Privacy Policy

This Privacy Policy explains how Sæle Digital ("Decretum", "we") handles personal data in connection with the Decretum Cloud Service at decretum.app. It does not cover Self-Hosted Deployments (see Self-Hosted Deployments below for why).

Self-Hosted Deployments

Where an organization deploys Decretum on its own infrastructure (for example, via the provided Docker image), that organization, not Decretum, controls the database, storage, and email delivery, and is the data controller for any personal data processed there. This Privacy Policy does not apply to that data; the deploying organization's own privacy policy governs it. Decretum, as the software provider, does not receive, store, or process personal data from a Self-Hosted Deployment in the ordinary course of its operation.

1. Who We Are

Sæle Digital (org. no. 838 358 152), Breimyra 74, 5134 Flaktveit, Norway, is the data controller for Account Data (your name, email address, sign-in method, and technical/security logs such as session IP address) and for the Cloud Service's operation generally. For personal data your Organization's Users choose to include within Content (decisions, posts, comments, tags, and attachments), your Organization is the data controller and Decretum acts only as a processor on its behalf, under the Data Processing Agreement (see that document's Section 2 for the full split). Contact: support@decretum.app.

2. What We Collect

We collect the following categories of personal data through the Cloud Service:

• Account data: name and email address. You sign in with a one-time code we send to your email address, or with Google or a Microsoft work account if you choose to; there is no Decretum password. Through Google or Microsoft we receive only confirmation of your identity and the profile fields they share (your name and email address), never your password with them. A sign-in code is valid for 10 minutes. To limit how many codes can be requested, we keep a one-way hash of the email address and the time of each request, only for as long as that limit needs it.
• Organization data: your role within an Organization, and, for invited members, the email address an Admin used to invite you.
• Content you submit: decisions, posts, comments, tags, and file attachments your Organization creates in the Service. This may include personal data your Organization chooses to include in that content; Decretum does not control what an Organization's Users write.
• Usage and preference data: settings such as language, dashboard layout, and notification preferences, plus technical logs (e.g. request logs, error logs, and each sign-in session's IP address and browser/device information) generated by operating the Service.

We do not use third-party advertising or analytics trackers on the Cloud Service. The application sets: a session cookie required to keep you signed in; a locale-preference cookie that remembers your chosen display language; and, only while you're actually signing in through Google or Microsoft, the short-lived state cookies that provider's sign-in protocol requires to complete the redirect securely (cleared once sign-in finishes). None of these are used for tracking or advertising. Separately, your browser's local storage (not a cookie, and never sent to or readable by us) remembers your preferred date/time display format on that device.

3. Why We Process It (Legal Basis)

• Performance of a contract: to create your account, operate your Organization's workspace, and provide the Service you or your Organization signed up for.
• Legitimate interests: to secure the Service, diagnose and fix problems, and improve reliability, balanced against your rights.
• Consent: where required for a specific optional feature (for example, connecting an optional third-party identity provider). [CONFIRM WITH COUNSEL: signing in via an optional identity provider may be better characterized as performance of a contract (the User is choosing how to authenticate for the Service they already want) rather than consent in the GDPR Article 6(1)(a) sense, which specifically requires being freely revocable without detriment; if reclassified, this list and the "withdraw consent" language in Section 7 below need updating to match.]
• Legal obligation: where we must retain or disclose data to comply with law.

4. Who We Share It With

We do not sell personal data. We share it only with the sub-processors necessary to operate the Cloud Service, under contractual terms requiring them to protect it, and with an Organization's own Users to the extent your Organization's visibility and access-control settings permit:

• Application hosting: Vercel Inc.
• Database hosting: Neon, Inc., a managed PostgreSQL provider running on Amazon Web Services infrastructure in the Frankfurt, Germany (eu-central-1) region
• File attachment storage: Amazon S3 (Amazon Web Services, Inc.), in the Frankfurt, Germany (eu-central-1) region
• Email delivery: Zoho CPaaS (formerly ZeptoMail), Zoho's transactional email service (Zoho Corporation B.V.), used to send sign-in codes, invitations, notifications and digests, processed in Zoho's EU data centers
• Identity providers: Google and/or Microsoft, only if and when you choose to sign in through them

We may also disclose personal data where required by law, to enforce our Terms of Service, or to protect the rights, safety, or property of Decretum, our Customers, or others.

