Privacy Policy

1. Who We Are

CollaboPoint ("we", "us", "our") operates the platform at www.collabopoint.com. We are committed to protecting your privacy and handling your personal data in an open and transparent manner. This Privacy Policy explains how we collect, use, share, and safeguard information about you when you use our services.

2. What Data We Collect

• Account information: name, email address, and (optionally) a profile photo and bio.
• Workspace data: documents, messages, files, calendar events, and other content you create.
• Technical data: a device identifier used for multi-factor authentication and trusted-device checks, and a push-notification token so we can deliver notifications. Our mobile app does not use third-party analytics, advertising, or tracking SDKs, and does not collect your location or device contacts.
• Payment data: billing name and address (processed by Apple, Google, or Stripe — we do not store full card numbers).
• Communications: emails sent to our support team.

3. How We Use Your Data

• To provide, maintain, and improve the CollaboPoint service.
• To authenticate your identity and secure your account.
• To send transactional emails (invitations, password resets, notifications).
• To personalise your experience and tailor AI suggestions.
• To monitor for security threats, abuse, and service integrity.
• To meet legal obligations and respond to lawful requests.

4. Legal Basis for Processing (UK & EU GDPR)

• Contract performance: processing required to provide the service you signed up for.
• Legitimate interests: fraud prevention, security monitoring, service improvement.
• Legal obligation: compliance with applicable laws and regulations.
• Consent: marketing communications (you may withdraw consent at any time).

5. Data Sharing and Disclosure

We do not sell your personal data. We share data only with trusted third-party service providers who help us operate the platform, including: Google Cloud Platform / Firebase (hosting, authentication, storage, real-time database); Resend (transactional email); Apple, Google, and Stripe (payment and subscription processing); Agora (real-time video and audio — media is routed through Agora infrastructure and is not recorded or stored by us); Expo and Apple Push Notification service (mobile push notifications); CloudConvert (optional document format conversion); and Unsplash / Pexels (stock image search). When you choose to use the optional AI assistant, the message or document content you send to it, together with recent conversation context, is transmitted to the AI provider serving your plan — Groq, OpenAI, or Anthropic — to generate a response; this happens only when you use the AI feature. All processors are required to handle your data in accordance with applicable law. We may disclose data if required to do so by law or in response to valid requests from public authorities.

6. International Data Transfers

Your data may be processed in countries outside the UK and European Economic Area. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission or UK International Data Transfer Agreements.

7. Data Retention

We retain your account data for as long as your account is active, plus a further 30-day grace period following deletion. Workspace content is deleted within 90 days of account closure. Aggregated, anonymised analytics data may be retained indefinitely. Backup copies are purged within 180 days.

8. Your Rights

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): request deletion of your data.
• Right to restrict processing: ask us to limit how we use your data.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests.
• Right not to be subject to automated decision-making.
• You can delete your account and personal data at any time directly in the app (Profile → Delete Account), and export your data from within the app. To exercise any other right, email privacy@collabopoint.com. We will respond within 30 days.

9. Security Measures

We implement industry-standard security measures including TLS 1.3 encryption in transit, AES-256 encryption at rest, multi-factor authentication, regular penetration testing, and continuous security monitoring. See our Security Policy for full details.

10. Cookies

We use cookies and similar tracking technologies to operate the platform and analyse usage. See our Cookie Policy for a full list of cookies used and your choices.

11. Children's Privacy

CollaboPoint is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us immediately and we will delete it.

12. User Content and Moderation

CollaboPoint lets you communicate with other members of your workspaces. You can report a message and block another user from within the app; reports are sent to our moderators for review. We may remove content or restrict accounts that violate our terms.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes we will notify you by email and update the "Last updated" date above. Continued use of the service after the effective date constitutes your acceptance of the updated policy.

14. Contact and Complaints

For privacy inquiries, contact our Data Protection Officer at privacy@collabopoint.com. If you are unhappy with our response you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Questions about this policy? Contact our Data Protection Officer at privacy@collabopoint.com

Other policies