Privacy policy

This page covers three things: this website, Pangolin sign-in (the account you sign in with at auth.pangolin.technology) and Dorsal, the web app for pwp workspaces at keel.pangolin.technology. It says what we hold, why, who else processes it, how long we keep it and what you can do about it. A product with its own privacy policy, such as Fairshare, is covered by that policy instead.

Who we are

Pangolin Technology is the trading name of Johannes van der Merwe, a sole trader in the United Kingdom. He is the controller of your personal data under UK data protection law: the UK GDPR and the Data Protection Act 2018. "We" on this page means him.

Contact: hello@pangolin.technology. A person reads every message. We are not required to appoint a data protection officer and have not done so.

This website

This site sets no cookies, runs no analytics and loads no third-party trackers. If you switch between day and night, your choice is kept in your own browser's local storage and never sent to us. Our host, Vercel, logs each request, including your IP address and browser, to keep the site running and to investigate faults. Legal basis: our legitimate interest in running a reliable website.

If you email us, we keep the email and our reply to answer you and to deal with anything that follows from it.

Pangolin sign-in

One sign-in is used across Pangolin's products. You sign in with GitHub or Google. We do not hold passwords.

What we hold

• Your account: an id we issue, your name, email address, whether the provider says that address is verified, and a link to your profile picture.
• For each provider you sign in with: its name, your account id there, your username (GitHub) or email address, and the profile details the provider returns.
• Your browser sessions: when each started, when it was last used, when it expires and your browser's user agent string, so you can recognise your sessions and we can spot misuse.
• Sign-in tokens: one-hour access tokens, and refresh tokens that last 30 days and change each time they are used. We store only a hash of each refresh token, never the token itself.
• Short-lived codes used while you sign in, including the code you type to sign in a command-line tool. They expire within 15 minutes.

Why: to know who you are when you use a Pangolin product and to keep your account secure. Legal basis: performing our contract with you.

Google user data

When you sign in with Google, we ask only for the openid, email and profile scopes. Google tells us your Google account id, name, email address, whether it is verified and a link to your profile picture. We use these only to sign you in and show who you are inside Pangolin's products. We do not ask for access to your Gmail, Drive, contacts or anything else in your Google account. We do not sell Google user data, use it for advertising, share it with anyone except as this page describes, or use it to train AI models. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

GitHub sign-in works the same way: GitHub tells us your account id, username, name, email address and profile picture link, and we use them in the same limited way. Google and GitHub are independent controllers of what they hold about you; their own privacy policies apply to that.

Dorsal

Dorsal shows a pwp workspace in the browser: its board, documents, reviews, runs and people. You can only see a workspace you belong to or were invited to.

What we hold

• Your organisations and workspaces, your role in each, and when you joined.
• Invitations: the email address invited, the role, who sent it and whether it was accepted. When you sign in with an invited address, the invitation is accepted for you.
• What a workspace pushes to us: cards, comments, questions, documents, reviews and their findings, runs, drafts of messages, and an event log of changes. Each entry records who made it and when.
• The machines you register: a name you choose, the public half of their signing key and whether they are approved. We never hold the private key.
• An audit log of security-relevant actions, such as approving a machine or changing a role, with who did it and when.
• Your sessions and pages you have visited inside a workspace, so Dorsal can show what is new since you last looked.
• If you sign in to Dorsal with a link sent to your email instead of through Pangolin sign-in: your email address and a one-time token that expires once used or after a short time.
• Files you sync through Dorsal are encrypted in your browser before they are uploaded. We store the encrypted copy and cannot read it. The key stays with you.

Why: to run Dorsal for you and your team. Legal basis: performing our contract with you. Workspace content can hold personal data about other people, for example names in a card or a document. The person or organisation that owns the workspace decides what goes into it; we hold and show it on their behalf, and only to members of that workspace.

What we do not do

We do not sell personal data, show advertising, share data with advertisers or build profiles of you for anyone else. We do not make decisions about you by automated means that have legal or similarly significant effects.

Who else processes it

These companies process personal data for us, under contract, only to provide their service to us:

• Vercel: hosting for this site, Pangolin sign-in and Dorsal, request logs, and storage for encrypted file sync.
• Neon: the Postgres databases that Pangolin sign-in and Dorsal store the data above in.
• Resend: sending the sign-in links Dorsal emails you.

Some of them process data outside the UK, including in the United States. Where they do, the transfer relies on UK adequacy regulations (including the UK extension to the EU-US Data Privacy Framework, for companies certified under it) or on the International Data Transfer Addendum to the standard contractual clauses in their data processing terms. Ask us for details. This list can change; the current list is always this page.

Within Pangolin, the members of a workspace see what that workspace holds. The person who runs Pangolin can see all of it, to fix problems and answer support requests. We will disclose personal data if the law requires us to.

How long we keep it

• Browser sessions for Pangolin sign-in: 14 days. Refresh tokens: 30 days. Sign-in codes: 15 minutes or less.
• Request logs: as long as Vercel keeps them, which is days to weeks depending on the log.
• Emails you send us: as long as we need them to deal with what you asked, then deleted.
• Your account and Dorsal data: until you ask us to delete your account, or the workspace it belongs to is deleted. Database backups roll over and are gone within 30 days of a deletion.

Your rights

Under UK data protection law you have the right to:

• get a copy of the personal data we hold about you;
• have it corrected if it is wrong;
• have it deleted;
• restrict how we use it, or object to our using it on the basis of legitimate interests;
• receive the data you gave us in a machine-readable format, or have it sent to someone else.

Email hello@pangolin.technology to use any of them. There is no self-serve account deletion yet, so a person does it by hand. We answer within one month, and tell you if we need longer, as the law allows. We may ask you to confirm who you are first. Using these rights is free.

We do not rely on your consent for anything on this page, so there is no consent to withdraw. You need to give us your name and email address, through GitHub or Google, to have an account; without them we cannot sign you in.

If you are unhappy with how we have handled your data, tell us first so we can put it right. You can also complain to the Information Commissioner's Office, the UK regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Cookies

This website sets none. Pangolin sign-in sets one cookie on auth.pangolin.technology to keep you signed in, and Dorsal sets its own sign-in cookies on keel.pangolin.technology. Both are strictly necessary for the service you asked for, so they do not need your consent, and neither is used to track you.

Security

Everything is sent over HTTPS. We store hashes rather than raw tokens, sign access tokens with keys we rotate, and keep secrets out of our code. If a breach puts your data at risk, we will tell you and, where the law requires, the ICO.

Children

Pangolin's products are for adults at work and are not directed at children. You must be at least 16 to have an account.

Changes

When this page changes, the date at the top changes with it. If a change affects how we use data you have already given us, we will tell you by email before it takes effect.