Privacy Policy

This policy explains what personal data we handle when you visit poolse.dev, open the public chat demo, use the customer dashboard, buy a paid plan, or contact us — and what you can do about it.

It is written to satisfy the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection (revFADP), the Law on Personal Data Protection of the Republic of North Macedonia (LPDP), and the US state privacy laws listed in § 13. Where those rules differ, we apply the stricter one rather than splitting our behaviour by geography.

1. The two roles we play

poolse is infrastructure other companies build on. That means we handle personal data in two very different capacities, and almost every question about your data has a different answer depending on which one applies.

We are the controller for data about our own relationship with you: your dashboard account, your billing record, the emails you send us, and the browsing you do on poolse.dev. We decide why and how that data is processed, and this policy governs it end to end.

We are a processor for the chat data that flows through a customer's tenant — the messages, attachments, display names, and end-user identifiers that a customer's application sends us. Our customer decides what to collect and why; we only act on their instructions, under the Data Processing Addendum. If you are an end user of an app built on poolse, we are not the right place to start: contact the company whose app you are using, because they hold the relationship and the decisions. We will help them respond, and we will forward a request that reaches us by mistake.

2. What we collect, and where it comes from

2.1 Data you give us

2.2 Data we generate or observe

2.3 Data our customers send us (we are the processor)

Message bodies, attachments, reactions, read state, presence, typing signals, display names, avatar URLs, and the external_id a customer assigns to each of its end users. For calls: who called whom, when, for how long and with what outcome, and the audio and video itself, which passes through our media servers and is not recorded. For push notifications: device push tokens, and the notification content, which can include a message preview and is delivered through Apple and Google. Our media and relay servers also see the IP addresses of the devices on a call. What ends up in that set is the customer's decision, not ours. We tell customers not to route special categories of data (health, biometrics, political or religious views) or payment card data through chat unless they have carried out their own assessment and have a lawful basis for it.

2.4 What we deliberately do not collect

• No advertising identifiers, ad-network pixels, or cross-site tracking.
• No analytics product, session recorder, heat mapper, or A/B testing tool. There is nothing in the analytics category to consent to today, and if that changes we will name the provider in the Cookie Policy and ask first.
• No purchased marketing lists, data-broker enrichment, or scraped contact data.
• No biometric data, no precise geolocation, and no profiling that produces legal or similarly significant effects.
• No browsing of customer content. Message bodies are encrypted at rest under a per-tenant key, and our internal operator console has no code path that decrypts them; it sees counts and timestamps, never text. This is not end-to-end encryption: our servers hold the keys, so someone with production server access could technically read data. We look at customer content only where a customer asks us to, to handle an abuse report about specific content, or where the law requires it.

3. Why we process it, and on what legal basis

Under the GDPR and the LPDP, every purpose needs a legal basis. Ours:

We do not use personal data for automated decision-making that produces legal or similarly significant effects, and we do not profile you within the meaning of Art. 22 GDPR. Automated rate limits and abuse thresholds do exist, but a human reviews any decision that would suspend or terminate an account.

4. Who receives it

We do not sell personal data, and we do not share it for cross-context behavioural advertising. Access inside the company is limited to the people who need it for the task in front of them. The operator console has no code path that decrypts message bodies.

Outside the company, data reaches only:

Each subprocessor is bound by a written contract meeting Art. 28(3) GDPR, is limited to the purposes above, and is assessed before being engaged. The current list is maintained at /legal/subprocessors; customers can subscribe to change notices under the DPA.

Other recipients, which are not subprocessors:

5. Payments and the Merchant of Record

Today, paid plans are invoiced directly by Torsten Labs DOO. When you apply for a paid plan we activate it by hand and send an invoice. We keep the billing data that requires — name, billing address, country, tax identifiers, invoices and payments — as the controller, for as long as tax and accounting law requires (see § 7). We never receive or store card numbers.

When self-serve checkout opens, it will be run by Lemon Squeezy, LLC as our Merchant of Record and authorised reseller. For purchases made there, your purchase contract for the transaction is with Lemon Squeezy: it takes the payment, determines and remits sales tax and VAT, issues the invoice, and handles refunds and chargebacks. For that transaction it is an independent controller, and its privacy notice governs it. The checkout runs on Lemon Squeezy's infrastructure, so your card number never touches our systems; we receive back only your billing email, country, plan, subscription status, invoice references, and the last four digits and brand of the card for display.

