userdeck

Privacy Policy

This policy explains how Userdeck ("we") processes personal data under the EU General Data Protection Regulation (GDPR). Userdeck is operated from Austria; the controller is named in the imprint.

What Userdeck is

Userdeck is an operations dashboard used by software businesses ("tenants") to view their users, answer support requests, and send lifecycle email across their own products. For the data of a tenant's end customers, the tenant is the controller and Userdeck acts as a processor under a data processing agreement.

Data minimization by architecture

Userdeck does not persistently store end customers' names or email addresses. Profile data is fetched from the tenant's own systems at the moment it is displayed or an email is sent, and is not written to our database. We do persistently store:

  • Pseudonymous user identifiersassigned by the tenant's app (pseudonymized personal data under Art. 4(5) GDPR);
  • Product events (e.g. signup, login, cancellation) referencing those identifiers;
  • Support conversations— text customers submit through the tenant's app or by email reply, which may contain personal data the customer chose to include, and for anonymous requests the contact email address they provided;
  • Suppression lists — SHA-256 hashes of email addresses that unsubscribed or bounced (no plaintext);
  • Tenant account data — name, email, and login credentials of workspace owners (here we are the controller).

Legal bases

Tenant accounts: performance of contract (Art. 6(1)(b)). Support conversations and transactional email: performance of contract with the tenant / the customer's request. Suppression hashes: legal obligation and legitimate interest in honoring opt-outs (Art. 6(1)(c), (f)).

Recipients and transfers

Email is delivered through self-hosted infrastructure in the EU. We do not sell data and engage no advertising processors. Sub-processors, if any, are listed in the DPA.

Retention

Support conversations are retained while the tenant's workspace exists. Unmatched inbound email is kept for at most 90 days for troubleshooting. Suppression hashes are kept as long as required to honor the opt-out. Tenant accounts are deleted on request.

Your rights

You have the rights of access, rectification, erasure, restriction, portability, and objection (Art. 15–21 GDPR), and to lodge a complaint with a supervisory authority — in Austria, the Datenschutzbehörde. For requests concerning a tenant's product, contact that tenant; for requests concerning Userdeck itself, use the contact in the imprint.