Privacy Policy

HeyRetro is a web application for running real-time retrospective boards, surveys, voting, timers, team workspaces, action items, and related collaboration workflows.

This Privacy Policy explains how HeyRetro collects, uses, shares, and protects personal data when you visit heyretro.io, create an account, join a board, use a team workspace, pay for a subscription, contact support, or use an integration.

For privacy questions or requests, contact [email protected]. If a paid plan, written order, or account notice identifies a specific legal operator for HeyRetro, that operator is responsible for the account covered by that notice.

• Provide, operate, maintain, and improve HeyRetro.
• Create and secure accounts, verify email addresses, authenticate users, support two-factor authentication, and enable SSO.
• Create teams, organizations, retro boards, guest sessions, invitations, surveys, votes, timers, and action items.
• Send transactional email such as verification messages, password reset links, team invitations, security notices, billing notices, and product-critical account notifications.
• Process subscriptions, trials, upgrades, downgrades, cancellations, invoices, fraud checks, and payment events through Stripe.
• Provide support, respond to requests, investigate errors, prevent abuse, enforce the Terms of Service, and protect users and the service.
• Comply with legal, tax, accounting, security, and regulatory obligations.

Where privacy laws require a legal basis for processing, we rely on the following bases depending on the context:

• Contract: to provide HeyRetro, manage accounts, operate boards, process subscriptions, and deliver requested services.
• Legitimate interests: to secure the service, prevent abuse, troubleshoot issues, improve the product, manage transactional email delivery, and communicate about service-related matters.
• Consent: where we ask for optional permissions, optional integrations, or future marketing communications.
• Legal obligation: to keep records required for tax, accounting, compliance, fraud prevention, and legal requests.

We do not sell personal data. We share information only when needed to operate HeyRetro, comply with law, or protect the service.

• Hosting, infrastructure, CDN, security, and deployment providers that help run heyretro.io.
• Email providers, including Amazon SES, for transactional email delivery and provider-level bounce, complaint, and suppression handling.
• Stripe for checkout, billing, subscription management, invoices, tax-related payment records, and payment method processing.
• Authentication and integration providers such as Google, Microsoft Teams, and enterprise SSO providers when you choose to connect or use those integrations.
• Monitoring, logging, and error-reporting providers that help detect outages, exceptions, and abuse.
• Professional advisors, authorities, or other parties where required by law, legal process, security investigation, or to protect rights, users, and the service.
• A successor organization if HeyRetro is involved in a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate confidentiality and continuity protections.

HeyRetro uses email for transactional and service-related purposes. Examples include account verification, password reset, team invitations, security notices, billing notices, and important account or product notifications.

HeyRetro does not use imported, purchased, rented, or scraped recipient lists. Team invitations should only be sent to people the sender has a legitimate reason to invite to a workspace or board.

Our email infrastructure may use bounce, complaint, and suppression information to protect deliverability and avoid sending further mail to addresses that reject or complain about messages.

• Session cookies keep you signed in and help protect requests against cross-site request forgery.
• Preference storage may remember settings such as appearance mode.
• Security and infrastructure providers may set cookies or process request metadata to detect abuse and protect the service.
• Payment, authentication, and integration providers may use their own cookies or storage when you interact with their hosted flows.

We keep personal data for as long as needed to provide HeyRetro, maintain security, resolve disputes, enforce agreements, comply with legal obligations, and support legitimate business needs.

• Account, team, organization, board, and collaboration data is generally retained while the account, team, organization, or board remains active or until it is deleted.
• Billing and transaction records may be retained for tax, accounting, fraud prevention, and compliance purposes after an account is closed.
• Logs, session records, error reports, and security records are retained for limited operational periods unless they are needed to investigate abuse, security incidents, or legal issues.
• Support communications may be retained to resolve current and future requests, document decisions, and improve support quality.

We use technical and organizational safeguards designed to protect personal data, including TLS for data in transit, access controls, account security features, authentication controls, and infrastructure protections.

No online service can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials, using strong passwords, enabling two-factor authentication where appropriate, and limiting board links and invitations to intended recipients.

Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to certain processing of your personal data. You may also have the right to withdraw consent where processing is based on consent and to lodge a complaint with a data protection authority.

You can update some account information in the product. For other privacy requests, contact [email protected]. We may need to verify your identity or authority before fulfilling a request.

HeyRetro and its providers may process information in countries other than your own. When required, we rely on appropriate safeguards for international transfers, such as contractual protections or provider compliance mechanisms.

HeyRetro is not directed to children under 16. Do not use HeyRetro if you are under 16, and do not submit personal data about children unless you have the authority and legal basis to do so.

We may update this Privacy Policy as HeyRetro changes or as legal, operational, or security requirements evolve. If changes are material, we will take reasonable steps to notify users through the service, by email, or by another appropriate method.

For privacy questions, data requests, security concerns, or abuse reports, contact [email protected].