How long we keep your data
While you work with us we keep what the work needs: your issues as Linear shows them to us, our copies of your code, and your portal accounts.
If Linear is disconnected we keep all of it for at least 14 days, or until the end of the month you paid for if that is later, so you can reconnect and carry on where you stopped.
When the account closes we revoke our access to your Linear and delete the working copies of your code on our servers that day. They leave our backups within a further 7 days.
90 days later we delete the portal records that came from your Linear, and disable your portal accounts. Our other copies of what came from your workspace are deleted as Annex A to our terms, clause A12, says.
Invoices and payment records are kept for 7 years, because Dutch tax law requires it. Section 7 below says what else we keep about the people who use the portal, and for how long.
Your data, back or gone
An account admin can download your record from Settings at any time: your work, deliveries and invoices, as CSV and JSON. After the account closes it stays there for 90 days.
An account admin can also delete everything now, from Settings. The account closes at once, and what we would delete after 90 days goes that day. Section 7 below, and Annex A to our terms, say what we still keep and for how long.
Privacy statement
This statement says what personal data we collect about the people who use our portal and about our clients' contacts, why we do it, and what rights you have. The sections above summarise how long we keep a client's data. Section 7 below gives the detail for the data in this statement.
1. Who we are
1.1 Ponte Digital, registered with the Dutch Chamber of Commerce (KvK) under number 42036253, Reitseplein 384, 5037 AA Tilburg, the Netherlands. We are the controller for the processing this statement describes.
1.2 Questions about your data, requests to use your rights and objections (sections 9 and 10), and reports of a security problem go to privacy@pontedigital.co. For anything else, write to hello@pontedigital.co. We have no data protection officer, because the law doesn't require one for us.
2. What this statement covers
2.1 It covers:
(a) people with a portal account;
(b) people invited to one;
(c) the admins of a client's Linear workspace, to whom we give an account when their company installs Ponte;
(d) clients' billing contacts;
(e) people who email us;
(f) visitors to our public pages;
(g) people who accept our terms for their company;
(h) people who delegate an issue to us before their company has accepted our terms;
(i) people who install our GitHub App for their company;
(j) people who ask for a sign-in link without having a portal account.
2.2 It doesn't cover the personal data we process inside a client's Linear workspace, repositories and previews to do their work. For that data the client is the controller, and we are its processor under Annex A to our terms. Questions about it go to that client. If you send them to us, we pass them on.
3. What we collect, why, and on what basis
Your portal account
3.1 We process your name, work email address, role and workspace; when your account was created and last used; how it was created (from your company's Linear workspace, by invitation, or by us); and your email preferences.
3.2 We do this to give you access to the portal for the service your company uses, and to run that access. The basis is our legitimate interest, and your company's, in giving its people access to the service it bought (article 6(1)(f) GDPR). If you are our client yourself, as a sole trader, the basis is our contract with you (article 6(1)(b) GDPR).
Accounts we create from Linear
3.3 When a company installs Ponte, we give the admins of its Linear workspace a portal account, once. We get your name and email address from that workspace. The basis is our legitimate interest in giving the people who manage the workspace access to what their company installed (article 6(1)(f) GDPR). When we create your account after your company first installs Ponte, our welcome email tells you this. You can object as section 10 says: we then remove your access and don't create it again. If you are your company's only account admin, we do that once your company has another.
Invitations
3.4 When a colleague invites you, we process your email address, the name they give, who invited you and when, and what happened to the invitation. The basis is our legitimate interest in letting clients add their own people (article 6(1)(f) GDPR). If you don't accept an invitation, we delete it 90 days after it expires.
Signing in and security
3.5 We process the email address you sign in with, the time, and your IP address when you ask for a sign-in link or use one, also when the address has no account with us. We keep a record of each sign-in link, and a log of account actions in the portal: who did what, and when. We do this to keep accounts secure, prevent misuse and investigate incidents. The basis is our legitimate interest in exactly that (article 6(1)(f) GDPR).
Emails from us
3.6 We process your email address and name, the content of our emails, and the delivery status our email provider reports: delivered, delayed, bounced, or marked as spam. Our emails tell you about your company's work, your account and billing. Work updates can include issue titles and the questions we ask you. The basis is our legitimate interest in keeping you informed about the service your company uses (article 6(1)(f) GDPR). You can switch the work digest off in Settings. We don't track whether you open our emails or click their links. Our email provider keeps our emails and their delivery status in the United States, for 30 days.
