1. Who we are

Deckbell is operated by Symprox Solutions, registered in the Republic of Azerbaijan (VÖEN 1009080171), with its registered office at Ecemi Naxcivani 26, Baku, Azerbaijan (“Deckbell”, “we”, “us”).

For your account details, and for data about how you use the website and the Service, we are the data controller. For the content a workspace stores in Deckbell, the organisation that owns the workspace is in control of that content, and we process it on its behalf to provide the Service. If your organisation needs a data processing agreement (DPA), contact us at support@deckbell.com.

We have not appointed an EU representative at present. If you are in the EU or EEA, you can contact us directly at support@deckbell.com about any data protection matter.

2. Data we collect

Account information

When you sign up or edit your profile: your name, email address, username, profile photo, and, if you add them, your position and department. We also store what is needed for the sign-in methods you use: a securely hashed password, the public key of any passkey you register, and your two-factor authentication settings. If you sign in with Google, we receive your name, email address, Google account ID and profile photo from Google.

Workspace content

Everything you and your teammates create in Deckbell: workspaces, projects, issues, sprints, comments, chat messages, voice messages and the files you upload (such as images and videos), plus agent configuration and instructions. If you attach your own AI provider key to an agent, we store it encrypted.

Integration data

If your workspace connects GitHub, we store the GitHub account name and ID used for the connection, an access token (encrypted), and information about the repositories and pull requests the integration works with.

Activity and notification data

Your online status (presence) is shown to members of your workspaces while you are using the app. We keep a history of the notifications we send you (for example, mentions, assignments and invitations), and records of agent runs.

Billing information

Payments are processed by Paddle. Paddle collects your payment details; we do not receive or store your full card details. We receive from Paddle what we need to manage your subscription, such as a customer ID, billing contact, plan, seat count and payment status.

Technical data

Like most online services, our servers and Cloudflare record technical information when you use Deckbell, such as your IP address, browser and device type, the pages or API endpoints requested, and timestamps. We use it to keep the Service secure and working, and to fix problems.

When you contact us

If you email us, we keep the message and our reply so we can help you.

3. Google user data

This section explains how Deckbell handles information it receives from Google when you choose “Sign in with Google” (or “Continue with Google”). Signing in with Google is optional; you can also sign in with an emailed code, a password or a passkey.

What we access

Deckbell only requests Google’s basic sign-in scopes (openid, email and profile). From your Google account we receive your name, your email address (and whether Google has verified it), your Google account ID and the address of your profile photo. We do not request or access your Gmail, Google Drive, Calendar, Contacts or any other Google data, and we never see your Google password.

How we use it

to create your Deckbell account, or to find your existing account by its email address;
to sign you in, now and in the future, using your Google account ID;
to treat your email address as verified, since Google has already confirmed it;
to fill in your name and, if you haven’t uploaded a picture, your profile photo, which the members of your workspaces see next to your messages and issues.

We do not use Google user data for advertising, we do not sell it or give it to data brokers or information resellers, we do not use it to determine credit-worthiness or for lending, and we do not use it to develop, improve or train generalised or non-personalised AI or machine-learning models. Nobody at Deckbell reads it except where you ask us to (for example in a support request), where it is needed for security or to investigate abuse, or where the law requires it.

Who we share it with

We do not share, transfer or disclose Google user data to third parties, except: with the members of the workspaces you join, who see your name, email address and photo; with the infrastructure providers that host Deckbell for us under contract (Hetzner and Cloudflare, see “Who we share data with”); where the law requires it; or as part of a merger, acquisition or sale of our business, after telling you first.

How we protect it

Google user data is sent over encrypted connections (HTTPS) and stored in our database on servers in Germany, which only Deckbell’s systems and a small number of authorised administrators can access. We do not store Google access tokens or refresh tokens: we use Google only to confirm who you are at sign-in, not to call Google services on your behalf.

How long we keep it, and how to delete it

We keep your name, email address, Google account ID and photo for as long as your Deckbell account exists. You can change your name and photo at any time in your profile settings. To delete this data, delete your account in the app’s settings or email support@deckbell.com; we then delete it within 30 days (and from backups within 30 days). You can also remove Deckbell’s access at any time at myaccount.google.com/connections; this stops you signing in with Google but does not by itself delete your Deckbell account.

Limited Use

Deckbell’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use your data

We use personal data to:

provide the Service: create your account, run your workspaces, show your work to your teammates and deliver messages in real time;
sign you in and keep your account secure, including sending one-time sign-in codes;
send service emails such as sign-in codes, invitations, notifications and important account notices;
run AI agents when you ask them to do something;
manage subscriptions and billing;
answer support requests;
prevent abuse, investigate problems and improve the Service;
comply with the law.

We do not sell your personal data, we do not use it for advertising, and we do not use your workspace content to train AI models.

5. Legal bases (EEA and UK)

If data protection laws such as the GDPR apply to you, we rely on these legal bases:

Contract: to provide the Service you signed up for, including accounts, workspaces, agents and billing.
Legitimate interests: to keep the Service secure, prevent abuse, fix problems, improve Deckbell and answer questions. We balance these interests against your rights.
Consent: where we ask for it, for example when you choose to sign in with Google or connect an integration. You can withdraw consent at any time.
Legal obligation: where we must keep or disclose data by law, for example tax records.