6. International transfers

Torsten Labs DOO is established in North Macedonia. The European Commission has not issued an adequacy decision for North Macedonia under Art. 45 GDPR. We say that plainly because a policy that glosses over it is not much use to a buyer doing diligence.

For personal data coming from the EEA, the UK, or Switzerland:

• Where a customer in those regions sends us end-user data, the transfer to us as processor is covered by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), incorporated into our DPA, together with the UK International Data Transfer Addendum and the Swiss adaptations where those regimes apply.
• Where we onward-transfer to a subprocessor, Module Three (processor to processor) applies, and each subprocessor is bound by terms no less protective than ours.
• Where a subprocessor is outside the EEA, we rely on the transfer mechanism named for it in the subprocessor list (the EU–U.S. Data Privacy Framework or the Standard Contractual Clauses), and we apply supplementary measures: message bodies encrypted at rest under per-tenant keys we hold, TLS on every external connection, minimisation of what leaves the primary region, and the request policy under which we challenge overbroad government access requests and tell the affected customer unless legally forbidden.
• The application servers and the database run in Frankfurt, Germany (Oracle Cloud, region eu-frankfurt-1). Attachments are stored in Cloudflare R2, which is not restricted to the EU, so Cloudflare may store them in another region.

You may request a copy of the clauses we rely on, with commercial terms redacted, at [email protected].

Representative in the EU

7. How long we keep it

Where we are required to keep something longer — a legal hold, an open dispute, a regulatory request — we keep only what that specific obligation requires and delete the rest on the normal schedule.

8. How we protect it

• Encryption at rest. Message bodies, webhook signing secrets and push credentials are encrypted with AES-256-GCM under a Data Encryption Key unique to the workspace, which is itself wrapped by a master key (envelope encryption). Other data is stored without application-level encryption, including display names, conversation names, a short preview of the latest message, call records, webhook delivery payloads and attachments; the encryption docs list exactly what is and is not encrypted. This is not end-to-end encryption: our servers hold the keys and decrypt data to serve it.
• Encryption in transit. HTTPS and WSS only on every external connection, with HSTS. Plain HTTP is redirected, never served. Traffic between our own services stays inside one server's private network.
• Credential handling. Passwords are bcrypt-hashed. API keys are stored as a keyed hash (HMAC-SHA256) plus a display prefix; the secret half exists only in the response that created it. Browser clients never receive a long-lived API key; they get short-lived tokens minted server-side.
• Separation of duties. The operator console reads metadata only. Its inability to reach message text is enforced at the module boundary and covered by a regression test.
• Signed webhooks. Deliveries are HMAC-SHA256 signed over a timestamped payload with a five-minute replay window, so you can verify that what arrived came from us.
• Access control. The operator console needs a password and a one-time code sent by email. The servers accept SSH keys only, with no password or root login, and a firewall that denies everything not explicitly opened.
• Resilience. Nightly database backups kept for 35 days, and rate limiting at the edge.

No system is perfect, and we will not pretend otherwise. If a personal data breach occurs, we notify the competent supervisory authority within 72 hours of becoming aware where Art. 33 GDPR requires it, notify affected individuals without undue delay where the risk is high, and notify affected customers without undue delay in every case so they can meet their own obligations. Report a suspected vulnerability to [email protected]; we will not pursue legal action against good-faith security research that follows the disclosure policy.

9. Your rights under the GDPR, UK GDPR, revFADP, and the LPDP

You can ask us to:

• Access — confirm whether we process data about you and get a copy, with the information in this policy.
• Rectify — correct anything inaccurate or complete anything incomplete.
• Erase — delete data where Art. 17 applies, subject to the retention obligations in § 7.
• Restrict — pause processing while an accuracy or objection dispute is resolved.
• Port — receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent directly to another provider where technically feasible. Customers can read their workspace's conversations and messages at any time through the API.
• Object — object to processing based on legitimate interests, including profiling. We stop unless we can show compelling legitimate grounds that override your interests. Where the objection is to direct marketing, we stop without qualification and without asking why.
• Withdraw consent — at any time, as easily as it was given. Cookie choices are changed from the footer link on every page. Withdrawal does not affect processing that already happened.
• Not be subject to automated decisions producing legal or similarly significant effects. We do not make any.

