Privacy Policy
This Privacy Policy explains how 1296869 Ontario Limited, operating as Artala ("Artala," "we," "us," or "our"), collects, uses, stores, and protects your personal information when you use the Artala platform (the "Service").
By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.
1. Data Controller
For the purposes of applicable data protection laws (including the EU General Data Protection Regulation and Canada's Personal Information Protection and Electronic Documents Act), the data controller is:
1296869 Ontario Limited, operating as Artala
Ontario, Canada
privacy@artala.app
When a workspace owner invites users and manages workspace data, Artala acts as a data processor on behalf of that workspace owner (the data controller for their organisation's data).
2. Information We Collect
Account Information. When you register, we collect your name, email address, and a password (stored as a cryptographic hash — we never store plaintext passwords). If you sign up or sign in with Microsoft or Google instead, you do not need a password with us. If you enable two-factor authentication, we store the associated TOTP secret.
Sign in with Microsoft or Google. If you choose to sign in with a Microsoft or Google account, that provider tells us your name, your email address, whether it has verified that address, an identifier for your account with it and, for a work or school account, your organisation’s domain. Google also tells us where your profile picture is; for a Microsoft account, we ask Microsoft for your profile photo. We use these only to sign you in, to connect the account to your Artala account and — the first time you do, if you have not set a profile photo with us — to use that picture as your Artala profile photo. We keep our own copy; you can change or remove it under Profile. We do not receive your password for that account, and we do not access your email, calendar, contacts or files. You can see and remove connected accounts under Profile → Sign-in methods.
Workspace and Project Data. Data you and your workspace members enter into the Service, including tasks, comments, attachments, timesheets, board configurations, custom fields, and any other content ("Customer Data"). Customer Data is owned by you as described in our Terms of Service.
Billing Information. Payment information (credit card numbers, billing addresses) is collected and processed directly by our payment processor, Stripe. We do not store credit card numbers on our servers. We may receive and store limited billing details from Stripe such as the last four digits of your card, card brand, and billing country for display in your account.
Usage and Technical Data. We collect information about how you interact with the Service, including browser type, device information, IP address, pages visited, and feature usage. This data is used to maintain and improve the Service.
Communications. If you contact us at support@artala.app, we retain the correspondence to respond to your inquiry and improve our support.
AI Connections. If you connect an AI assistant to Artala (for example Claude or ChatGPT), we record the connection: which assistant, whether it may make changes, when it was connected and when it was last used. We store only a fingerprint (hash) of its access tokens, never the tokens themselves. Changes an assistant makes are recorded in task history and the audit log under your name and the assistant’s, for example “Dana Cohen (via Claude)”.
3. How We Use Your Information
We use your information for the following purposes:
- To provide, operate, and maintain the Service
- To process subscriptions and payments
- To send transactional emails (account verification, password resets, workspace invitations, task notifications, weekly digests)
- To provide AI-powered features (workspace assistant, task creation, playbook generation, digest summaries)
- To contact you occasionally about your experience with the Service, and to request product feedback
- To send product update emails, if and only if you have explicitly asked to receive them
- To enforce our Terms of Service and protect against abuse
- To comply with legal obligations
We do not sell your personal information to third parties. We do not use Customer Data for advertising purposes.
4. Legal Basis for Processing (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, our legal basis for processing your personal data depends on the context:
| Purpose | Legal Basis |
|---|---|
| Providing the Service and managing your account | Performance of a contract (Article 6(1)(b)) |
| Processing payments and tax compliance | Legal obligation (Article 6(1)(c)) |
| Sending transactional emails | Performance of a contract (Article 6(1)(b)) |
| Contacting you about your experience with the Service | Legitimate interests (Article 6(1)(f)) |
| Sending product update emails | Consent (Article 6(1)(a)), withdrawable at any time |
| Improving the Service and analytics | Legitimate interests (Article 6(1)(f)) |
| AI feature processing | Performance of a contract (Article 6(1)(b)) |
| Providing workspace data to an AI assistant you connected, when you ask it to | Performance of a contract (Article 6(1)(b)) |
5. Third-Party Service Providers
We share your information with the following categories of service providers, solely to operate the Service:
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Microsoft Azure | Hosting, database, file storage | All Service data | West Europe (Netherlands) |
| Stripe | Payment processing | Billing details, email, tax IDs | United States |
| Twilio SendGrid | Transactional email delivery | Email address, name, email content | United States |
| Anthropic | AI features (workspace assistant, task generation) | Workspace metadata, task data relevant to the query | United States |
| Cloudflare | Website hosting, CDN, DNS | IP address, request metadata | Global edge network |
Each provider processes data in accordance with their own privacy policies and applicable data protection agreements. Where data is transferred outside of the EEA, we rely on Standard Contractual Clauses or the provider's adequacy framework.
AI assistants you connect are not our service providers. When you or someone in your workspace connects an AI assistant through Artala’s AI connector, that assistant is chosen and engaged by you or your organisation, not by Artala. Workspace data the assistant reads is sent to its provider at your request and is handled under your agreement with that provider and its privacy policy, not this one.
