Legal
Privacy Policy
Last updated
How Ayebridge handles personal data, written to be read rather than skimmed past.
1. Who we are
Ayebridge is client portal and project approval software operated by Sianipar Consults LLC, a Missouri limited liability company (Missouri charter number LC014758768), trading as Ayebridge, with its business address at c/o United States Corporation Agents, Inc., 1028 N Kingshighway St, Cape Girardeau, MO 63701-3503, United States. In this policy, “we”, “us” and “Ayebridge” mean Sianipar Consults LLC.
For the personal data described in this policy as ours, Sianipar Consults LLC is the controller (in US terms, the business). Our privacy contact is privacy@ayebridge.com. You can also write to us at Sianipar Consults LLC, c/o United States Corporation Agents, Inc., 1028 N Kingshighway St, Cape Girardeau, MO 63701-3503, United States.
This policy covers our website, the Ayebridge app, client portals and our emails. It does not cover the websites of our customers or of third parties we link to.
2. When we are controller and when we are processor
We handle personal data in two different roles:
- As controller for data about our customers and their team members (accounts, billing, support), visitors to our website, people who contact us or report abuse, and the security records we keep to protect the Service.
- As processor (in US terms, service provider) for everything our customers put into their workspaces, including the names and email addresses of the client contacts they invite and the files, comments, approvals and requests in their portals. Here the customer, usually a freelancer or agency, is the controller and decides why the data is processed. We process it only on their instructions, under our Data Processing Addendum.
If you are a client contact and want to access, correct or delete data in a portal, please contact the freelancer or agency who invited you. If you contact us instead, we will pass your request to them and help them respond.
3. Personal data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account data | Name, email address, password (stored only as a salted hash), two-factor settings, workspace memberships and roles, notification settings. | You, when you sign up or are invited to a team. |
| Agreement records | Which version of the Terms and the Refund and Cancellation Policy you accepted, when, and the IP address and browser used, at sign-up and at checkout. | Created when you accept. |
| Billing data | Billing name and address, tax ID, card brand and last four digits, expiry month and year, plan, invoices, payment, refund and dispute status. We never receive full card numbers or security codes. | You, through Stripe Checkout and the Stripe customer portal, and Stripe. |
| Workspace content (processed for customers) | Client names, client contacts' names and email addresses, files and versions, updates, comments, approval decisions (with name, email, time, IP address and browser), requests, quote and invoice documents, branding. | Our customers, their team members and the client contacts they invite. |
| Usage and technical data | Sign-in sessions (IP address, browser and device), security and audit events, error logs, and request logs kept by our hosting provider. | Your browser or device, when you use the Service. |
| Website analytics | Aggregate page views: page address, referrer, country, browser, operating system and device type. No cookies and no identifiers that follow you across sites. | Your browser, only where analytics are allowed (see below). |
| Communications | Emails to support, contact-form messages, abuse and copyright reports, and our replies. | You, when you write to us. |
We do not ask for, and ask customers not to upload, special categories of personal data (such as health data) unless their project genuinely needs it. We do not buy personal data from data brokers.
4. Why we use it and our legal bases
Under the GDPR and UK GDPR we must have a legal basis for each use of personal data as a controller. These are our purposes and bases:
| Purpose | Data used | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Create and run your account and workspace, and provide the Service | Account data, workspace content, usage data | Performance of our contract with you (Art. 6(1)(b)). For team members of a customer: our legitimate interest in providing the Service the customer bought (Art. 6(1)(f)). |
| Take payments, issue invoices and refunds, calculate tax | Billing data, account data | Performance of the contract (Art. 6(1)(b)); legal obligations on tax and accounting (Art. 6(1)(c)). |
| Send service emails (sign-in links, receipts, trial and renewal notices, notifications you can switch off) | Account data, workspace content | Performance of the contract (Art. 6(1)(b)). |
| Keep the Service secure, prevent fraud and abuse, enforce our Terms | Usage data, account data, communications | Legitimate interests in protecting our customers, their clients and the Service (Art. 6(1)(f)). |
| Handle payment disputes and legal claims | Agreement records, billing data, usage data | Legitimate interests in establishing and defending legal claims (Art. 6(1)(f)). |
| Answer support requests and messages | Communications, account data | Legitimate interests in helping you (Art. 6(1)(f)); contract where you are a customer. |
| Understand how the website is used, in aggregate | Website analytics | Consent in the EEA, UK and Switzerland (Art. 6(1)(a)); legitimate interests elsewhere (Art. 6(1)(f)). |
| Comply with the law and requests from authorities | Any relevant data | Legal obligation (Art. 6(1)(c)). |
We do not use personal data for advertising, we do not build advertising profiles, and we do not make decisions with legal or similarly significant effects about anyone by automated means alone. We do not sell personal data.
5. Payments and Stripe
Payments are processed by Stripe. When you subscribe, you enter your payment details on a checkout page hosted by Stripe, and you manage payment methods in the Stripe customer portal. Your full card number and security code go directly to Stripe and never reach our servers. Stripe sends us only the limited billing data listed above.
Stripe processes payment data for us as a service provider. Stripe also uses some payment data as an independent controller, for example to prevent fraud and to meet its own legal obligations, as described in the Stripe Privacy Policy (opens in a new tab). Stripe Tax uses your billing address and any tax ID to calculate sales tax or VAT.