How to exercise them. Email [email protected] from the address on your account, or write to the registered seat above. We respond within one month, extendable by two further months for genuinely complex requests, in which case we tell you within the first month and explain why. There is no charge unless a request is manifestly unfounded or excessive, and we will explain before charging anything. If we cannot identify you from what you have sent, we will ask for what we need — and no more.

Account holders can act directly. Your dashboard lets you edit your profile and delete your account, and every workspace it owns, without asking us first. Deletion is immediate.

Complaints. Tell us first if you can — most issues are a misunderstanding we can fix the same day. You always keep the right to complain to a supervisory authority: the Agency for Personal Data Protection of the Republic of North Macedonia, or, in the EEA, the authority in your country of residence, place of work, or where the alleged infringement occurred. In the UK it is the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner.

10. Marketing communications

We send product and company email only to people who asked for it, and to existing customers about products similar to what they already use, which is permitted under the ePrivacy soft opt-in. Every message has a one-click unsubscribe that works immediately and does not require you to sign in. Unsubscribing never affects service email — verification, password resets, billing notices, and security alerts continue for as long as you hold an account, because they are part of the service and not marketing.

11. Children

poolse is a business tool. The dashboard is not directed at children, and you must be at least 16 — or 18 where local law sets that as the age to enter a contract — to create an account. We do not knowingly collect personal data from children. If you believe a child has given us data, write to [email protected] and we will delete it.

If you build a product on poolse that is directed at children, that is your call and your responsibility: you must obtain any parental consent your law requires (COPPA in the United States, Art. 8 GDPR in the EU, and their equivalents) before routing a child's data through our service. Our Acceptable Use Policy is part of that obligation.

12. Cookies and similar technologies

Covered in full, cookie by cookie, in the Cookie Policy. The short version: strictly necessary cookies keep you signed in, protect our forms, and remember your choice; nothing else is set unless you switch it on; and you can change your mind at any time. Open cookie settings

We honour the Global Privacy Control signal. If your browser sends it, we treat that as a refusal of every optional category and as an opt-out of any sale or sharing of personal data.

13. Your rights in the United States

If you live in California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, or another state with a comprehensive privacy law, you have rights to know, access, correct, delete, obtain a portable copy, and opt out of sale, sharing, targeted advertising, and significant profiling. You also have the right not to be discriminated against for exercising them — we do not offer financial incentives for data and we do not degrade the service for anyone who says no.

The disclosures those laws require:

• We do not sell personal information, and we have not in the preceding 12 months.
• We do not share personal information for cross-context behavioural advertising, and we have not in the preceding 12 months.
• We do not use or disclose sensitive personal information for any purpose beyond what CCPA § 7027(m) permits without a right to limit. We do not collect it for the dashboard at all.
• We do not knowingly sell or share the personal information of anyone under 16.
• The categories we collect, the purposes, the sources, and the recipients are set out in § 2, § 3, and § 4. Retention is in § 7.

To exercise a right, email [email protected]. We confirm receipt within 10 business days and respond within 45 days, extendable once by a further 45 days with notice. An authorised agent may act for you with written permission that we can verify. If we refuse, we say why, and you may appeal by replying to that decision with the word "appeal"; we answer an appeal within 45 days and, if we still refuse, tell you how to contact your state Attorney General.

For California residents specifically: where we handle your data on behalf of a business customer, we act as a service provider under the CCPA, and we neither retain, use, nor disclose that information outside the direct business relationship or for any commercial purpose other than performing the service.

14. Changes to this policy

We update this policy when the service or the law changes. Every version carries a number and an effective date at the top, and we keep the previous versions available on request.

For a change that materially affects you, we give notice at least 30 days in advance by email to account holders and by a notice on the site — and where the change means we would rely on your consent, we ask for it rather than assume it. Minor clarifications take effect on publication.

15. Contact

Postal mail reaches us at the registered seat listed at the top of this page. We are below the thresholds in Art. 37 GDPR and Art. 41 LPDP that make appointing a Data Protection Officer mandatory, so the contact above is a designated privacy contact rather than a formally appointed DPO — we would rather tell you that than imply an office we have not created.