Your information
Privacy policy
Last updated:
Everstack Ltd is responsible for your personal information as the controller of Sableley. Our company details are below. For any privacy request, email support@sableley.com. We aim to reply within two working days, on a best-effort basis. Support is by email only, with no chat or phone service.
What we hold and why
We hold your account details, boards and pictures to provide the service you asked for. We record your plan, trial dates, subscription status and policy acceptance. If you connect a repo, we hold its address and an encrypted access token so we can sync it. These uses are necessary to perform our contract with you. Without the required account information, we cannot provide an account.
We use billing and tax information to meet legal obligations. We use security logs to protect accounts and the service, which is our legitimate interest. Information you send to support is used to answer your request and resolve the problem.
Your boards and pictures are never sold or used to train anything. We do not show them to other customers or the public. A person at Everstack reads them only with your written permission to fix a support problem, or where the law requires it. Software processes them to provide sync, merging, backups and removal of unreferenced pictures.
Where information goes
- DigitalOcean, London: your boards, pictures and the account records needed to run Sableley.
- Clerk, United States: sign-in information, including your email, your name if Google supplies one, passkey registration details and account security information. Passkey private keys stay with your device or passkey provider. Identity transfers use the UK International Data Transfer Addendum.
- Stripe: payments, subscriptions and billing records, including your billing address, card country and IP address as location evidence for VAT. Stripe handles card details; Sableley does not store your full card number.
- Backblaze, European Union: nightly backups with a rolling 30-day history. Current backup files remain available while your account needs them.
- Resend, United States: your email address and product emails. These include trial-ending, lapsed-account, deletion-warning, account-deleted and yearly-renewal emails, and checkout confirmations. Stripe sends payment receipts and failed-payment emails.
- Cloudflare: delivery and protection of both the landing page and Sableley, cookieless Web Analytics on the landing page, and forwarding of support email to Everstack's mailbox.
- Your chosen Git hosting service, if you connect a repo: a copy of your boards and pictures. You choose that service, its location and who can access your repo.
These providers process information needed for their roles. Some process information outside the UK. Where required, we use approved contractual safeguards for international transfers, including the UK transfer addendum for Clerk. Contact us for information about the safeguards applying to your data.
How long we keep it
Your account information, boards and pictures are held while your account is live. If your trial ends unpaid or your subscription ends, the account becomes read-only. After 90 days lapsed, it is deleted. We email when it lapses and 30 days and seven days before deletion.
You can delete your account from settings sooner. Deletion removes the live account, boards, pictures and sign-in identity, and deletes the account's backup files. Older shared account index backups may still contain account metadata until their 30-day retention ends. All remaining backup information is gone within 30 days of account deletion.
Server security logs can include IP addresses and are kept for 30 days. Billing and VAT records are retained as required by law: six years for UK records and ten years for EU One Stop Shop records. These remain with Stripe and in Everstack's books, not in the product.
Deleting your account does not delete your connected repo, its history, your exports or other copies you control. You are responsible for those copies.
Cookies, device storage and analytics
There is no analytics in Sableley itself. The landing page uses Cloudflare Web Analytics, which works without cookies. We do not use advertising trackers. Sableley uses a session cookie for sign-in, not tracking, so we do not show a cookie banner.
Sableley also stores boards, pictures, pending edits and settings on your device so it can work offline. That storage is part of providing Sableley, not analytics.
Your choices and rights
From your first day, account settings lets you export everything or delete your account. You can also ask us for access to your personal information, correction, erasure, restriction, or a portable copy, and object to processing based on legitimate interests. Some rights depend on the circumstances; for example, we must keep required tax records.
Send requests or complaints to support@sableley.com. You can complain to the UK's Information Commissioner's Office (ICO) or your local data protection authority. Everstack pays the ICO data protection fee.
Accounts are for people aged 18 and over. We do not knowingly provide accounts to children.
Changes to this policy
We date each version and email material changes at least 30 days in advance. Continuing to use Sableley after they take effect accepts those changes; you may cancel beforehand. This does not remove any of your data protection rights.