Privacy Policy

Who is responsible for your information?

UserGist is a product name. The full legal name, registration details, business address, and applicable privacy representatives of its operator must be confirmed before this notice becomes effective. Contact the existing UserGist sales address below for current arrangements.

For website enquiries, account administration, billing relationships, and protecting our service, the UserGist operator generally determines how information is used. For information collected through a customer’s app, survey, SDK integration, or portal, that customer generally determines the purpose and UserGist processes it on their instructions. A customer may itself act for another organisation. The applicable Data Processing Addendum governs that relationship.

If you responded to a survey, submitted feedback, or used an app that integrates UserGist, start with the organisation operating that app or portal. Its privacy notice explains its choices, lawful basis, and any additional integrations.

Information we handle

Why we use information

• Provide accounts, permissions, SDK ingestion, campaign targeting, surveys, feedback, notifications, portals, and customer support.
• Operate subscriptions, calculate usage, reconcile payments, communicate about the service, and maintain required financial records.
• Detect abuse, authenticate requests, investigate errors, secure the service, and keep records of important actions.
• Measure dashboard use through optional analytics when a user has opted in. Enabling essential service functions does not require this optional choice.
• Carry out a customer’s documented instructions, including exports, deletion requests, and transfers to integrations the customer enables.
• Meet legal obligations, respond to lawful requests, and establish or defend legal claims. Marketing communications require a separate appropriate legal basis and an available opt-out; creating an account is not blanket marketing consent.

Legal bases where GDPR or UK GDPR applies

For processing we control, the relevant basis depends on the activity. Contract applies when processing is necessary for a contract with you; legitimate interests may support business contact administration, service security, fraud prevention, and ordinary support where those interests are not overridden by your rights. Legal obligation applies to required records and disclosures. Consent applies to optional analytics and other activities for which it is required.

Where you act for an employer, managing that business relationship may rely on legitimate interests rather than a contract with you personally. We must document the applicable interests and assessments. You can object to processing based on legitimate interests and withdraw consent for future optional processing. Withdrawal does not affect earlier lawful processing.

Customers are responsible for selecting and communicating the lawful basis for their end-user data. SDK consent flags are technical controls; they do not by themselves establish valid legal consent or replace a customer’s notice.

Who receives information

Information is made available to authorised customer workspace members and providers needed to operate the service. Access depends on roles and configuration. Public requests, comments, roadmap content, changelogs, and help articles may be visible to anyone and may be indexed or copied. Private support conversations are intended for the customer’s authorised team, rather than a public request board.

Paddle may act as an independent controller for its merchant-of-record activities. WorkOS, delivery providers, and other vendors may also have independent obligations for some activities; their role depends on the service and contract. A vendor used for our own account administration is not automatically a subprocessor of all customer end-user data.

Customers can choose analytics destinations such as Amplitude or Mixpanel, push delivery through Apple or Google, and third-party AI clients. Those destinations receive the information necessary for the enabled feature under the customer’s instructions and the destination’s applicable terms. Disconnecting an integration does not itself erase data already delivered there.

The proposed policy is not to sell personal information or share it for cross-context behavioural advertising. This statement must be checked against actual vendor settings and business practices before release. We may disclose information when legally required, to protect rights and safety, or in a business transfer subject to applicable protections and notice obligations.

Cookies, local storage, and analytics

Authentication, security, user-selected preferences, offline SDK queues, and saved drafts can use cookies or other device storage. Optional dashboard analytics stays off until a user opts in. The current implementation does not enable session replay, advertising trackers, or automatic click/form capture. Choices can be changed from the dashboard’s privacy controls.

A customer integrating an SDK controls its activation, its notice, and its own consent experience. Push permission at the operating-system level is separate from a lawful basis for processing and the app’s notification preferences.

Processing locations and international transfers

UserGist uses providers with operations in multiple countries. A universal EU-only or Frankfurt-only storage guarantee is not made. The inventory identifies configuration evidence separately from locations still awaiting production and contract verification. A storage region does not necessarily limit a provider’s support access or all ancillary processing.

Where a restricted international transfer occurs, the parties must establish an applicable transfer mechanism, complete the necessary assessments, and apply supplementary measures where needed. These can include a valid adequacy decision or the appropriate standard contractual clauses and UK or Swiss adaptations. A link to a provider’s DPA does not prove that the required agreements have been executed for UserGist.

The operator’s own establishment and remote access locations also need confirmation. Request the safeguards applicable to your account using the contact below.

Retention and protection

Retention depends on the record, service configuration, customer instructions, and applicable legal requirements. Some analytics tables have timed expiry; core account, portal, and operational records do not all share those limits. We do not describe a short-lived export link as deletion of its underlying file.

The product includes authentication, permission checks, consent controls, audit records, and encryption of configured service credentials. Security and deletion require operational checks across databases, object storage, vendors, queues, and backups. No system is completely secure. The linked pages describe safeguards and limits without claiming an unverified certification.

Your choices and privacy rights

Depending on the law and context, you may request access, correction, deletion, restriction, portability, or an explanation of processing; object to certain processing; withdraw consent; and complain to your relevant supervisory authority. California and other US state laws may provide additional rights, including an appeal or opt-out of covered sale, sharing, or targeted advertising. These rights are subject to applicable conditions and exceptions.

We do not require optional analytics consent to provide the core service. Where a recognised opt-out preference signal applies, optional analytics should remain disabled. Our dashboard treats Global Privacy Control and Do Not Track as reasons to keep its optional analytics off.

For customer-controlled app or portal data, we assist the customer in handling your request. An unidentifiable visitor should not be required to create an account simply to make a request; we may need limited information to locate their app-scoped record safely.

Children and sensitive information

The proposed service is intended for business customers and adult account administrators. Customers must not use it to collect children’s personal data, special-category or similarly sensitive information, or regulated health/payment information unless a separate written arrangement and the necessary safeguards permit that use.

Do not put passwords, authentication secrets, full payment card details, government identifiers, or confidential health information into event properties or free-text responses. Property filtering is a safeguard, not a guarantee that arbitrary text contains no personal information. Contact us if you believe prohibited data or children’s data has been submitted.

Contact and changes

Contact [email protected] with the subject “Privacy request” or “Legal request”, as appropriate. Do not send passwords, API keys, payment card numbers, or identity documents in an initial message.

Material changes to an effective notice should be communicated appropriately and dated. A privacy notice describes processing; reading it or continuing to use a service is not consent to every optional use. This version remains a review draft until the operator and release details have been approved.