Privacy Policy

1.Who we are

Phlare is provided by Phlare. When this policy says “we” or “us”, it means that company.

2.The two roles

Where we are responsible (controller)

We are the controller — the “responsible party” under South Africa’s Protection of Personal Information Act, 2013 (POPIA) — for personal information about people who create a Phlare account or are invited into a workspace (“account holders”), people who visit this website or contact us, and people at businesses we deal with.

Where we act for a business (processor)

A business that uses Phlare keeps information about its own contacts in it, sends them messages through it, and receives their replies, orders and website activity into it. For that information the business is the controller and we are its processor (the “operator” under POPIA). We use it only to provide the service to that business, as the Data Processing Agreement requires, and the business’s own privacy notice explains what it does with it.

3.What we collect about account holders and visitors

• Account details: first names and surname, email address, the password you choose (stored only as a one-way hash, never in a readable form), optionally a phone number and picture, the workspaces you belong to and your role in each, and when you accepted these documents.
• Workspace details: the business name, currency, time zone, brand and sending settings, the Plan and how much of it is used.
• Security records: the email address and network (IP) address used for each sign-in, sign-up, password reset and confirmation-email request, and whether it succeeded; when you were last active; and a record of actions taken by the people who administer Phlare itself.
• What you tell us: messages you send us, requests for a different Plan and anything you ask us to help with.
• The website: we use no advertising or third-party analytics on this website. Your browser keeps your sign-in tokens and a few preferences in its own storage so that the application works; nothing in it is used to track you.

4.Checking new passwords against known breaches

When you choose a new password, we check it is not one already published in a data breach, using the Pwned Passwords service. Only the first five characters of a one-way hash of the password leave our server; the service answers with every breached hash beginning with those characters and we compare them here. Neither the password, nor its full hash, nor your email address is ever sent.

5.Why we use it, and on what basis

• To provide the service you signed up for — creating and running your account and workspaces, confirming your email address, sending invitations and password resets: because it is necessary for our contract with you or your business.
• To keep accounts and the service secure — limiting repeated sign-in attempts, locking an address after too many wrong passwords, preventing the abuse of free Plans and of our shared sending reputation: in our legitimate interest, and yours, in a service that cannot be broken into or misused.
• To support you and tell you about the service — answering requests, and telling you about changes to the service, these documents or your Plan: for our contract, and in our legitimate interest.
• To meet legal obligations — keeping records the law requires, and responding to lawful requests from authorities.

We do not sell personal information, and we do not use it for advertising. We send you marketing about Phlare only where the law allows, and you can opt out at any time.

6.Who we share it with

• Our sub-processors, who host the service and deliver its email, listed on the sub-processors page, each bound by a contract to protect it.
• The workspaces you belong to: your name, email address and activity are visible to the other members of each workspace, as the service requires.
• Professional advisers, such as lawyers and auditors, under a duty of confidentiality.
• Authorities, where the law requires it, or where it is necessary to protect someone’s safety or to establish or defend a legal claim.
• A buyer of the business, if the service is sold or transferred, who would be bound by this policy.

7.Where it is kept, and transfers abroad

Phlare is hosted on servers in Germany, in the European Union. Personal information from South Africa, Botswana, Namibia, Zambia, Zimbabwe, the United Kingdom and elsewhere is therefore transferred to Germany, where the EU General Data Protection Regulation gives it protection at least equivalent to the laws of those countries; the United Kingdom recognises the EU as giving adequate protection.

Where a sub-processor is outside the EU or the United Kingdom — our email delivery provider is in the United States — the transfer is made under the EU Standard Contractual Clauses and the United Kingdom’s Addendum to them, or another safeguard the law recognises, which also meets the conditions in section 72 of POPIA and the equivalent rules elsewhere.

8.How long we keep it

• Account details: for as long as you have an account, and afterwards only as long as needed to deal with any question about it or as the law requires.
• Security records of sign-in and similar attempts: one day.
• Links for confirming an address, resetting a password or joining a workspace: until used or until they expire (7 days, 60 minutes and 7 days respectively).
• Customer Data of a workspace that is closed: as the Terms of Service set out — available for export for 30 days, then deleted from the live service, and from backups within 90 days.

9.How we protect it

The measures we take — encryption in transit, passwords stored only as hashes, secrets for connected services encrypted, workspaces kept apart, limits on sign-in attempts, and more — are listed in Annex 2 of the Data Processing Agreement. If a breach affects your personal information and puts you at risk, we will tell you and the regulator as the law requires.

10.If you are a contact of a business that uses Phlare

If a business has emailed, texted or messaged you through Phlare, that business holds your information and decides how it is used. To ask what it holds, to correct it, to have it erased, or to object, contact the business — it can export or erase your information in Phlare when you ask. Every marketing email sent through Phlare carries a link to unsubscribe, which takes effect straight away.

If you cannot reach the business, write to us using the contact details on this page and we will pass your request on and help the business answer it.

11.Your rights

Depending on the law that applies to you, you may ask us for access to the personal information we hold about you, have it corrected or erased, object to or restrict how we use it, receive a copy of it in a portable form, and withdraw any consent you have given. We will answer within the time the law sets — one month under the UK GDPR, a reasonable time under POPIA — and will not charge unless the law allows it. We may need to check it is you before we act.

To use these rights, write to us using the contact details on this page. You can also complain to a regulator. We would like the chance to put things right first, but you do not need to come to us before you do:

• South Africa: the Information Regulator
• Botswana: the Information and Data Protection Commission
• Zambia: the Office of the Data Protection Commissioner
• Zimbabwe: the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), as the data protection authority
• United Kingdom: the Information Commissioner’s Office
• European Union: the data protection authority where you live or work

Wherever you are, we apply the standard described in this policy, and where two laws differ, the stricter.

12.Automated decisions and children

We make no decision about anyone by automated means that has a legal or similarly significant effect on them. Segments, flows and similar automation in a workspace are set up by the business that uses them, for its own purposes.

Phlare is for businesses and is not meant for anyone under 18. We do not knowingly collect personal information about children as account holders.

13.Changes to this policy

We will update this policy when what we do changes, and change the date at the top. If a change matters to account holders, we will say so in the service and by email before it takes effect.