service so we can improve performance and usability. Where practical, we use aggregated or pseudonymized data for this purpose.

• Page view tracking to understand which features are most used.
• Session duration and navigation path analysis to improve user experience.
• Error and performance monitoring to identify and resolve issues.
• Feature adoption metrics to inform product development priorities.

6.4 Marketing cookies

We may use marketing cookies to measure campaign effectiveness and show more relevant advertising. Where consent is required, we will set marketing cookies only after you have provided it.

6.5 Cookie duration

Session cookies are temporary and are deleted when you close your browser. Persistent cookies remain on your device for a defined period or until you delete them. Authentication cookies typically persist for up to 30 days, while analytics and preference cookies typically persist for up to 12 months.

6.6 Managing cookies

You can manage cookies through your browser settings and, where available, through our cookie banner. Most browsers let you block or delete cookies, set site-specific preferences, and browse in a private or incognito mode. Please note that blocking essential cookies may prevent the Service from functioning properly.

6.7 Do Not Track

Some browsers transmit a Do Not Track (DNT) signal. Because there is no consistent industry standard for responding to DNT signals, we do not currently change our data collection or use practices in response to them. If a uniform standard is adopted, we may update this policy accordingly.

7.1 Infrastructure and hosting providers

We use third-party cloud infrastructure, hosting, database, and content delivery services to operate the Service. These providers process data on our behalf under data processing agreements and are contractually prohibited from using your data for their own purposes.

7.2 Payment processors

We use Stripe as our primary payment processor. When you provide payment information, it is transmitted directly to Stripe, which is PCI-DSS Level 1 certified. Stripe processes payment data in accordance with its own privacy policy. We receive only limited payment information from Stripe (such as last four digits, card brand, and payment status) necessary to manage your subscription.

7.3 Analytics providers

We use analytics services to understand Service usage and improve product quality. These providers receive aggregated or pseudonymized usage data and are contractually restricted from using this data for purposes beyond providing analytics services to us.

7.4 Communication and email service providers

We use third-party services to send transactional emails, support communications, and, where you have opted in, marketing emails. These providers process email addresses and message content on our behalf and under our instructions.

7.5 Integration partners

When you connect third-party services, data is shared with those services at your direction and in accordance with the integration you configure. Eigenn is not responsible for how a third-party service handles data once it leaves the Service.

7.6 Professional advisors and auditors

We may share information with our legal counsel, accountants, auditors, and other professional advisors who need the information to provide services to us. These parties are bound by professional duties of confidentiality.

7.7 Law enforcement and legal obligations

We may disclose information where required by law, regulation, legal process, or governmental request, including in response to lawful subpoenas, court orders, or other compulsory legal process. We may also disclose information where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Eigenn, our users, or the public, or to detect, prevent, or address fraud, security issues, or technical problems.

7.8 Business transfers

If Eigenn is involved in a merger, acquisition, reorganization, asset sale, bankruptcy, or similar business transaction, your information may be transferred as part of that transaction. We will provide notice before your personal data is transferred and becomes subject to a different privacy policy. Any successor entity will be bound by the terms of this Privacy Policy with respect to previously collected data.

7.9 With your consent

We may share information with third parties when you have given us explicit consent to do so, or when sharing is initiated by you through the Service (for example, when you share a report or export data to an external destination).

9.1 Retention periods by data category

• Account and profile data: retained for the duration of your account and for up to 30 days after account deletion to allow for reactivation, then deleted or anonymized.
• Billing and payment data: retained for the duration of the business relationship plus 7 years to comply with tax and financial record-keeping requirements.
• Customer and operational data: retained for the duration of your subscription. Upon cancellation or termination, you may export your data within 30 days. After the export window, data is deleted within 90 days, subject to legal hold or regulatory requirements.
• Technical and usage data: retained for up to 24 months for analytics purposes, then aggregated or deleted. Server logs are retained for up to 90 days for security and debugging purposes.
• Support and communications data: retained for 3 years after resolution for quality assurance and training purposes, then deleted.

9.2 Criteria for determining retention

When determining how long to retain specific categories of data, we consider the volume, nature, and sensitivity of the data; the potential risk of harm from unauthorized use or disclosure; the purposes for which we process the data and whether we can achieve those purposes through other means; applicable legal, regulatory, tax, accounting, or other requirements; and outstanding litigation, regulatory investigation, or audit needs.

9.3 Deletion and anonymization

When data reaches the end of its retention period, we securely delete it or anonymize it so that it can no longer be associated with you. Anonymized data may be retained indefinitely for statistical and analytical purposes.

10.1 Technical safeguards

• Encryption of data in transit using TLS 1.2 or higher for all connections to the Service.
• Encryption of data at rest using AES-256 or equivalent encryption standards for stored data.
• Secure credential storage using industry-standard hashing algorithms (bcrypt or equivalent) for passwords.
• Network segmentation and firewall protections to isolate service components.
• Automated vulnerability scanning and regular penetration testing of the Service.
• Rate limiting, brute-force protection, and anomaly detection on authentication endpoints.
• Encrypted backups with tested restoration procedures.