Billing and payments
3.7 We process:
(a) your company's name, address and country;
(b) its VAT number and the result of the VIES check on it;
(c) the invoice email address;
(d) who started each payment;
(e) payment and refund records;
(f) the kind of payment method and, for a card, its expiry date and last four digits;
(g) which version of our terms was accepted, for which business, by whom and when (section 3.15).
3.8 We do this to take payment, invoice, apply VAT correctly, keep our books and collect what is due. The bases are:
(a) our contract with you, if you are our client yourself (article 6(1)(b) GDPR);
(b) otherwise, our legitimate interest in running the contract with your company (article 6(1)(f) GDPR);
(c) our legal duties under Dutch tax and bookkeeping law (article 6(1)(c) GDPR).
3.9 You enter card and bank details in the checkout of Mollie, our payment provider. We never see full card numbers. Mollie is a separate controller for the payment, and its own privacy statement applies to it.
Correspondence
3.10 When you email us, we process your address, your name, your message and our replies, to answer you and keep a record. The basis is our legitimate interest in doing so (article 6(1)(f) GDPR). Where a message about your company's work holds personal data from its issues or code, we process that data for your company, under Annex A to our terms.
Leaving
3.11 When your company's account closes, we record when and why, including any reason or comment you give us. We do this to close the account properly and to learn why clients leave. The basis is our legitimate interest in both (article 6(1)(f) GDPR).
Our public pages
3.12 When you visit our pages, your IP address, browser details and the pages you request are processed to deliver them and keep them secure: by our hosting provider for the portal, and by our agent server for the page you see when you install our Linear app. We use no analytics and no tracking. The basis is our legitimate interest in running a secure website (article 6(1)(f) GDPR).
Legal claims
3.13 We may use the data above where we need it to establish, exercise or defend a legal claim. The basis is our legitimate interest in doing so (article 6(1)(f) GDPR).
Before your company accepts our terms
3.14 When a company installs our Linear app, we record its workspace's name and address in Linear, and the names and email addresses of its admins, so they can sign in and accept our terms. If someone installs our GitHub App, we record which account installed it and which repositories it can reach. If someone delegates an issue before an account admin has accepted, Linear sends us the issue, but we record only its identifiers and when it was delegated, so that we can answer once and start it after acceptance. We don't keep or use what the issue says. Linear also sends us a notification of every change in the workspace that our app can see, such as new and changed issues and comments. Before acceptance we discard them without reading them, all but two kinds: the notice that an issue was delegated to us, and notices about an issue we are holding, such as that it was closed. We use those only to hold, answer or let go of that issue. For a discarded notification, our service logs keep only its kind and the workspace's identifier. The basis is our legitimate interest in answering a request for our service and starting it once we may (article 6(1)(f) GDPR).
Accepting our terms
3.15 When an account admin accepts our terms, we record their name where we have it, their email address and role, the company they accepted for and the details they gave for it, the version accepted, the time, their IP address and browser, and the confirmation email we sent. We do this to prove the agreement. The basis is our legitimate interest in that (article 6(1)(f) GDPR), or our contract with you if you are our client yourself (article 6(1)(b) GDPR).
Connecting GitHub
3.16 If linking our GitHub App to your company's workspace fails, we record who tried (their email address), when, why, and which installation it named, so that we can finish the link by hand. We note it in the security log (section 3.5) and email ourselves about it. The basis is our legitimate interest in completing the installation your company asked for (article 6(1)(f) GDPR).
Our AI assistant
3.17 Our staff use Claude, Anthropic's AI assistant, for our own administration and correspondence. They use it on an individual Claude plan with model training switched off. It isn't connected to our mailbox or our Google Drive. Claude processes the personal data in what we give it or let it read, such as your name, your email address and what you wrote to us. For this use Anthropic is a controller in its own right (section 5.2), not our processor. Its terms and privacy policy say how long it keeps the data. The basis is our legitimate interest in running our own administration and correspondence efficiently (article 6(1)(f) GDPR). We never put the personal data we process for clients (section 2.2) into it. Our agent sends that data to Anthropic under our commercial agreement with Anthropic (Annex A to our terms).
