Privacy Policy
Last updated November 2, 2026
Draft. This text has not been reviewed by counsel and will change before launch. Items in square brackets are placeholders.
1. Who we are
[Legal entity name and registered address to be completed before launch.] Contact: support@aquaindy.com. This policy explains what personal data the Aquaindy service processes, why, and the rights people have.
2. Data we process
Account data (name, email address, hashed password, session records). Workspace content entered by the Customer and its users: clients and contacts, projects, tasks, comments, files, requests, approvals, time entries, expenses, rates, allocations and absences. Operational records: audit events, notifications, email delivery status, background-job records and request logs with IP address and user agent.
3. Why we process it
To provide the workspace the Customer asked for, to secure accounts and detect abuse, to send transactional email (verification, password reset, invitations, notifications the user has enabled), and to operate and improve the service. [Legal bases under applicable law to be confirmed by counsel.] We do not sell personal data and do not use it for advertising.
4. Client guests
When a Customer invites a client guest, that person's account data is processed to give them portal access. The Customer decides what the guest can see. Guests can ask the Customer to revoke access at any time.
5. Cookies and local storage
The service uses two essential cookies: a session cookie that keeps you signed in, and a short-lived cookie that protects Google sign-in. On the public pages only, Google Analytics cookies are set if you accept them; declining, or a Global Privacy Control signal from your browser, keeps Google Analytics from loading. There are no advertising cookies. Browser local storage holds only your analytics choice. The Cookie policy page lists every cookie, its purpose and how long it lasts.
6. Sub-processors
We use a hosting provider for the application and its database, a private object-storage provider for files, and a transactional email provider for account and notification email. [Named providers, their locations and the data-processing terms with each to be listed before launch.] If you choose to sign in with Google or connect Google Calendar, Google LLC receives the requests needed for that: for sign-in, Google tells us your Google account identifier, name and verified email address; for Google Calendar, we send the titles, dates and links of your own tasks, milestones, time off and pending approvals to a calendar we create in your Google account. No budgets, rates or other finance figures are sent. You can disconnect at any time from your Account page, which deletes that calendar and revokes our access. If you accept analytics on the public pages, Google LLC (Google Analytics) receives visit data as described on the Cookies page.
7. Retention
Workspace content is kept while the workspace exists. Audit events are kept for the life of the workspace because they are its record of who did what. Report exports expire after seven days. Session and request logs are kept for a limited operational period. [Retention periods to be fixed with counsel.] On termination, data is deleted or returned under a documented procedure.
8. Security
Workspace isolation is enforced at the route, query and database level; passwords are hashed with argon2id; sessions are opaque hashed tokens; files live in private storage behind short-lived signed links; security-relevant changes are logged. The Security page lists current measures and known gaps. No certification is claimed.
9. Your rights
Depending on where you live, you may have rights to access, correct, delete or export your personal data and to object to or restrict processing. Account holders can change their name, email and password in the application. Other requests go to the contact below; Customers remain responsible for data they control about their clients and staff.
10. International transfers
[Hosting region and the safeguards for any transfer outside the visitor's region to be completed by counsel. The service runs on Render in the United States.]
11. Changes and contact
We will announce material changes to this policy in the service or by email. Questions and requests about your personal data go to support@aquaindy.com.