6. Who receives personal data
We share personal data only with the providers that help us run the Service (our subprocessors), under contracts that limit their use of it to providing their services to us:
| Subprocessor | Purpose | Location | Their terms |
|---|---|---|---|
| Stripe, Inc. | Payment processing, subscription billing, invoicing and sales tax calculation | United States | |
| Vercel Inc. | Application hosting, content delivery and website analytics | United States | |
| Neon Inc. (Databricks) | Managed PostgreSQL database | United States | |
| Cloudflare, Inc. | File storage (R2), DNS, email routing and network security | United States / global network | |
| Resend (Plus Five Five, Inc.) | Transactional email delivery | United States |
The list is kept up to date on our Subprocessors page. We may also disclose personal data:
- inside a workspace, to the team members and client contacts the customer has given access;
- to professional advisers, such as lawyers and accountants, under a duty of confidentiality;
- when the law requires it, or to protect the rights, safety or property of our customers, their clients, the public or us. We push back on requests that are not legally valid;
- to a buyer or successor if our business is sold or reorganized, who must keep protecting it as this policy describes.
8. How long we keep data
| Data | How long |
|---|---|
| Account data | While your account exists. After you delete it, removed from live systems within 30 days. |
| Workspace content | While the workspace exists. After a trial or subscription ends, the workspace is kept read-only for at least 30 days; we email the Owner at least 14 days before deleting it. Deleted files stay restorable for 30 days. When a workspace is deleted, its data is removed from live systems within 30 days. |
| Backups | Deleted data can remain in our providers' rolling backups for up to a further 30 days, after which it is overwritten. |
| Billing records and agreement records | 7 years after the end of the financial year they relate to, as tax and accounting laws require and to deal with disputes. |
| Security and audit logs, and records of past sign-ins | Up to 12 months, unless needed longer to investigate an incident or respond to an open payment dispute. A sign-in session you are still using is kept while it is active. |
| Data exports | The download link and the export file are removed after 7 days. |
| Support, contact and abuse records | Up to 3 years after the matter is closed. |
| Rate-limit counters (IP-based) | About one day. |
| Website analytics | Aggregate only. Vercel discards the visit hash after 24 hours. |
Customers decide how long the content in their workspaces is kept, within the limits above, and can delete it at any time.
9. Your rights (EEA, UK and Switzerland)
If the GDPR, UK GDPR or Swiss data protection law applies to you, you have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have data deleted, where there is no good reason for us to keep it;
- restrict how we use it, or object to processing based on our legitimate interests;
- receive data you gave us in a portable format;
- withdraw consent at any time, for example for analytics, without affecting what happened before.
Email privacy@ayebridge.com. We reply within one month and may ask you to confirm your identity first. Many of these things you can also do yourself: edit your profile in account settings, export a workspace, or delete your account. You also have the right to complain to a data protection authority, such as the one where you live or work, though we would appreciate the chance to help first.
10. Your US state privacy rights
This section applies to residents of California and other US states with comprehensive privacy laws, to the extent those laws apply to us.
What we collect and why
In the last 12 months we collected the categories of personal information described in Personal data we collect: identifiers (name, email, IP address), commercial information (plan, invoices), internet or other electronic network activity (sign-in sessions, security logs, aggregate analytics), and the content of messages you send us. Account login credentials are sensitive personal information under California law; we use them only to let you sign in and keep your account secure. We use personal information only for the business purposes described in this policy and disclose it only to the service providers listed above, for those purposes.
No sale or sharing
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done either in the last 12 months. We do not knowingly collect personal information from anyone under 16. You can still record an opt-out on Your Privacy Choices, which also switches off our analytics, and we honor Global Privacy Control signals.
Your rights
You have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to opt out of sale, sharing and targeted advertising; and not to be treated differently for using these rights. To make a request, email privacy@ayebridge.com. We verify requests by asking you to confirm from the email address on the account, or with other information that matches what we hold. An authorized agent may make a request for you with your signed permission. If we decline a request, you can appeal by replying to our decision; if you are not satisfied with the outcome, you can contact your state attorney general.
11. International transfers
Sianipar Consults LLC is based in the United States, and our providers store and process data mainly in the United States. If you are in the EEA, the UK or Switzerland, your personal data is therefore transferred to the United States.
We protect these transfers with the European Commission’s Standard Contractual Clauses (with the UK Addendum and the Swiss amendments where relevant), and, where a provider is certified under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, on that certification. You can ask for a copy of the relevant safeguards at privacy@ayebridge.com.
12. How we protect data
- Encryption in transit (HTTPS with HSTS) everywhere, and encryption at rest by our database and storage providers.
- Files are kept in private storage. Every upload and download uses a signed link that expires within minutes; there are no public file links.
- Each workspace’s data is separated in our data layer, and client contacts see only their own client’s portal. Automated tests check this isolation.
- Passwords are stored only as salted hashes. Two-factor authentication is available to every team member.
- Rate limits on sign-in and public forms, security headers including a content security policy, and executable file types blocked.
- Access to production systems is limited to the people who need it, and administrative actions are logged.
- Backups are made by our database provider.
No system is perfectly secure. If a breach affects your personal data, we will tell you and the relevant authorities as the law requires. Report security issues to security@ayebridge.com.
13. Children
Ayebridge is a business tool and is not directed at children. You must be at least 18 to create an account, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, please contact privacy@ayebridge.com and we will delete it.
14. Changes to this policy
We will update this policy when our practices change and change the date at the top. If a change is material, we will email account holders at least 30 days before it takes effect, unless the law requires a change sooner.
15. Contact
Questions and requests: privacy@ayebridge.com. Post: Sianipar Consults LLC, c/o United States Corporation Agents, Inc., 1028 N Kingshighway St, Cape Girardeau, MO 63701-3503, United States. Security issues: security@ayebridge.com.