Privacy Policy

This policy explains how Ext0 processes personal data. There are two kinds of people involved: customers (people who sign up and manage workspaces) and end users (visitors who use a customer's widget or portal). For end-user data we act as a processor on behalf of the customer, who is the controller.

Data we collect

• Account data: name, email, password hash, timezone, optional MFA configuration.
• Billing data: handled by our payment processor; we store subscription status and invoice references, not card numbers.
• End-user content: ideas, comments, votes, survey answers, and — only when provided or verified — a name and email address.
• Technical data: truncated IP addresses and coarse device information kept for a short period for security and abuse prevention.
• Usage analytics: minimal, pseudonymous product events (for example "widget opened") retained for up to 90 days in raw form, then aggregated.

How we use data

To provide and secure the Service, send transactional email (verification, security, billing), deliver notifications that users opted into, and improve reliability. We do not sell personal data and do not send marketing without a legal basis.

Sharing

We use subprocessors for hosting, email delivery and payments. A current list will be published before launch. Voter emails are never shown publicly.

Retention

Account and workspace data is kept while the account is active. Security logs containing IP data are retained for a limited period (proposed: 30 days). Deleted data is purged from backups on their normal rotation.

Your rights

Depending on your location you may request access, correction, export, deletion or restriction of your data, and object to processing. End users should contact the customer who operates the workspace; we will assist them. Customers can contact us directly.

International transfers

[Hosting region and transfer mechanisms to be confirmed before launch.]