1. Our role
For personal information inside a customer’s ProjectSmith workspace, the customer decides what is processed and why (it is the “controller” or “business”), and we process it on the customer’s behalf (as “processor” or “service provider”) under our Data Processing Addendum. For information about our own customers’ contacts, website visitors and people who contact us, we decide how it is used and are responsible for it.
2. What we collect
We collect:
- Website and email: what you send when you email us, and standard server logs (IP address, browser, pages requested). The website uses no analytics or advertising cookies.
- Account details: name, email address, role and seat of each user, and sign-in records.
- Workspace data: data brought in from the customer’s Autotask instance (resources, projects, tasks, tickets, time entries, companies and contacts) and data created in ProjectSmith, such as timesheets, leave, approvals, allocations, budgets and audit records.
- Support requests: what you write, and the details attached to an in-app request (workspace, name, the page you were on, your browser, the app version and recent app error messages).
- Billing: the billing contact and company name. Card details are collected and held by Stripe; we never receive full card numbers.
- Email delivery: addresses we send to, and whether a message was delivered or bounced.
3. How we use it, and why
To provide, support and secure the service; to bill for it; to send service emails such as invitations, notifications and trial and billing notices; to answer enquiries; to improve the service using aggregated information; and to meet legal obligations.
Where the UK or EU GDPR applies, we rely on: performing our contract with the customer; our legitimate interests in running, securing and improving the service and answering enquiries; complying with legal obligations; and consent where the law requires it.
We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use customer workspace data to train machine-learning models.
5. Where it is stored, and international transfers
Customer workspace data is hosted in Australia (Microsoft Azure, Australia East), with encrypted backup copies in Microsoft Azure, Australia Southeast. United Kingdom and United States regions are planned. Because we are a US company and our customers are worldwide, personal information may also be accessed from or transferred to other countries, including the United States and Australia: by our staff when they support and operate the service, and by sub-processors that handle limited data elsewhere, such as sign-in identity data (Microsoft Entra), billing data (Stripe), email delivery (SMTP2GO) and the support mailbox (Microsoft 365).
Where we transfer personal information across borders we protect it as the law of its origin requires. For information from the UK or EU, that means safeguards such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum. For information from Australia, we take reasonable steps to make sure overseas recipients handle it consistently with the Australian Privacy Principles.
6. How long we keep it
Workspace data is kept while the workspace exists. The workspace Owner can export it from the app, and it is permanently deleted 30 days after the Owner requests deletion. Databases keep 35 days of point-in-time restore, plus weekly backups for 12 weeks and monthly backups for 12 months. Backups are encrypted and copied to Microsoft Azure Australia Southeast for disaster recovery. Backups are shared across all customers and cannot be purged for one customer, so deleted data stays in encrypted backups until they age out, for up to 12 months, and is never restored except for disaster recovery.
Audit records are kept after a workspace is deleted, as our security and compliance record of what happened in the service. They can include names and email addresses. We keep them for as long as required for security, legal and compliance purposes, and at least 12 months.
Emails and support requests are kept as long as we need them to deal with the enquiry and for our records.
7. Security
We protect personal information with the measures described on our Security page, including tenant isolation, encryption in transit and at rest, multi-factor authentication and audit logging.
8. Your privacy rights
If your information is in a customer’s workspace, that customer controls it, so we will usually pass your request to them and help them respond. Otherwise, contact us and we will respond as the law where you live requires.
- Australia: we comply with the Australian Privacy Principles in the Privacy Act 1988 (Cth) for personal information of people in Australia, including access and correction, and the Notifiable Data Breaches scheme. You can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
- United Kingdom and European Union: you can ask for access, correction, deletion, restriction or portability of your information, and object to processing based on legitimate interests. You can complain to the UK Information Commissioner’s Office or your local data protection authority. Business customers can get our Data Processing Addendum, which covers UK and EU GDPR terms.
- United States: if a state privacy law such as the California Consumer Privacy Act (as amended by the CPRA) applies to you, you can ask to know what personal information we hold and how we use it, and ask us to correct or delete it. We do not sell or share personal information as those laws define it, and we will not treat you differently for using your rights. You can make a request yourself or through an authorised agent.
9. Making a request or a complaint
Email privacy@getprojectsmith.com. We may need to confirm your identity before acting on a request. We aim to respond within 30 days, and always within the time the law that applies to you allows.
11. Children
ProjectSmith is a business service and is not meant for children. We do not knowingly collect personal information from anyone under 16.
12. Changes to this policy
We will post changes on this page and update the date at the top. If a change is significant we will tell workspace Owners by email.
13. Contact
[legal entity name], [registered address], Chicago, IL, USA. Email privacy@getprojectsmith.com.