Microsoft and Google, when you sign in with them, are not our service providers either. You choose to use your account with them; they confirm who you are to us under your agreement with them and their privacy policies. We send them only what the sign-in needs (which app is asking, and where to return you) and, when you first connect a Microsoft account, one request for your profile photo; they send us the details listed in section 2.
6. AI Feature Data Processing
When you use AI features, relevant workspace data (such as task titles, descriptions, assignees, statuses, and dates) is sent to our AI provider (Anthropic) to generate responses. This data is transmitted securely and is not used by the AI provider to train their models. AI processing is triggered only when you actively use an AI feature — workspace data is not passively sent to AI providers.
Connected AI assistants. On the Pro plan, people in a workspace can also connect their own AI assistant (for example Claude or ChatGPT). A connected assistant can read the workspace data that the person who connected it can see — or, for a workspace API key, the key’s creator — and, if they allowed it, make changes with that person’s permissions. It acts only when the person asks it to. Workspace Owners and Admins can see every connection and disconnect any of them.
AI features are optional. A workspace Owner or Admin can turn AI off for the entire workspace in Workspace Settings. When AI is off, Artala’s own AI features are unavailable to everyone in the workspace, no AI assistant can be connected, and assistants already connected cannot read or change anything — so no workspace data is sent to our AI provider or to any connected assistant. The change takes effect within about a minute.
7. Data Retention
We retain your account information and Customer Data for as long as your account is active. When you delete your individual account, your name and email are removed and the content you authored is anonymised. When a workspace is closed or its subscription lapses, its data is retained for a recovery period of up to approximately 90 days across our lock and deletion stages, after which it is permanently deleted from our active systems; residual copies are then removed from encrypted backups in the ordinary course of our backup rotation.
A Microsoft or Google account connected to your Artala account stays connected until you remove it or delete your Artala account. A profile photo we copied from it stays your Artala profile photo until you change or remove it, or delete your account. While a sign-in is in progress we hold its details for a few minutes; a Microsoft photo fetched for it is erased as soon as it has been used, or after the sign-in expires, and the whole record of each sign-in is deleted after one day.
Images pasted into task descriptions and comments are stored separately from file attachments and are deleted 24 months after they are uploaded, even while the workspace remains active; the text of the description or comment is not affected.
Billing records are retained as required by applicable tax and accounting laws (typically 7 years).
Audit logs are retained for up to 36 months by default, and are deleted when the workspace is deleted if that occurs sooner. Workspace administrators may configure a shorter retention period.
8. Data Security
We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), encryption at rest for database and file storage, role-based access controls within the application, HMAC-signed webhooks for API integrations, two-factor authentication support, sign-in with Microsoft or Google (which workspace owners on the Pro plan can require for their workspace), and session management with revocation.
While we take reasonable steps to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.
9. Your Rights
For all users. You may at any time:
- Access and update your personal information through your account settings
- Export your personal data using the built-in data export feature
- Delete your account using the self-service account deletion feature (GDPR Article 17 — Right to Erasure)
- Request information about what data we hold about you by contacting privacy@artala.app
Additional rights under GDPR (EEA/UK/Swiss users). You have the right to request restriction of processing, object to processing based on legitimate interests, request data portability, and lodge a complaint with your local data protection authority.
Rights under PIPEDA (Canadian users). You have the right to access your personal information, challenge its accuracy, and withdraw consent for non-essential processing by contacting privacy@artala.app.
10. International Data Transfers
The Service is hosted in the Microsoft Azure West Europe region (Netherlands). Some of our service providers (Stripe, SendGrid, Anthropic) are based in the United States. Where personal data is transferred outside of the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.
11. Email Communications (CASL Compliance)
We send transactional emails that are necessary for the operation of the Service (account verification, password resets, workspace invitations, task notifications). These are exempt from consent requirements under Canada's Anti-Spam Legislation (CASL) as they relate to an existing business relationship.
Weekly digest emails are a feature of the Service that you can enable or disable in your account settings. By enabling digest emails, you consent to receiving them. You may withdraw this consent at any time through your settings.
Product feedback. We may occasionally contact you directly to ask about your experience with the Service — for example, to understand why a trial did not continue, or to gather feedback on a feature you used. These messages are product research rather than promotion: they will not advertise features, offer discounts, or ask you to purchase or upgrade. They identify us as the sender, and each one includes a way to tell us not to contact you again, which we honour permanently.
Product updates. If you have explicitly opted in, we may send occasional email about new Artala features and language support. This is the only category of email we send that is promotional in nature, and you will only ever receive it because you asked to: we never add anyone automatically, we never treat creating an account or accepting our Terms as consent, and the opt-in is never pre-selected. Every such email identifies us and carries a one-click unsubscribe, and you can withdraw consent at any time in your account settings. We keep a record of when, where and how consent was given, and of the exact wording you were shown.
We do not sell or rent our mailing list, we do not send email on behalf of third parties, and we do not use Customer Data to build marketing audiences.
12. Children
The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 16, we will take steps to delete that information promptly.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website with a new version number and effective date. Your continued use of the Service after such changes constitutes acceptance of the updated policy.
14. Contact
For privacy-related questions or requests:
1296869 Ontario Limited, operating as Artala
Email: privacy@artala.app