Privacy Policy

1. Data We Collect

We collect the following types of personal data to provide the Service:

• Account information: name, email address, company name, and role
• Feedback data: performance reviews, ratings, and comments submitted during feedback cycles
• Peer signals: Impact Tokens and Growth Tips exchanged between colleagues
• Survey responses: answers to pulse survey questions
• Usage data: login timestamps, language preferences, and feature usage patterns
• Technical data: browser type, IP address, and device information for security and analytics
• Billing data: subscription and payment information processed by Stripe, Inc. — this data is stored and managed by Stripe, not on our servers

2. How We Use Your Data

We use collected data solely to:

• Provide and maintain the Service functionality
• Generate feedback reports and analytics for authorized users
• Send email notifications about feedback cycles, signals, and surveys
• Improve the Service through aggregated, anonymized usage analytics
• Ensure platform security and prevent unauthorized access
• Comply with legal obligations

3. Data Storage and Security

Your data is stored on secure servers with encryption at rest and in transit. We implement industry-standard security measures including access controls, regular backups, and monitoring. While no system is 100% secure, we take reasonable precautions to protect your personal data.

4. Multi-Tenant Data Isolation

Small Gains operates as a multi-tenant platform where each company's data is logically isolated. Users can only access data within their own company. This isolation is enforced at the application level through company-scoped queries and access controls. No user from one company can view, modify, or export data belonging to another company.

5. Data Sharing

We do not sell, rent, or trade your personal data to third parties. We may share data only in the following cases: (a) with Stripe, Inc., our payment processor, who processes billing and payment data under their own privacy policy at stripe.com; (b) with other service providers who assist in operating the platform, under strict data processing agreements; (c) when required by law, regulation, or legal process; (d) to protect the rights, property, or safety of Celerity Labs LLC, our users, or the public.

6. Cookies

We use essential cookies to maintain your session and language preference. We do not use advertising or tracking cookies. Session cookies are deleted when you close your browser. The language preference cookie is stored for up to one year for convenience.

7. Your Rights (GDPR)

If you are located in the European Economic Area, you have the following rights regarding your personal data:

• Right of access — request a copy of your personal data
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure — request deletion of your data (subject to legal retention obligations)
• Right to data portability — receive your data in a structured, machine-readable format
• Right to restrict processing — limit how we use your data
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent

8. Data Retention

We retain your personal data for as long as your company has an active subscription. Upon account termination, company managers may request a data export within 30 days. After this period, we delete all company data from our active systems within 90 days. Backup data may be retained for up to 6 months for disaster recovery purposes before being permanently deleted.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify registered users of material changes via email. Your continued use of the Service after changes take effect constitutes your acceptance of the revised policy.

10. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at [email protected]. For GDPR-related inquiries, our response time is within 30 days of receiving your request.