4. Where the data comes from
4.1 Most of it comes from you. If you are an admin of a client's Linear workspace, we got your name and email address from that workspace when your company installed Ponte. If a colleague invited you, we got your email address and name from them. Your company gives us its billing details. Some comes from others: GitHub tells us which account installed our GitHub App and which repositories it can reach; Mollie tells us the status of each payment and the kind of payment method, and for a card its expiry date and last four digits; VIES tells us whether a VAT number is valid; and our email provider tells us whether our emails were delivered.
5. Who receives your data
5.1 These providers process data for us, on our instructions and under a data processing agreement:
(a) Vercel Inc. (United States), which hosts the portal and its encrypted storage;
(b) Plus Five Five, Inc., trading as Resend (United States), which sends our emails;
(c) Hetzner Online GmbH (Germany; servers in Finland and Germany), which hosts our agent servers;
(d) MoneyBird B.V. (the Netherlands), which keeps our books and sends our invoices;
(e) Google Cloud EMEA Limited (Ireland), with Google LLC (United States), which hosts our email.
5.2 These parties receive data as controllers in their own right:
(a) Mollie B.V. (the Netherlands), for payments;
(b) the European Commission's VIES service and national tax authorities, for VAT number checks;
(c) the Dutch Tax and Customs Administration (Belastingdienst);
(d) professional advisers such as an accountant or lawyer, where we need them and bound to confidentiality;
(e) courts, regulators or the police, where the law requires it;
(f) Anthropic Ireland, Limited (Ireland), which provides the AI assistant in section 3.17.
5.3 Other portal users in your company's workspace see your name, email address and role. If you accepted our terms for your company, its account admins can download our record of that acceptance, which includes your IP address and browser. Our staff can see your account to support you, and each time they open a client's portal it is logged.
5.4 We don't sell personal data.
6. Transfers outside the European Economic Area
6.1 Vercel and Resend are in the United States. We transfer data to them under the European Commission's standard contractual clauses and the EU-US Data Privacy Framework, under which both are certified. Google Cloud EMEA Limited is in Ireland; where Google processes our email elsewhere, that transfer is Google's, under its own standard contractual clauses. Ask us and we send you a copy of the safeguards. Anthropic Ireland, Limited is in Ireland too. Where Anthropic processes what our staff give Claude (section 3.17) in the United States, that transfer is Anthropic's, under the standard contractual clauses its privacy policy names.
7. How long we keep it
7.1 The summary at the top of this page covers your company's data. For personal data we process inside your company's workspace and code, Annex A to our terms, clause A12, applies. This section covers the personal data in this statement.
7.2 Sign-in links: valid for 15 minutes, and usable once. The record of a used link is deleted a day after it expires.
7.3 Your sign-in session: 14 days.
7.4 Your portal account: for as long as it exists. If an account admin removes you, we delete your account. An account we created from Linear is disabled instead, so that it isn't created again. When your company's account closes, all its portal accounts are disabled 90 days later, or at once if an account admin chose Delete everything now.
7.5 Disabled accounts: we keep the name, email address, role, and the dates the account was created and last used, for 12 months after the account was disabled. Then we delete them.
7.6 Invitations: an invitation is valid for 7 days. We delete its record 90 days after it was accepted, withdrawn or expired. If an invitation is refused because the address already belongs to another client's portal, we keep a note of that address for up to 30 days, to sort it out.
7.7 Names and email addresses of your workspace's Linear admins: until 90 days after your company's account closes. After that we keep only the details of disabled accounts in 7.5, for the period stated there.
7.8 The security log: it holds the most recent 500 account actions across all our clients. Older entries are deleted as new ones come in. Counters that limit how many invitations are sent, which hold the inviter's email address, are deleted about a week after the day they count.
7.9 Delivery status of our emails: for as long as your account exists. If an address bounced, or marked our mail as spam, it stays on our do-not-send list for as long as we send email, so that we don't write to it again.
7.10 Records of accepted terms: while the agreement runs, and seven years after the end of the year in which it ends. Billing records, invoices and payment records: seven years after the end of the year they relate to, because Dutch tax law requires it (article 52 of the General Tax Act, AWR).
