Privacy Policy
This Privacy Policy covers the marketing site and the encrypted1on1 Cloud service. Self-hosted deployments are covered by the deploying organization’s own privacy policy — the product itself has a configurable footer link for exactly this purpose (see the deployment docs). Throughout this policy, "the Operator", "we", and "us" refer to the individual or entity operating the encrypted1on1 Cloud service and this website.
1. What this policy covers
The marketing site and the Cloud service. Self-hosted deployments are covered by the deploying organization’s own privacy policy (see the scope note above).
2. What we can technically see, and what we can’t
This is the most important section on this page. Metadata we can see: who talks to whom, meeting dates, account emails. Content we structurally cannot see, because of end-to-end encryption: answers, feedback, comments, goal checkpoints. For the technical reader who wants the real threat model, not just the summary, see our encryption documentation.
3. Marketing site data
No third-party analytics or trackers run on this site. Privacy wins over conversion-tracking convenience — a privacy-first product running third-party analytics on its own site would be a real, easily-noticed credibility gap for exactly the audience most likely to check. If analytics are ever added, they’ll be a self-hosted or privacy-respecting tool (e.g. Plausible, Fathom, Umami — no third-party cookies, no cross-site tracking), and this section will say so plainly. No cookie banner is needed as long as this holds — there’s genuinely nothing to consent to. The one exception is the Cal.com booking widget used for “Book a demo” — that’s disclosed below as a sub-processor, not lumped in with “no analytics,” since it’s the actual mechanism of a request you make, not a tracker.
4. Cloud service data
Account data (email, hashed authentication material — never the actual password or master key, which never leave your browser), billing data for paid tiers once Cloud billing launches (via a third-party payment processor, to be named here once one is chosen), and server logs with their retention period.
5. Data location
Cloud infrastructure is physically hosted in Lithuania, within the EU/EEA — relevant for GDPR-conscious customers specifically, since it means Cloud customer data doesn’t leave the EU/EEA by default.
6. Sub-processors
One is already decided and real: Cal.com, used for the “Book a demo” lead-capture flow — it handles the name, email, and company of anyone who books a call. The Cloud infrastructure/hosting provider is located in Lithuania (see Section 5); the specific provider, along with the payment processor and email delivery provider, will be named here once those vendors are chosen ahead of Cloud launch.
7. Data subject rights
Access, export, and deletion. The product already has self-service account deletion and data export built in for self-hosted deployments; the Cloud version will offer the same. You can also exercise these rights, or ask a question about them, by contacting the Operator directly (see Section 11).
8. Data retention
Tied to the pricing tiers above: the Free Cloud tier keeps 3 months of history, Plus and Enterprise keep it indefinitely (until you delete it or close your account). “Retention” here means actual deletion, not just hiding old data from the interface — see the Terms of Service’s Termination section for the 30-day export window on account closure.
9. Security practices
End-to-end encryption for content, plus standard practices for the metadata that is visible to us: encryption at rest and in transit, and access controls limiting who can reach production systems.
10. Changes to this policy
The Operator may update this policy from time to time. For material changes, you’ll be given at least 30 days’ notice — by email to the address on your account and/or a notice on this site — before the change takes effect.
11. Contact
For privacy questions or requests, contact the Operator at aleksejs0@gmail.com.