Privacy Policy
Last updated: 24 September 2026
1. Who we are
1.1 This Privacy Policy explains how SystemTracker OÜ (registry code 17298601, Ahtri tn 12, 15551 Tallinn, Estonia, team@systemtracker.com) ("we", "us") processes personal data when you visit systemtracker.com (the "Website") or use the SystemTracker app at app.systemtracker.com (the "App").
1.2 We are the controller for personal data about Website visitors, people who contact us or book a demo, account holders and billing contacts.
1.3 For personal data that customers put into their Projects (for example names in responsibility lists, documents and chat), the customer is the controller and we act as processor on its behalf, under our Terms and Conditions, including the Data Processing Addendum in Annex 1. Questions about that data should go to the customer that runs the Project.
1.4 We process personal data in line with the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act.
2. Personal data we collect and why
| Who | Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|---|
| Website visitors | IP address, device and browser data, pages visited, clicks and scrolls, cookie choices | Run and secure the Website, understand how it is used, remember consent | Legitimate interest; consent for analytics cookies |
| People who contact us or book a demo | Name, company, role, email, message and anything else you send | Reply to you and arrange demos | Legitimate interest; steps before a contract |
| App users | Name, email, title, company, phone (if shared), profile picture, login codes, invitations, roles, activity in Projects | Create and secure accounts, sign-in by email code, show users to their teammates, provide the App | Performance of contract; legitimate interest |
| Billing contacts | Company name, contact person, billing email, VAT ID, address, invoices and payment status | Invoicing, accounting and tax | Performance of contract; legal obligation |
| App technical data | IP address, log files, device and browser data, error reports | Security, troubleshooting, preventing abuse | Legitimate interest |
| Support and feedback | Emails and messages you send us | Answer requests and improve the Service | Legitimate interest |
We only send transactional emails, such as login codes, Project invitations, activity notifications and invoices. We do not send marketing emails without your consent.
We do not sell personal data or use it for automated decisions with legal effects.
3. Cookies and analytics
3.1 The Website uses cookies and similar technologies. Strictly necessary cookies are always on. Analytics cookies are only set if you accept them in our cookie banner. Your choice is stored in your browser for 12 months.
3.2 With your consent, we use Microsoft Clarity to understand how visitors use the Website through usage metrics, heatmaps and session replays. Clarity collects data such as clicks, scrolling, pages visited and device information. It masks text you type into forms. Microsoft's own privacy statement applies to its processing.
3.3 You can change or withdraw consent at any time via Consent Preferences in the Website footer.
3.4 The App uses only cookies and local storage needed to keep you signed in, secure the service and remember your settings.
4. Who we share data with
4.1 Service providers that process data on our behalf under data processing agreements:
| Provider | Purpose | Location |
|---|---|---|
| PlanetScale (on Amazon Web Services) | App database and backups | EU |
| Amazon Web Services (AWS) | App back-end hosting and data storage | EU |
| Vercel | App front-end hosting | EU |
| Resend | Sending login codes, invitations and notifications | EU |
| Sentry | Error tracking and diagnostics for the App | EU |
| Webflow | Website hosting and contact/demo forms | USA |
| Microsoft (Clarity) | Website analytics, with consent | USA |
4.2 Other users. Other members of a Workspace or Project can see a user's name, title, any contact details they choose to share, and updates about their activity in that Project.
4.3 AI integrations. If you connect an AI assistant (such as Claude) to the App, the assistant's provider receives the data it accesses on your instructions. That provider's own privacy policy applies.
4.4 Authorities and advisers. We may share data with accountants, lawyers, auditors or public authorities where required by law or to protect our rights.
4.5 Business transfers. If we are involved in a merger or sale, personal data may pass to the buyer under the same protections.
5. Transfers, retention and security
5.1 All App data is hosted in the EU. Our Website providers (Webflow and Microsoft Clarity) are based in the USA, and some of our EU-hosted providers have US parent companies. Where data may be transferred outside the EU/EEA, we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.
5.2 We keep personal data only as long as needed:
| Data | Kept for |
|---|---|
| Account data | While the account is active, then deleted or anonymised within 90 days |
| Project data (as processor) | As instructed by the customer; deleted after the export window in our Terms |
| Invoices and accounting records | 7 years, as required by the Estonian Accounting Act |
| Contact and demo requests | Up to 2 years after our last contact |
| Website analytics | Per the provider's retention settings, up to 13 months |
| Security logs | Up to 12 months |
5.3 We use appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls and passwordless sign-in by one-time email codes.
6. Your rights and contact
6.1 You have the right to access your personal data, correct it, have it deleted, restrict or object to its processing, and receive it in a portable format. Where we rely on consent, you can withdraw it at any time.
6.2 To use your rights, email team@systemtracker.com. We reply within one month. For data in a customer's Project, we will pass your request to that customer.
6.3 You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee, info@aki.ee) or the data protection authority where you live or work, such as Datatilsynet in Norway.
6.4 We may update this policy. Material changes will be announced on the Website or by email. The date at the top shows the current version.
Contact: SystemTracker OÜ, Ahtri tn 12, 15551 Tallinn, Estonia · registry code 17298601 · team@systemtracker.com
