Effective 11 November 2026
Privacy
Yolleg Ltd · Company 10455920 · 71–75 Shelton Street, London, England WC2H 9JQ, United Kingdom · [email protected].
Data and purpose
We process email-account details, essential session identifiers, one-use matching-email sign-in challenges, organisation records, project/task/dependency/milestone data, assignments, reported work, source files, versioned history, staff invitations/roles, consent, billing references and support messages. Use minimal authorised business references. Do not store credentials, identity documents, health/HR files, private legal case material or payment-card details.
Protection and processors
Account email/key fields, organisation payloads, original bytes and filenames are encrypted at rest. This is not end-to-end encryption; authorised support can decrypt records. HTTPS protects transfer. Stripe or the existing private Labs billing service supplies hosted payment processing; full card data is not stored by this app. SendGrid handles account and transactional mail, with tracking disabled. No advertising trackers, analytics SDK, third-party fonts or cloud AI processing of customer workspace records.
Cookies and retention
Necessary HttpOnly, SameSite session cookies last up to seven days and are Secure on HTTPS. Sign-in links expire after 15 minutes and are one-use. Organisation records and originals remain until erased/account deletion, subject to service availability and capacity. Operational maintenance cleans expired links/invitations/sessions and retains protected backup snapshots under configured policy; precise provider backup geography/deletion timing must be confirmed by the operator. Contract/declaration records may remain up to six years for accounting or disputes. Contact/security/contract records may include information outside encrypted payloads. A pending private project route may be held in sessionStorage during sign-in; production records are server-stored, not browser-only.
Your choices
Export your records, download originals, revoke your sessions and staff access, erase your workspace, cancel renewal or request account deletion/access/correction/restriction/objection/portability at [email protected]. Erasure does not cancel billing. No data sales. You may complain to the UK ICO or your local supervisory authority. External references use their own privacy policies. Earlier interest-list consent is separate from account/subscription consent and can be withdrawn through support.