Privacy Policy

Who we are and how to reach us

Speedy Deploy ("we," "us," or "our") provides the Service to mobile product, growth, and monetization teams. In this policy, "you" refers to a person who signs up for or uses our web application; "customer" refers to the organization or team on whose behalf the Service is used; and "end user" refers to a person who uses a mobile app in which a customer has deployed a Speedy Deploy flow.

If you have questions about this policy or how we handle information, contact us at support@speedydeploy.com. If you are an end user of a mobile app and have a question about your data, please contact the company that operates that app, since they control it—see the section on end-user analytics data below.

Account and customer information we collect

When you create a Speedy Deploy account, we collect your name and email address. If you sign in with Google, we receive your name, email address, profile picture, and a Google account identifier through Google's OAuth flow; we do not receive your Google password. If you register with an email and password instead, we store only a securely hashed version of your password and never the password itself.

As you use the Service, we collect information about your organization or team, your project names, your role within a project (owner, admin, manager, or developer), and team membership. When you invite a teammate, we process the invited person's email address so we can send the invitation and, until it is accepted, revoked, or expires, track its status. We also generate authentication session tokens so you can stay signed in.

We collect limited technical information automatically when you use the web application, such as IP address, browser and device type, and log data about requests to our servers, which we use for security, debugging, and keeping the Service reliable.

Flow content you create

The core of the Service is the flows you build—the screens, copy, images, ordering, branching and conditional logic, paywall configurations, experiment and variant definitions, and other content that makes up a flow. We store this flow content so we can render it in your app, run your experiments, and let your team collaborate on it.

This content belongs to you and your organization. We use it to operate the Service for you, not for our own independent purposes, and we do not sell it or use it to build advertising profiles.

End-user analytics data (we act as a processor)

To power the analytics, funnels, and experiments that make Speedy Deploy useful, we collect event data about the end users who experience your flows in your mobile app. This typically includes flow and screen views, step completions and drop-off, the fact that a given question was answered, experiment variant assignments, conversion and paywall interaction events, and device and operating-system information. This data is collected on your behalf, at your direction, and through your integration of our SDK into your app.

We do not receive the answers themselves. When an end user makes a choice or types a reply, our SDK records that the question was answered and nothing about what was said — not the option chosen, not the text entered. The answer is handed to your app, and it is your app that decides whether to send it anywhere. This is a property of how the SDK and our ingest endpoint are built, not a setting, and there is no way to turn it on.

For this end-user data, you (the customer) are the data controller and Speedy Deploy is the data processor. We process end-user data only to provide, secure, and support the Service for you—for example, to compute your funnels, run your experiments, and show you your statistics. We do not use it to independently market to end users, and we do not sell it. Because you control this data, you are responsible for providing any notices to and obtaining any consents from your end users that applicable law requires, and for having a lawful basis to collect it.

You determine what your flows ask end users. We ask that you do not configure flows to collect sensitive personal information or data you are not permitted to collect. If an end user asks to access or delete their data, you can typically fulfill that request through the Service, and we will support you as your processor. Our handling of end-user data is further governed by the data processing terms in your agreement with us.

How we use information

We use customer and account information to create and secure your account, authenticate you (including via Google sign-in and session tokens), operate the web application, enable team collaboration and role-based access, send transactional messages, and provide support.

We use flow content and end-user analytics data to render your flows, run your experiments (including A/B, multivariate, and conditional or branching variants), compute your funnels and conversion statistics, and deliver the reporting features of the Service to you.

We use technical and log data to keep the Service secure and reliable, prevent abuse and fraud, debug problems, understand aggregate usage of our own product, and comply with our legal obligations. Where required, our lawful bases include performing our contract with you, our legitimate interests in operating and securing the Service, your consent, and compliance with law.

Communications

We send transactional emails that are part of the Service, such as a welcome message when you register, a notification when a new sign-in occurs on your account, and team invitation emails. These emails are delivered through our email provider and are necessary to operate the Service, so they are not marketing messages you can opt out of while keeping an active account.

If we ever send optional product or marketing emails, we will include a way to unsubscribe, and you can opt out at any time without affecting your ability to use the Service.

Service providers and sub-processors

We rely on a small set of trusted service providers to run the Service, and they process information only on our instructions and under contractual confidentiality and security obligations. These include cloud hosting and database infrastructure providers that store account, flow, and analytics data; an email delivery provider that sends our transactional emails; and the analytics and data-processing infrastructure that powers your funnels, experiments, and reporting.

We also use Google as an authentication provider when you choose Google sign-in. Where any provider acts as a sub-processor for end-user data that we process on your behalf, we remain responsible to you for their handling of that data. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

Cookies and sessions

Our web application uses cookies and similar technologies that are strictly necessary to sign you in and keep your session active. When you authenticate, we set a session token so you do not have to log in on every request; these sessions expire after a period of inactivity and when you sign out.

We do not use advertising cookies or third-party tracking cookies to profile you across other websites. Any analytics we run on our own website is limited to understanding and improving how the Speedy Deploy site and app perform.

Data retention

We retain your account and customer information for as long as your account is active and as needed to provide the Service. Pending team invitations expire automatically after a set period if they are not accepted or revoked. If you close your account, we delete or anonymize your personal information within a reasonable period, except where we must keep certain records to meet legal, accounting, security, or dispute-resolution obligations.

For end-user analytics data, we retain it for the period configured under your account and your instructions as the controller, and we delete or return it in accordance with your agreement with us when our processing on your behalf ends. Aggregated or de-identified data that can no longer be linked to an individual may be retained to operate and improve the Service.

Security

We take reasonable and appropriate technical and organizational measures to protect information against unauthorized access, loss, or misuse. These include encryption of traffic in transit, hashing of account passwords, hashing of invitation tokens, role-based access controls within projects, restricted internal access on a need-to-know basis, and monitoring and logging of our systems.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach that affects your personal information, we will notify you and any relevant authorities as required by applicable law.

Your privacy rights

Depending on where you live, you may have rights to access the personal information we hold about you, to correct inaccurate information, to delete it, to receive a portable copy, to restrict or object to certain processing, and to withdraw consent where processing is based on consent. Under laws such as the EU and UK GDPR and the California Consumer Privacy Act (as amended), you also have the right not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined under California law.

To exercise any of these rights with respect to your Speedy Deploy account, contact us at support@speedydeploy.com. We will verify your request and respond within the timeframes required by law. If you are an end user of a mobile app that uses Speedy Deploy, direct your request to the company that operates that app, since they are the controller of that data; we will assist them as their processor.

International data transfers

We operate the Service using infrastructure and providers that may be located in countries other than your own, including the United States. When we transfer personal information across borders, we rely on appropriate safeguards recognized under applicable law, such as the European Commission's Standard Contractual Clauses and equivalent mechanisms, together with additional technical and organizational measures where needed.

By using the Service, you understand that your information may be processed in these locations, always subject to the protections described in this policy.

Children

The Service is intended for businesses and product teams and is not directed to children. We do not knowingly collect personal information directly from children through the web application. If we learn that we have inadvertently collected such information from a child in violation of applicable law, we will delete it.

Flows that a customer deploys may reach end users of the customer's app. The customer is responsible for complying with laws that protect children, such as COPPA and the GDPR provisions on children's data, and for configuring flows and consents appropriately for their audience.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in the Service, our practices, or legal requirements. When we make material changes, we will update the effective date above and, where appropriate, notify you through the Service or by email.

Your continued use of the Service after an update takes effect means you accept the revised policy.