Privacy Policy

1. Introduction

ApprovalRail ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

Roles. For customers using ApprovalRail to run approval workflows, we act as the data controller for account, billing, and operational data you provide to us directly, and as a data processor for the workflow content your organization (and its members) submits through the service. For employees submitting requests, the customer organization that invited you generally determines the purposes and means of that processing.

2. Information We Collect

2.1 Personal Information

We may collect personal information that you voluntarily provide, including:

• Name and email address
• Company or organization name
• Profile information
• Payment information (if applicable)

2.2 Usage Data

We automatically collect certain information about your use of our service:

• IP address and browser type
• Pages visited and features used
• Time and date of visits
• Device information

2.3 Essential Cookies

We use essential cookies for authentication and secure sessions. We do not use analytics, marketing, or tracking cookies. See our Cookie Policy for details.

2.4 Website Analytics

We use Cloudflare Web Analytics to measure website visits and page performance. Its JavaScript beacon sends usage and performance measurements from your browser to Cloudflare. According to Cloudflare, this service does not use cookies or local storage to collect usage metrics and does not fingerprint visitors for analytics.

Read Cloudflare's Web Analytics privacy information for more details.

2.5 Workflow Content

When approval workflows are used, we process the content that members of a customer organization submit through the service, including request fields, free-text reasons, comments, and uploaded files. These may include sensitive information (for example, sick-leave reasons or medical context in PTO requests). The customer organization that invited you is responsible for deciding what to collect and for giving notice to its employees about that collection; please ask your employer with any questions about workflow content.

2.6 Uploaded Files

Files you attach to approval requests are stored in private storage and are only accessible through access-controlled, short-lived links issued to authorized members of the relevant organization. Uploaded files are deleted when the owning request data is deleted.

3. How We Use Your Information

We use the information we collect to:

• Provide and maintain our service
• Process and manage approval workflows
• Communicate with you about your account and our service
• Improve and personalize user experience
• Detect and prevent fraud or abuse
• Comply with legal obligations

Legal Basis for Processing: Because the basis depends on the purpose, we do not rely on one basis for all processing:

• Providing the service and running approval workflows: necessity for performing the contract with the customer organization (Art. 6(1)(b)).
• Account administration, billing, and tax records: necessity for performing the contract and for complying with legal obligations (Art. 6(1)(b), Art. 6(1)(c)).
• Security, fraud prevention, and audit logging: our legitimate interests in operating a secure service (Art. 6(1)(f)).
• Website analytics: our legitimate interests in understanding aggregate usage of the public website (Art. 6(1)(f)).
• Optional notifications and optional integrations: your consent, which you can withdraw at any time in your settings (Art. 6(1)(a)).

Where processing is performed on behalf of a customer organization, that organization remains responsible for establishing a lawful basis for the workflow content it collects.

4. Google User Data

If you choose to connect your Google account or use Google services with ApprovalRail, we may access certain Google user data in accordance with your permissions. This may include:

• Basic profile information (name, email)
• Google Workspace data (if applicable and authorized)

Our use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell Google user data. We only use this data to provide and improve our services, and we do not transfer it to third parties except as necessary to provide our service or as required by law.

5. Data Sharing and Disclosure

We may share your information with:

• Service Providers: Third-party vendors who help us operate our service. These include, in particular: our hosting and authentication provider (Supabase), our payment processor (Stripe), our email-delivery providers, and Cloudflare Web Analytics for aggregated website metrics.
• Customer organizations and their webhook endpoints: approval workflow content (including request fields, comments, and attachment references) is shared with the members of the relevant customer organization, and — where the customer organization has configured webhooks — with the destination endpoints that organization itself chooses. Those endpoints are under the organization's control.
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. This includes:

• AES-256-GCM encryption for sensitive data
• Secure authentication with session management
• Role-based access controls
• Regular security reviews and updates

Under Article 33 of the GDPR, we will notify the competent supervisory authority of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, without undue delay and, where feasible, not later than 72 hours after becoming aware of it (unless the breach is unlikely to result in such a risk).

Under Article 34 of the GDPR, where a personal data breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay. Where required, we will also notify the customer organization whose workflow data is affected.

7. Data Retention

We retain your personal information as follows:

• User Account & Profile: Retained until you delete your account, plus a 30-day grace period during which deletion can be cancelled. When the deletion job runs, your authentication account is deleted and your name, avatar, and email address are removed; the remaining profile record exists only so historical audit records and job executions remain traceable to a "deleted user" instead of a dangling reference.
• Approval Requests, Comments, and Uploaded Files: Requests you created and comments you wrote are permanently deleted when your account deletion executes. Uploaded files belonging to those requests are deleted from storage at the same time.
• Approval Records: Approval decisions recorded in other members' requests may be retained where the customer organization has a legitimate retention interest, but your identity in them is removed when your account is deleted.
• Audit Logs: While your account is active, retention follows your organization's subscription plan. After your account deletion executes, audit records associated with your account are physically erased after 2 years.
• Error Logs: Automatically erased after 1 year.
• Invoices & Billing Records: Retained for 10 years from the date of issuance to comply with tax and accounting legal requirements.

You may request deletion of your account and personal data at any time through your account settings or by contacting us.

8. Your Rights

Depending on your location, you may have the following rights:

• Access: You can view your personal information through your account settings. For a complete copy of all data we hold about you, contact us at [email protected]. We will respond within 30 days.
• Correct: You can update your profile information directly in your account settings.
• Delete: You can delete your account through your account settings. This initiates a 30-day grace period before permanent deletion.
• Data Portability: You may request a copy of your data in a structured, commonly used format by contacting us at [email protected].
• Object or Restrict: Contact us if you wish to object to or restrict certain processing activities.
• Withdraw Consent: Where we rely on your consent, you may withdraw it at any time.
• Lodge a Complaint: You have the right to lodge a complaint with a data protection supervisory authority — in particular in the EU member state where you habitually reside, where you work, or where an alleged infringement took place.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days.

9. Data Subject Requests

If you are located in the European Economic Area (EEA), Switzerland, or the UK, you have certain data protection rights. We are committed to facilitating these rights.

How to Make a Request

To submit a data subject request, please email us at [email protected] with the subject line "Privacy Request" and include:

• Your name and email address associated with your account
• The specific right you wish to exercise (access, deletion, portability, etc.)
• Any additional details that help us process your request

Response Time

We will acknowledge your request within 5 business days and provide a substantive response within 30 days of receipt. If your request is complex or requires additional time, we will inform you of any extension.

Verification

To protect your privacy, we may request information to verify your identity before fulfilling your request. We will only use this information for verification purposes.

10. Children's Privacy

Our service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we learn we have collected such information, we will delete it promptly.

11. International Data Transfers

We prioritize using service providers that store and process data within the European Union. However, some of our third-party services may process data in countries outside the EU/EEA, including the United States.

Our approach: We actively seek EU-based alternatives and migrate services when feasible. For services that operate outside the EU, we ensure appropriate safeguards are in place, including:

• Data Processing Agreements (DPAs) with all our service providers
• Standard Contractual Clauses (SCCs) where required
• Services certified under the EU-US Data Privacy Framework (where applicable)

For questions about our data providers or where your data is stored, contact us at [email protected].

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

13. Contact Us

If you have any questions about this Privacy Policy, please contact us at: [email protected]