Privacy policy
How Two Weeks Cloud and this website handle personal data. This is a draft for legal review.
Summary
- This website sets no cookies and uses no analytics today. It remembers your theme choice in your browser. See the cookie policy.
- Cloud holds your team’s estimation data and account details. We use them to run the service, and for nothing else. We do not sell personal data.
- Card details go straight to Stripe. We never see or store them.
- You can ask us to access, correct or delete your data. Self-service export and deletion for Cloud accounts is planned and not built yet, so we handle requests by hand for now. See Your rights.
[LEGAL REVIEW REQUIRED] The summary must match the final text. Re-read it after every change below.
Who we are
[COMPANY NAME] (“we”, “us”), of [REGISTERED ADDRESS], company number [COMPANY REGISTRATION NUMBER], is the controller of the personal data described here, except where we process customer data on a customer’s behalf (see the data processing agreement).
Privacy contact: [PRIVACY LEAD OR DPO]. Email hello@two-weeks.dev, or use the contact form with the topic “Privacy or data request”. ICO registration: [ICO REGISTRATION NUMBER]. Representative: [EU REPRESENTATIVE, IF REQUIRED].
[LEGAL REVIEW REQUIRED] Confirm the controller, whether a DPO or representative is required, and whether ICO registration applies.
What we collect and why
| Where | What | Why | Lawful basis |
|---|---|---|---|
| Contact form | Your name, email address, topic and message. The message is emailed to our team through our mail provider. | To read and reply to your message. | [LAWFUL BASIS TO CONFIRM] |
| Waitlist | Your email address, the time you agreed, and which wording you agreed to. Stored in the website’s key-value store, not sent by email. | To tell you when Cloud opens. | Consent. You can withdraw it at any time. |
| Cloud account | Email address, username and display name, a bcrypt hash of your password (never the password itself), or the link to the Google, Microsoft or GitHub account you sign in with. Login sessions. Your organisation membership and role. | To create your account, sign you in and keep it secure. | [LAWFUL BASIS TO CONFIRM] |
| Estimation sessions | Sessions, tickets, votes, comments and the display names participants type. Participants join with a code and a name and need no account. | To run estimation sessions for the organisation that created them. | We act as processor; see the DPA. |
| Jira and GitLab connections | The access tokens a host adds, encrypted at rest with AES-256-GCM and never returned to the browser. Imported ticket titles and links. | To import tickets and write estimates back, at the host’s request. | We act as processor; see the DPA. |
| Billing | The organisation and billing contact, plan, subscription status and number of active members. Payment details are collected and held by Stripe, not by us. | To charge for paid plans and manage subscriptions. | [LAWFUL BASIS TO CONFIRM] |
| Service emails | Your email address and the content of verification, password-reset and invitation emails. We switch off open and link tracking in these emails. | To verify your address, reset passwords and invite colleagues. | [LAWFUL BASIS TO CONFIRM] |
| Technical data | IP address and request details in server logs and rate-limit counters. Usage events that power the in-app analytics screens. Error reports and traces only if error reporting or tracing is switched on: [SENTRY ENABLED FOR CLOUD: YES OR NO]. | To keep the service secure, stop abuse and fix faults. | [LAWFUL BASIS TO CONFIRM] |
| Website visits | None collected by us today. Cookieless analytics is planned ([ANALYTICS PROVIDER]); this policy will be updated before it is switched on. | Not applicable yet. | Not applicable yet. |
We do not use advertising cookies or tracking pixels, and we do not sell personal data.
[LEGAL REVIEW REQUIRED] Confirm the lawful basis for each row, whether any row involves special-category data, and whether a records-of-processing entry and a DPIA are needed.
Who we share it with
We share personal data only with the companies that help us run Cloud. They are listed, with what they do and where, on the sub-processors page. We may also disclose data where the law requires it.
International transfers
Cloud’s hosting region is not announced yet ([HOSTING REGION]). Some providers, such as Stripe and the mail provider, may process data outside the UK and EEA. Where they do, we rely on [INTERNATIONAL TRANSFER MECHANISM].
[LEGAL REVIEW REQUIRED] Choose and document the transfer mechanism for each provider.
How long we keep it
| Data | Kept for |
|---|---|
| Waitlist entries | Up to 12 months from when you joined, then deleted automatically; or until you ask us to remove it. (The website function’s default; the owner must confirm it.) |
| Contact messages | [CONTACT MESSAGE RETENTION PERIOD] |
| Account data | [ACCOUNT DATA RETENTION PERIOD] |
| Estimation content | [ESTIMATION CONTENT RETENTION PERIOD] |
| Backups | [BACKUP RETENTION PERIOD] |
| Server logs | [SERVER LOG RETENTION PERIOD] |
| Billing records | [BILLING RECORDS RETENTION PERIOD] |
Your rights
Under UK and EU data protection law you can ask us to give you a copy of your data, correct it, delete it, restrict or object to its use, and move it to another service. Where we rely on your consent, you can withdraw it at any time. You can also complain to the Information Commissioner’s Office (or your local supervisory authority).
To make a request, use the contact form or email hello@two-weeks.dev. We aim to answer within [REQUEST RESPONSE TIME]. To leave the waitlist, ask in the same way.
Not built yet: self-service export and account deletion for Cloud users and organisations is planned and is not available. Until it is, we carry out requests manually and may ask you to confirm your identity first.
If your organisation set up the workspace, ask your organisation’s administrator first: for estimation content, your organisation decides how it is used.
[LEGAL REVIEW REQUIRED] Confirm the rights wording, the response time, identity-check approach and the wording for requests that concern customer-controlled data.
Children
Two Weeks Cloud is built for working teams and is not aimed at children. [MINIMUM AGE POLICY]
Changes to this policy
We will update this page when what we do with personal data changes, and tell customers about material changes: [CHANGE NOTICE METHOD AND PERIOD].