5. International Data Transfers

Our database, file storage, application hosting, and email delivery are all located in the EU/EEA (Frankfurt, Germany for the database, file storage, and application compute; Zoho's EU data centers for email). Two of our infrastructure providers, Vercel Inc. and Neon, Inc., are United States companies that may access personal data from the United States in the ordinary course of providing their services (for example, for customer support or account administration), even though the data itself is stored in Frankfurt. Where this occurs, we rely on those providers' certification under the EU-U.S. Data Privacy Framework, with the Standard Contractual Clauses approved by the European Commission applying as a fallback safeguard.

6. Data Retention

We retain Organization and Content data for as long as the Organization's account remains active. If an Organization's account is closed, we retain the data for 14 days to allow reactivation. Nobody, including Admins, can sign in during that window, so export is not possible until an Admin reactivates the account, after which export remains available again like normal. If the 14 days pass without reactivation, the data is permanently deleted, except where retention is required by law or for legitimate business records (for example, billing history).

Technical request and error logs generated by our application hosting provider (which may include IP addresses) are retained for up to 30 days before being automatically deleted.

7. Your Rights

Depending on your location, you may have the right to access, correct, export, or delete your personal data, object to or restrict certain processing, and withdraw consent where processing is based on consent.

Export and deletion are self-service. You can export your own account data, and delete your own account, directly from Settings within the Service. Deleting your account signs you out immediately. For 14 days afterward, you can cancel the deletion using the link sent to your email. After that window, we permanently remove your name, email address, and other personal identifiers from your account. Decisions, posts, and other Content you authored remain part of your Organization's record and are not deleted, since that Content belongs to your Organization, not to you individually (see Terms of Service §5). Your name on it is replaced with a generic label (for example, "Former member") once your account is purged. This replaces your name everywhere the Service looks it up live; it does not rewrite free-text content that already names you at the time it was written (for example, an @mention typed into a post, or a name recorded in an approval or status-change history), since that text is part of the Organization's own historical record, not a live reference to your account. An Organization's Admin can also choose, when removing someone who is simply leaving rather than requesting their own deletion, to keep that person's name attributed instead of anonymizing it. An Organization's only Admin cannot delete their own account, or be removed by anyone else, until the Admin role is transferred to someone else first. An Admin can similarly export the entire Organization's data (every decision, post, member, and pending invite, but not the underlying attachment files themselves; see Terms of Service §9) or close the Organization's account entirely; closing deactivates every member's access immediately and is reversible for 14 days via a link emailed to every Admin, the same self-service mechanism as individual account deletion above. A pending invite (an email address an Admin has invited who hasn't yet joined) is retained until that person signs up or an Admin revokes it; it does not expire automatically.

The "try the demo" link signs every visitor who uses it into the same single, pre-seeded demonstration account, rather than creating an account for you. We do not collect or store any name, email address, or other personal data of yours through it. Anything that account appears to let you change is either illustrative seed data shared by every visitor or blocked outright.

For other rights (correcting inaccurate data, objecting to or restricting certain processing, or withdrawing consent), contact support@decretum.app. Where an Organization's Admin manages your account (for example, a work account created by your employer), some requests may need to go through your Organization's Admin, since they control your account within the Service. EU/EEA residents also have the right to lodge a complaint with their local data protection authority.

We do not use automated decision-making. Nothing in the Service makes an automated decision about you, or profiles you, in a way that produces legal or similarly significant effects. Every approval, status change, and access decision is made by a person.

California residents have additional rights under the CCPA/CPRA, including the right to know what personal information we collect, to delete it, to correct it, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined by the CCPA, and we will not discriminate against you for exercising any right under it. Contact support@decretum.app to exercise these rights.

8. Security

All traffic between your browser and the Service is encrypted in transit (TLS). Access within an Organization is governed by role-based permissions and, for restricted decisions, explicit collaborator lists. See the Security & Deployment page for more detail. No system is perfectly secure; we cannot guarantee absolute security of information transmitted to the Service.

9. Children's Privacy

The Service is intended for business use by adults and is not directed at children. We do not knowingly collect personal data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide reasonable notice (for example, by email to an Organization's Admins or a notice within the Service) before the change takes effect.

11. Contact

Questions about this Privacy Policy, or requests relating to your personal data, can be sent to support@decretum.app.