Privacy notice

There are two situations:

• When your organisation uses Teasoo SET. Your organisation decides how its people and stakeholder data are used, so your organisation is the data controller and we are the data processor acting on its instructions. If you want to know how your organisation uses your data, please ask them.
• For our own account and enquiry data (for example when you contact us, or as the holder of an account), Teasoo Consulting is the data controller.

Our Data Protection Officer is Efeosasere Okoro. You can contact them at efeosasere.okoro@teasooconsulting.com.

• Account data: your name, email address, role, and the organisation you belong to.
• Stakeholder data your organisation enters: such as names, organisations, notes, engagement history, commitments, risk and sentiment.
• Technical data: sign-in records and basic logs we need to run and secure the service.

You can sign in with a password or with Google. When you use Google, Google verifies your identity under its own privacy policy; we only receive your name and email address.

• To provide the service under our contract with your organisation. Lawful basis: GDPR Article 6(1)(b); NDPA, performance of a contract.
• To keep the service secure and working properly. Lawful basis: our legitimate interests; NDPA, legitimate interest.
• To meet legal obligations, where they apply.

We do not sell your data, and we do not use it for advertising.

We use a small number of trusted providers to run the service. They only process data to provide their service to us, under contract:

• Supabase: database and sign-in hosting.
• Vercel: application hosting.
• Resend: sending our emails, such as invitations, reminders, and password resets.
• PostHog: privacy-focused product analytics. It shows how the app is used, so we can improve it. It never records your screen, and links containing tokens are not sent.
• Sentry: error monitoring, so we can find and fix faults. It receives error details and technical diagnostics. It does not receive your name, email, cookies, or the contents of stakeholder records.

We don't share your data with anyone else unless the law requires it.

We and our main providers process your data in the European Economic Area (EU). Some providers may process limited technical data in other regions; where data is transferred internationally, we rely on appropriate safeguards, such as standard contractual clauses, to keep it protected.

We keep personal data for as long as your organisation uses the service, and for a reasonable period afterwards. We keep it longer only where the law requires. When it's no longer needed, we delete or anonymise it.

Each organisation's data is isolated at the database level, so one organisation can never see another's. Access is controlled by role, data is protected in transit, and we test these controls continuously.

Under the GDPR and the NDPA you can ask to:

• see the personal data we hold about you (access);
• correct it if it's wrong (rectification);
• delete it (erasure);
• limit or object to how it's used;
• get a copy in a portable format;
• withdraw your consent, where we relied on it.

If your organisation is the data controller, please ask them first and we'll help them respond. For data we control, contact our Data Protection Officer at efeosasere.okoro@teasooconsulting.com.

We use essential cookies to sign you in and keep the service secure. These are always on because the service can't work without them.

We also use privacy-focused analytics (PostHog) to understand how the app is used so we can improve it. This runs only if you accept when we ask. You can decline, and nothing is collected. Our analytics never records your screen, strips any tokens or links before sending, and identifies you only by a random identifier, never by your name or email. We don't use advertising cookies, and we don't sell your data.

If you're unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to a data protection authority:

• in Nigeria, the Nigeria Data Protection Commission (NDPC);
• in the EU or UK, your local data protection supervisory authority.

We may update this notice. The date at the top shows when we last reviewed it.