6. AI agents

Deckbell agents run on models from Anthropic. When you use an agent, the content it needs is sent to Anthropic, which processes it to generate the agent’s response. Depending on what you ask, this can include:

the issue the agent is working on (its key, title and description) and your instructions;
the agent’s configuration and prompt;
recent messages in a chat conversation with the agent;
for coding agents, the name of the repository attached to the agent; the agent then works in a sandboxed environment run by Anthropic.

Content is only sent to Anthropic when an agent is used, not for the rest of your workspace. Anthropic processes it under its commercial terms. If you attach your own Anthropic API key, the request is made under your own Anthropic account and its terms.

Within Deckbell, your profile and the content you post are visible to the other members of the workspaces you belong to, according to the workspace’s settings.

Outside Deckbell, we use the service providers below to run the Service. They process personal data for us under contract, only for the purposes described here.

Provider	What it does for Deckbell	Location
Hetzner	Hosts the Deckbell API servers and the database that stores accounts and workspace content.	Germany (Nuremberg)
Cloudflare	DNS, content delivery and security (all traffic to deckbell.com, app.deckbell.com and api.deckbell.com passes through it), hosting of the website and web app, storage of uploaded files and workspace exports (Cloudflare R2, EU jurisdiction), sending of transactional email, and relaying huddle audio, video and screen sharing in real time (not recorded or stored).	Global network; files stored in the EU
Anthropic	Runs the AI models behind Deckbell agents, only when you use an agent.	United States
Paddle	Merchant of record for paid plans: checkout, payment processing, invoicing and tax.	United Kingdom and other countries
Google	“Sign in with Google”, only if you choose it (see “Google user data” below); and serving the web fonts used on deckbell.com.	United States and other countries
GitHub	Repository and pull-request integration, only if your workspace connects it.	United States

We may also disclose data if the law requires it, to protect the rights, property or safety of our users or others, or as part of a merger, acquisition or sale of our business, in which case we will tell you before your data becomes subject to a different privacy policy.

8. Where your data is stored

Deckbell’s servers and database are hosted by Hetzner in Germany, and uploaded files and workspace exports are stored with Cloudflare R2 under its EU jurisdiction, so your account and workspace content are stored in the EU. Some of our providers (Cloudflare, Anthropic, Google, GitHub and Paddle) may process data in other countries, including the United States. Where data leaves the EEA or UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

9. Cookies and local storage

We only use cookies and browser storage that are needed for Deckbell to work. We do not use advertising or analytics cookies, and deckbell.com does not run analytics.

Session cookie (deckbell-session): keeps you signed in. It is a first-party cookie set on .deckbell.com so that app.deckbell.com and api.deckbell.com share your session.
Security cookie (XSRF-TOKEN): protects your account against cross-site request forgery.
Preferences in local storage: your light or dark theme choice on deckbell.com and your appearance settings in the app. These stay in your browser.
Cloudflare may set strictly necessary cookies to protect the Service from bots and attacks.

deckbell.com loads its fonts from Google Fonts, which means your browser connects to Google and shares your IP address with it.

10. How long we keep data

Account and workspace data: for as long as your account or workspace exists. When you delete your account, or an owner deletes a workspace, we delete the related data within 30 days.
Backups: deleted data may remain in backups for up to 30 days before it is overwritten.
Technical logs: for up to 90 days, unless we need them longer to investigate a security incident.
Billing records: for as long as tax and accounting laws require.

11. Security

We protect your data with encryption in transit (HTTPS), hashed passwords, encrypted storage of secrets such as provider API keys and integration tokens, access controls, and support for passkeys and two-factor authentication. No system is perfectly secure, so please use a strong, unique sign-in method and turn on two-factor authentication. If we become aware of a breach that affects your personal data, we will notify you and the authorities as the law requires.

12. Your rights

Depending on where you live, you may have the right to:

access the personal data we hold about you and get a copy of it;
correct inaccurate data (you can edit most profile details in the app yourself);
delete your data (you can delete your account in the app’s settings);
receive your data in a portable format;
object to or restrict certain processing;
withdraw consent where we rely on it;
complain to your local data protection authority.

To exercise these rights, email support@deckbell.com. We will reply within one month. If your request is about content in a workspace that belongs to an organisation, we may refer you to that organisation, since it controls that content.

13. Children

Deckbell is a tool for work and is not meant for children. You must be at least 16 to use it, and we do not knowingly collect data from anyone younger. If you think a child has given us personal data, contact us and we will delete it.

14. Changes to this policy

We will update this policy when our practices or providers change, and change the “Last updated” date above. If a change is significant, we will tell you by email or in the app before it takes effect. See also our Terms of Service.

15. Contact

Questions or requests about privacy? Write to support@deckbell.com, or by post to Symprox Solutions, Ecemi Naxcivani 26, Baku, Azerbaijan.