PRIVACY POLICY

Seven Gems LLC ("Setsail," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our user lifecycle management platform and related services (collectively, the "Service"). Please read this Privacy Policy carefully. By accessing or using the Service, you agree to be bound by the terms described herein.

1. INFORMATION WE COLLECT

1.1 Information You Provide to Us

We collect information you provide directly when using our Service, including:

• Account Information: Name, email address, company name, phone number, and authentication credentials
• Member Data: Employee information you enter into the system for lifecycle management purposes, including names, email addresses, job titles, start dates, and termination dates
• Billing Information: Payment card details and billing addresses (processed securely through third-party payment processors)
• Communications: Content of messages, support tickets, and feedback you send to us

1.2 Information Collected Automatically

When you access or use our Service, we automatically collect certain information, including:

• Log Data: IP address, browser type, operating system, access times, and pages viewed
• Device Information: Device identifiers, mobile network information, and hardware model
• Usage Data: Features used, actions taken, and performance metrics
• Cookies and Tracking Technologies: We use cookies, web beacons, and similar technologies to track activity and store preferences

1.3 Information from Third-Party Sources

We may receive information from third-party services you connect to Setsail, including Datto Autotask PSA and authentication providers (such as Microsoft Azure AD, Google Workspace, or Okta).

2. HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes:

• Provide and Maintain the Service:To operate, maintain, and improve Setsail's functionality
• Process Transactions: To process payments and manage billing
• Customer Support: To respond to inquiries, provide technical support, and resolve issues
• Communicate with You: To send service updates, security alerts, administrative messages, and marketing communications (with your consent)
• Analytics and Improvement: To analyze usage patterns, monitor performance, and enhance user experience
• Security and Compliance: To detect fraud, prevent security incidents, and comply with legal obligations
• Integration Management: To facilitate integrations with Datto Autotask PSA and other third-party services

3. DATA SECURITY

We implement industry-standard security measures to protect your information from unauthorized access, alteration, disclosure, or destruction. Our security practices include:

• Encryption at Rest: All member personally identifiable information (PII) is encrypted using AES-256 encryption
• Encryption in Transit: All data transmitted between your browser and our servers uses TLS/SSL encryption
• Access Controls: Strict role-based access controls limit who can access sensitive data
• Multi-Tenancy Isolation: Complete data isolation between customer organizations
• Regular Security Audits: Periodic security assessments and vulnerability testing
• Secure Infrastructure: Hosted on Microsoft Azure with enterprise-grade security controls

While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but maintain commercially reasonable safeguards.

4. DATA RETENTION

We retain your information for as long as necessary to provide the Service and fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Retention periods vary based on:

• Active Accounts: Data retained for the duration of your active subscription
• Terminated Accounts: Data retained for 90 days after account termination, then securely deleted
• Backup Data: Retained in encrypted backups for up to 30 days
• Legal Requirements: Data may be retained longer to comply with legal, regulatory, or contractual obligations

5. THIRD-PARTY SERVICES

Setsail integrates with third-party services to provide enhanced functionality:

• Datto Autotask PSA:We share member lifecycle data with Autotask to create and synchronize tickets. Your data is subject to Datto's privacy policy.
• Authentication Providers: We support single sign-on (SSO) through Microsoft, Google, and Okta. Authentication data is subject to their respective privacy policies.
• Payment Processors: Billing information is processed by third-party payment processors. We do not store complete payment card details.
• Cloud Infrastructure:Our Service is hosted on Microsoft Azure. Data storage and processing are subject to Azure's security and privacy policies.

We are not responsible for the privacy practices of third-party services. We encourage you to review their privacy policies.

6. GDPR COMPLIANCE (EU CUSTOMERS)

If you are located in the European Economic Area (EEA), you have certain rights under the General Data Protection Regulation (GDPR):

• Legal Basis for Processing: We process your data based on contract performance, legitimate interests, and legal compliance
• Data Portability: You may request a copy of your data in a structured, machine-readable format
• Right to Erasure: You may request deletion of your personal data, subject to legal retention requirements
• Right to Restriction: You may request restriction of processing in certain circumstances
• Right to Object: You may object to processing based on legitimate interests or for direct marketing purposes
• Data Protection Officer: For GDPR inquiries, contact [email protected]

7. YOUR RIGHTS

You have the following rights regarding your personal information:

• Access: Request access to the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information, subject to legal exceptions
• Opt-Out: Unsubscribe from marketing communications at any time
• Data Export: Request a copy of your data for portability purposes

To exercise these rights, please contact us at [email protected]. We will respond to your request within 30 days.

8. CONTACT INFORMATION

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

9. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated policy on this page and updating the "Last Updated" date. We encourage you to review this Privacy Policy periodically. Your continued use of the Service after changes become effective constitutes acceptance of the updated Privacy Policy.