Privacy policy
Last updated
Overview
This policy explains how OmniLabs Technologies ("OmniLabs", "we", "us"), based in British Columbia, Canada, handles personal information when you use debloq.io, the Debloq dashboard at app.debloq.io, and the hosted Debloq email editor.
Our short version: we collect what we need to run your account, bill you and license the editor. The email designs you and your users create stay in your own application. We do not sell personal information, and we do not use advertising or analytics trackers.
Information we collect
When you sign up for and use the dashboard, we collect:
- Account details: your name, email address, password (stored only as a secure hash), workspace name, team members and their roles, and an optional profile picture.
- Billing details: your Stripe customer and subscription IDs, plan, billing interval, trial and renewal dates, and subscription status. Card details are entered directly with Stripe and never reach our servers.
- Project details: project names, licensed domains and project keys.
- Security and audit logs: sign-in activity and changes made in your workspace, with the user, time, IP address and browser user agent.
Information from the embedded editor
Each time the editor loads in your product, it sends us its project key, the origin (domain) of the page it is embedded in, and optionally that page's URL. Our servers also receive the requesting IP address and user agent, as with any web request. We use this to confirm the key is valid for that domain, to prevent misuse, and to troubleshoot.
If you use live countdown timers, the timer images are served from our servers. When an email recipient opens an email containing a timer, their email client requests the image, and we receive standard request data such as IP address and user agent. We use it only to serve the timer and keep the service running.
Your email designs
Designs, HTML, text and images created in the editor are passed to your application through the callbacks you configure. The editor does not send them to Debloq servers. You choose where they are stored, how images are uploaded, and how test emails are sent.
Some optional editor features, such as draft recovery and locally saved blocks, swatches and assets, store data in the end user's browser (localStorage) on your domain. It stays on that device and is not sent to us.
How we use information
We use personal information only for these purposes:
- To create and manage your account, workspace and projects.
- To process payments, trials, renewals and refunds.
- To issue, verify and protect project keys.
- To send service emails, such as account verification, password resets, receipts and important changes to the Service or these policies.
- To keep the Service secure, investigate abuse and fix problems.
- To meet our legal, tax and accounting obligations.
We do not send marketing emails without your consent, and you can unsubscribe from them anytime.
Service providers
We share personal information only with providers that help us run the Service, under contracts that require them to protect it:
- Microsoft Azure: application hosting, database, caching, messaging and file storage.
- Cloudflare: delivery of the hosted editor.
- Stripe: payments and billing.
- Resend: transactional email, such as verification and password-reset messages.
We may also disclose information if required by law, to protect our rights or users' safety, or as part of a merger or acquisition, in which case this policy will continue to apply.
Where information is stored
Our providers may store and process information outside Canada, including in the United States and other countries. When that happens, the information may be accessible to courts, law enforcement and national security authorities in those countries. We use contractual and technical safeguards to protect it wherever it is processed.
How long we keep it
We keep account and project information while your account is active. When you delete a project, its key is revoked immediately. When you delete your account, we delete or anonymise your personal information within 90 days. We keep billing and tax records for as long as Canadian law requires (generally six years), and security logs for a limited period, usually no more than 12 months.
Security
We protect information with encryption in transit, hashed passwords, access controls, short-lived tokens and audit logging. No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you and the relevant regulators as the law requires.
Your rights
Under Canadian privacy law (PIPEDA and British Columbia's PIPA), and similar laws such as the GDPR where they apply, you can:
- Ask for access to the personal information we hold about you.
- Ask us to correct information that is inaccurate.
- Ask us to delete your information, subject to records we must keep by law.
- Withdraw consent, subject to legal or contractual limits, though some of the Service may then stop working.
- Complain to the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner for British Columbia, or your local regulator.
To make a request, email reach@debloq.io. We will respond within 30 days.
Your end users' information
If you embed the editor in your product, you are responsible for your own users' personal information and for telling them how you handle it. Because designs stay in your application, we generally do not receive your users' content. We only receive the technical request data described above.
Children
The Service is for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 18.
Changes to this policy
We may update this policy as the Service changes. If a change is material, we will tell you by email or in the dashboard before it takes effect. The date at the top shows when it was last updated.
Contact
OmniLabs Technologies, 319 W Hastings St, Vancouver, BC V6B 1H6, Canada. Our Privacy Officer can be reached at reach@debloq.io for any question or request about your personal information.