This document explains what data Reattend collects, why we collect it, how long we keep it, and the rights you have over it. We've tried to write it in plain English. Where the law requires specific phrasing, we use it, and link to the full text.
This policy applies to the Reattend website, the Reattend product (the desktop app, the web dashboard, and APIs), and any corporate communications you receive from us. Reattend does not connect to third‑party services today; if that changes, this policy will say so before any such connection is offered.
For most data we handle, our customer (your employer, in most cases) is the controller and Reattend is the processor. For website analytics, marketing, and our own corporate operations, Reattend is the controller.
The desktop app captures work on your computer: text on screen in work apps, documents in folders you choose, meetings, dictation and scans. This raw layer stays on your computer in an encrypted store and is never sent to us. What reaches us is derived work knowledge you share with your organization (a memory's title and summary, facts, tasks, names, meeting notes) and what administrators add on the dashboard, such as policies, announcements and decisions. This is the most sensitive class of data we handle. It is stored encrypted, never used to train any model, and never accessed by our staff except when you or your administrator ask us to for support, or where the law requires it.
| Purpose | What we use | How long |
|---|---|---|
| Operate the product | Account, shared memory content, server logs | Term of contract |
| Show people who opened their memories | Access records | Term of contract |
| Detect abuse & fraud | IP, device, behavioural signals | 12 months |
| Customer support | Account + the specific record you reference | Lifetime of ticket + 6 months |
| Billing & tax | Company, billing contact, invoices | 7 years (tax law) |
| Marketing emails | Email, company, role | Until you unsubscribe |
We do not use customer memory content to train any model, ours or anyone else's. We do not sell personal data. We do not run programmatic advertising on the Reattend product or this website.
Where we rely on legitimate interest, we have completed a balancing test. You can request a copy from anjan@reattend.com.
Shared memory content is retained for the term of your employer's contract, plus the wind‑down period (default 30 days, configurable up to 180). On termination, or on a verified deletion request, we erase it from the service within 72 hours. Raw activity captured by the desktop app never reaches us; it stays on the computer, under the person's control.
Backups are retained for 35 days on a rolling window. If a deletion request lands during that window, the deleted records are excluded from any future restore.
The full security architecture is on the compliance page. The headlines: raw activity kept on each computer in an encrypted store, shared knowledge stored encrypted, AES‑256‑GCM encryption for stored SSO secrets, HTTPS in transit, single sign‑on with OpenID Connect on the Business plan (SAML on request), record‑level access control with eight visibility rules, and a hash‑chained tamper‑evident audit log. We hold no certifications today; SOC 2 and ISO 27001 audits are planned. The compliance page lists every control with its real status, including the ones still on the roadmap.
Depending on where you live, you may have the right to access, correct, port, delete, or object to the processing of your personal data. You can also withdraw consent at any time without affecting prior processing.
To exercise a right, write to anjan@reattend.com from the email address on file. We respond within 30 days (72 hours for a verified erasure request).
If your data leaves your home region, it does so under the EU Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement, or, for India, the conditions allowed by the DPDP Act. Reattend's hosted service runs in a single United States region, where shared data and logs are stored. Raw activity captured by the desktop app stays on each computer and is not transferred.
Government and regulated organizations can instead run their own server, including air‑gapped installs, where data never leaves a boundary you choose and Reattend holds nothing. Contact us before you rely on one.
Reattend is a workplace product and is not directed to anyone under 18. We do not knowingly collect personal data from minors. If you believe we have, write to anjan@reattend.com and we will delete it.
We update this policy when the law changes, when we add a subprocessor, or when we ship a feature with new data‑handling implications. Material changes get 30 days' notice via email and an in‑product banner. The effective date at the top of this page always reflects the current version.
You can reach our Data Protection Officer at anjan@reattend.com.
For privacy questions of any kind: anjan@reattend.com. For postal mail, write to our registered office:
Reattend Technologies Private Limited
Work Studio, 707 & 708, 7th Floor, Roodraksh Mall
Bhangagarh, Guwahati 781005
Assam, India
If we don't resolve your concern, you may complain to your local supervisory authority. In India, that's the Data Protection Board; in the EU, your national DPA; in the UK, the ICO.
