Privacy Policy

At Valplaude ("we", "us", or "our"), we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our approval management service ("the Service").

1. Information We Collect

1.1 Information You Provide

When you use our Service, you may provide:

• Account Information: Name, email address, company name, password
• Profile Information: Avatar, timezone preferences
• Approval Data: Request titles, descriptions, attachments, comments
• Payment Information: Processed securely by Paddle (we don't store card details)

1.2 Information Collected Automatically

When you access the Service, we automatically collect:

• Log Data: IP address, browser type, pages visited, time spent
• Device Information: Device type, operating system, unique identifiers
• Cookies: Session cookies for authentication and preferences

2. How We Use Your Information

We use the information we collect to:

Purpose	Legal Basis
Provide and maintain the Service	Contract performance
Process payments and subscriptions	Contract performance
Send transactional emails (invites, notifications)	Contract performance
Improve and optimize the Service	Legitimate interest
Respond to support requests	Legitimate interest
Prevent fraud and abuse	Legitimate interest
Comply with legal obligations	Legal compliance

3. Information Sharing

We do NOT sell your personal information. We may share information with:

• Service Providers: Paddle (payments), email providers (for notifications)
• Your Organization: Team members within your company account
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets

4. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. After account deletion:

• Personal data is deleted within 30 days
• Anonymized usage data may be retained for analytics
• Backup copies are removed within 90 days
• Legal/financial records may be retained as required by law

5. Data Security

We implement appropriate security measures to protect your data:

• Encryption in transit (TLS/SSL) and at rest
• Secure password hashing (bcrypt)
• Regular security audits and updates
• Access controls and authentication
• Secure hosting infrastructure

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

6. Your Rights

Depending on your location, you may have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Deletion: Request deletion of your personal data
• Portability: Receive your data in a portable format
• Objection: Object to certain processing activities
• Restriction: Request limited processing of your data

To exercise these rights, contact us at support@valplaude.com.

7. Cookies

We use essential cookies to:

• Maintain your login session
• Remember your preferences
• Protect against cross-site request forgery (CSRF)

We do not use advertising or tracking cookies. You can disable cookies in your browser settings, but some features may not work properly.

8. International Data Transfers

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.

9. Children's Privacy

The Service is not intended for users under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

10. Third-Party Links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Posting a notice on the Service
• Sending an email to your registered address
• Updating the "Last updated" date above

12. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and the right to request deletion. We do not sell personal information.

13. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR). Our legal bases for processing are described in Section 2 above. You may lodge a complaint with your local data protection authority.