This instance hasn’t set its operator’s details (the LEGAL_* environment variables), so the bracketed placeholders below are not filled in.
Legal
Privacy Policy
Version 2026-10-14, effective 14 October 2026.
Asincly runs asynchronous standups: people on a team check in with a short written note and, if they want, a video, and the team reads them instead of meeting. This policy says what personal data that involves, who is responsible for it, and what you can do about it.
Who is responsible
This service is operated by [operator name — set LEGAL_ENTITY_NAME], [registered address — set LEGAL_ADDRESS], [country — set LEGAL_COUNTRY]. Contact: [contact email — set LEGAL_EMAIL].
We have two roles, and it matters which one applies:
- Your organization is the controller of what your team puts in Asincly — check-ins, recordings, transcripts, summaries, replies, reactions, away periods. We process that content as their processor, on their instructions, under our Data Processing Agreement. If you’re here because your employer uses Asincly, they decide why this data is collected and how long it is kept, and requests about it go to them first (we help them answer).
- We are the controller of the data we need to run the service itself: accounts and sign-in, security logs, billing, and service emails.
What we process, why, and on what basis
| Data | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Account: email, name, time zone, sign-in method; sessions (device, network prefix, last active); 2FA settings | To sign you in, keep your account secure and show you your teams | Contract (b) with you or your organization; legitimate interest (f) in account security |
| Team content: check-ins, recordings, AI transcripts, summaries and drafts, replies, reactions, away periods, mentions | To run your team's standups | Processed for your organization, which determines the basis (often contract or legitimate interest towards its staff) |
| Notifications and email preferences | Reminders when your window opens, mentions, replies | Contract (b); you can turn emails off |
| Billing: organization owner's contact, company name, address, VAT ID, invoices (card details stay with Stripe) | To charge for paid plans and keep tax records | Contract (b); legal obligation (c) for tax records |
| Security and abuse records: audit log of administrative actions, rate-limit counters, request logs | To protect accounts and the service, and investigate incidents | Legitimate interest (f) |
We don’t sell personal data, show ads, or use analytics or tracking cookies (see Cookies).
AI processing of recordings
When a team has AI drafting on and you record a video, the audio track is sent to our AI provider (listed in Subprocessors) to transcribe it and draft your check-in, together with your private notes, your previous plan and your teammates’ names. You see the draft and edit it before anyone else does; check-ins sent from a draft are marked “ai-assisted”. The recorder tells you this before you start. Nothing is decided about you automatically (no Art. 22 decisions).
You can opt out under Account → AI: your videos are then kept as they are and never sent for processing. Organization admins can also turn AI drafting off for a whole team.
Who else receives data
Only the service providers that help us run Asincly, on contract and for the purposes above: hosting, database, storage, email, AI, payments, and — if your team uses them — Google sign-in and Slack. The full list, with what each receives, is on Subprocessors. We disclose data to authorities only when the law requires it.
Where data is stored and transfers outside the EU
The database and recordings are hosted in [hosting region — set LEGAL_DATA_REGION]. Several providers are US companies, so data can be accessed from or processed in the United States. Those transfers rely on the EU–US Data Privacy Framework where the provider is certified, and on the European Commission’s Standard Contractual Clauses otherwise. You can ask us for a copy of the safeguards.
How long we keep it
| Data | Kept |
|---|---|
| Recordings (video and audio) | Per your team's setting (default 90 days); on the Free plan, videos past its history window are deleted 30 days after leaving Pro |
| Written check-ins, replies, reactions, transcripts and summaries | Until your organization deletes them, deletes the team or organization, or you delete your account |
| Notifications | 90 days |
| Sessions | Until you sign out, revoke them, or 30 days without use |
| Sign-in links | 1 hour, single use |
| Audit log | For the life of the organization |
| Rate-limit counters | 2 days |
| Billing records and invoices | As long as tax law requires |
Deleting a recording, team, organization or account removes the database records and the files in storage right away. Copies in database backups disappear as the backups roll over.
How it’s protected
- Every request reads and writes as the signed-in person, under Postgres row-level security keyed on team membership.
- Transcripts, summaries, AI drafts, Slack tokens and 2FA secrets are encrypted in the database with AES-256-GCM. Written check-ins, replies and notifications are stored without that extra column encryption.
- Recordings go from your browser straight to private storage; playback uses links that expire within minutes.
- TLS in transit; strict Content-Security-Policy; optional two-factor authentication and enforced SSO for organizations.
More on the Security page.
Your rights
Under the GDPR you can ask to:
- Access your data and take it with you — Account → Your data → Download my data.
- Correct it — your name and time zone are editable under Account; anything else, ask us.
- Erase it — Account → Delete account removes you, your check-ins and recordings.
- Restrict or object to processing — including opting out of AI processing under Account → AI.
- Withdraw consent where we rely on it, without affecting what came before.
For anything not covered in the app, email [contact email — set LEGAL_EMAIL]. We answer within one month. Where your organization is the controller, we pass your request to them and help them respond. You also have the right to complain to a supervisory authority: the data protection authority of your EU/EEA country of residence or work.
Children
Asincly is a workplace tool and isn’t meant for anyone under 16.
Changes
We’ll post any change here with a new version and date, and email organization owners before a material change takes effect.