7.11 Records of leaving (section 3.11), and records of failed attempts to connect your GitHub organisation (section 3.16): until 90 days after your company's account closes. The security log entry for such an attempt goes as section 7.8 says.
7.12 Correspondence: while your company is our client and for two years after, unless it is part of our books (seven years) or we need it for a claim.
7.13 Request logs: our hosting provider keeps the portal's for at most 30 days, and we don't keep copies. Our agent server keeps its logs for 30 days, and its backups keep them 7 days longer (7.16). Our email provider keeps our emails and their delivery status for 30 days.
7.14 Where we need data to deal with a legal claim, we keep it until the claim is settled.
7.15 Records of issues delegated before our terms were accepted (section 3.14): until the issue starts, and at most 30 days. Time your company's lanes are paused, or we can't reach its workspace, doesn't count towards the 30 days. When your company's account closes, we delete them.
7.16 Backups: our agent server is backed up daily. Hetzner keeps the last seven daily backups, in the European Union, and deletes the oldest when it makes a new one. We keep no other backups or copies of the server, and use the backups only to restore our systems. So what we delete from the agent server leaves its backups within a further 7 days.
8. Security
8.1 We protect personal data with appropriate technical and organisational measures. Connections are encrypted (TLS). Portal records are encrypted with AES-256-GCM before they are stored, in private storage. Sign-in links work once and expire after 15 minutes. Sessions use a signed cookie that scripts can't read. Portal users have roles, and account actions are logged. On our agent server, what we hold about you is in files that only our server account and our administrators can read. The commands our agent runs on Ponte clients' issues run in an operating-system sandbox. It hides those files from them, and every credential of ours except a token for the one repository they work on. Other work on that server doesn't run in that sandbox. No system is completely secure. If a breach is likely to put your rights and freedoms at high risk, we tell you.
9. Your rights
9.1 You have the right to access your personal data, and to have it corrected or erased. You can ask us to restrict its processing. Where we process it on the basis of a contract with you, you can receive it in a machine-readable format and have it passed on. Section 10 covers your right to object.
9.2 Email us to use these rights. We answer within one month. For complex requests we may take two months longer, and tell you so within the first month. We may ask you to confirm who you are. Using your rights is free, unless a request is clearly unfounded or excessive.
9.3 An account admin of your company can also change or remove your portal access.
10. Your right to object
10.1 Most of what this statement describes rests on our legitimate interests. You can object to that processing at any time, on grounds relating to your particular situation (article 21 GDPR). We then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend a legal claim. Email us to object.
11. Complaints
11.1 If you think we handle your data wrongly, tell us first if you like. You can also complain to the Dutch Data Protection Authority: Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, the Netherlands, autoriteitpersoonsgegevens.nl. Or complain to the data protection authority where you live or work.
12. Cookies and browser storage
12.1 pd_session keeps you signed in for 14 days. Scripts can't read it. Apart from pd_view_as for our own staff (12.3), it is the only cookie of ours that stays once you are signed in.
12.2 pd_next remembers the page you asked for while you sign in, for 30 minutes. We delete it once you are signed in.
12.3 pd_view_as is set only for our own staff, for one hour, when they view a client's portal to support them.
12.4 pd-theme is kept in your browser's local storage, only when you choose a light or dark theme.
12.5 These are strictly necessary to provide the service you ask for, or store a choice you made. So we don't ask for consent (article 11.7a(3)(b) of the Dutch Telecommunications Act). We use no analytics, advertising or tracking cookies. Our fonts come from our own site. Mollie sets its own cookies in its checkout, under its own policy.
13. What you must give us, and automated decisions
13.1 You need an email address to sign in. Your company needs to give billing details to buy and to be invoiced. Nothing else is required.
13.2 We check VAT numbers automatically against VIES, and the result decides whether Dutch VAT is charged to your company: for a business elsewhere in the EU, a number VIES doesn't confirm means we charge Dutch VAT instead of applying the reverse charge. If you think the check got it wrong, email us. A person looks at it and corrects the invoice where needed. Apart from that, we make no decisions about people based solely on automated processing that have legal or similarly significant effects. Our AI agent works on your company's issues. It makes no decisions about you.
14. Changes
14.1 We may update this statement. The version date shows at the top of the page. We tell account admins by email about changes that matter to them.