10.2 Administrative safeguards

• Role-based access controls limiting employee access to personal data based on job function and need-to-know principles.
• Background checks for employees with access to personal data, where permitted by law.
• Regular security awareness training for all employees.
• Incident response plan with defined procedures for detecting, reporting, investigating, and remediating security incidents.
• Vendor risk assessment program for third-party service providers that process personal data.
• Data processing agreements with all sub-processors.

10.3 Organizational safeguards

• Information security policies reviewed and updated regularly.
• Logging and monitoring of access to systems containing personal data.
• Change management procedures for infrastructure and application modifications.
• Business continuity and disaster recovery planning.

10.4 Your responsibilities

Security is a shared responsibility. You are responsible for maintaining the confidentiality of your account credentials, configuring appropriate access controls within your workspace, ensuring that team members have appropriate permission levels, and promptly reporting any suspected unauthorized access to your account. We recommend enabling all available security features, including strong passwords and, when available, multi-factor authentication.

12.1 Right of access

You have the right to request confirmation of whether we process your personal data and, if so, to request a copy of that data along with information about the purposes of processing, the categories of data concerned, the recipients or categories of recipients, the retention periods, and the source of the data.

12.2 Right to rectification

You have the right to request correction of inaccurate personal data and, taking into account the purposes of processing, the completion of incomplete personal data.

12.3 Right to erasure

You have the right to request deletion of your personal data where the data is no longer necessary for the purposes for which it was collected, you withdraw consent and there is no other legal basis for processing, you object to processing and there are no overriding legitimate grounds, the data has been unlawfully processed, or the data must be erased to comply with a legal obligation. This right is not absolute and may be limited by legal obligations, exercise or defense of legal claims, or public interest considerations.

12.4 Right to restriction of processing

You have the right to request restriction of processing where you contest the accuracy of the data (for a period enabling verification), the processing is unlawful and you oppose erasure, we no longer need the data but you require it for legal claims, or you have objected to processing pending verification of whether our legitimate grounds override yours.

12.5 Right to data portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller without hindrance, where processing is based on consent or contract and is carried out by automated means.

12.6 Right to object

You have the right to object to processing based on legitimate interests or public interest. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims. You have an absolute right to object to processing for direct marketing purposes at any time.

12.7 Rights related to automated decision-making

You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you. Eigenn does not currently make automated decisions that produce legal effects on individuals. If this changes, we will update this policy and provide appropriate safeguards, including the right to obtain human intervention, express your point of view, and contest the decision.

12.8 Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority in the EU or UK member state where you reside, work, or where the alleged infringement occurred. While we encourage you to contact us first so we can address your concerns directly, this right exists independently of any other remedy.

13.1 Categories of personal information

In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA: identifiers (name, email, IP address, account identifiers); commercial information (subscription records, billing history, purchase details); internet or electronic network activity (browsing history within the Service, search history, interaction data); professional or employment-related information (job title, company, role); and inferences drawn from the above categories to create a profile about preferences and characteristics.

13.2 Right to know and access

You have the right to request that we disclose the categories of personal information collected, the categories of sources, the business or commercial purposes for collection, the categories of third parties with whom we share personal information, and the specific pieces of personal information collected about you.

13.3 Right to delete

You have the right to request deletion of personal information we have collected from you, subject to certain exceptions, including where retention is necessary to complete a transaction, provide the Service, detect security incidents, comply with legal obligations, or exercise free speech or other legal rights.

13.4 Right to correct

You have the right to request correction of inaccurate personal information that we maintain about you, taking into account the nature of the personal information and the purposes of processing.

13.5 Right to opt out of sale or sharing

We do not sell personal information as defined by the CCPA. We do not share personal information for cross-context behavioral advertising purposes. If our practices change, we will update this policy and provide a "Do Not Sell or Share My Personal Information" link on our website.

13.6 Right to limit use of sensitive personal information

To the extent we collect sensitive personal information as defined by the CCPA, we use it only for purposes authorized by the CCPA, such as providing the Service and maintaining security.

13.7 Non-discrimination

We will not discriminate against you for exercising your CCPA rights. We will not deny you the Service, charge you different prices, provide a different level of quality, or suggest that you will receive a different price or level of quality for exercising your rights.

13.8 Authorized agents

You may designate an authorized agent to make requests on your behalf. Authorized agents must provide signed written authorization or power of attorney. We may require you to verify your identity directly even when using an authorized agent.

13.9 Shine the Light

Under California Civil Code Section 1798.83, California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

14.1 Virginia (VCDPA)

Virginia residents have rights to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of processing for targeted advertising, sale of personal data, and profiling with legally or similarly significant effects. To appeal a denial of a rights request, contact us using the information in Section 21.

14.2 Colorado (CPA)

Colorado residents have rights to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of processing for targeted advertising, sale of personal data, and profiling with legally or similarly significant effects. You may appeal a denial to the Colorado Attorney General.

14.3 Connecticut (CTDPA)

Connecticut residents have rights to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of processing for targeted advertising, sale of personal data, and profiling with legally or similarly significant effects.

14.4 Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), and others

Residents of these and other states with comprehensive privacy laws have similar rights to access, delete, and port their data, and to opt out of targeted advertising and sale. Because these laws continue to evolve, contact us for the most current information about rights available in your jurisdiction.