Privacy Policy

This Privacy Policy describes how Enginely collects, uses, and protects information in connection with the Enginely Service, and how it applies to our Terms of Service.

1. Roles

When your company (the "Customer") uses Enginely, Customer is the data controller (or "Business" under the CCPA/CPRA) for the personal data of its employees submitted to the Service — names, roles, and pulse/scorecard responses. Enginely is the data processor (or "Service Provider"), and processes that data only on Customer's instructions to provide the Service.

2. What we collect

• Account data: name, work email, authentication events.
• Workspace data Customer or its team members enter: scorecard metrics, quarterly priorities, meeting notes, issues, and organizational structure.
• Billing data, handled by our payment processor — Enginely does not store full card numbers.
• Standard technical logs (access times, IP address, browser type) for security and troubleshooting.

3. Sub-processors

4. Security

We encrypt data in transit and at rest, restrict administrative access with multi-factor authentication, log access to production systems, and maintain an incident response process. If we become aware of unauthorized access to your data, we will notify affected Customers without undue delay.

5. Your rights

Depending on where you're located, you may have rights to access, correct, or delete your personal data. Employees should first contact their employer (the Customer), who controls that data; Customer may contact us to assist with any request.

6. International transfers

Where personal data is transferred from the EU/UK/Switzerland to the United States, such transfers are governed by the EU Standard Contractual Clauses (or UK Addendum) to the extent required by applicable law.

7. Data Processing Agreement

Business customers, and any customer with EU or otherwise regulated employee data, can request our Data Processing Agreement, which includes our full sub-processor list, security commitments, and breach-notification terms.

8. Retention and deletion

We retain Customer Data for as long as the account is active. On termination, Customer Data is available for export for 30 days, after which it may be deleted, unless a longer retention period is required by law.

9. Contact

Questions about this policy can be sent through Support.