Sitedrive Privacy Policy
Version: 2026-10 · Effective: 1 November 2026
This policy explains how Sitedrive Oy handles personal data when you use the Sitedrive service (the web app, the mobile apps and the API) or visit sitedrive.com. It also explains your rights and how to use them. Our general principles for protecting personal data are in our Data Protection Policy.
1. Who we are
Sitedrive Oy (business ID 2768803-6), Lapinlahdenkatu 16, 00180 Helsinki, Finland.
Data Protection Officer: dpo@sitedrive.com. Contact the DPO about anything in this policy.
2. Our role
Inside the Sitedrive service, Sitedrive is a processor. The company whose Sitedrive account you use is the controller of your personal data in the service: usually your employer or the company that invited you. If you start a trial, the company you start it for is the controller of the trial account. We process the data only on that company's behalf and on its instructions, under its agreement with us and our Data Processing Agreement. Section 3 describes this data.
Sitedrive is the controller only for marketing and sales contacts, the customer relationship and billing, our website, and sign-ins that are not yet linked to any company. Section 4 describes this data.
3. Data we process on behalf of a customer company
| Data | What it includes | How long it is kept |
|---|---|---|
| User account and sign-in | Email address, name if your sign-in provider shares it, user ID, sign-in method (email code, Google, Microsoft or Apple), sign-in times, language and time zone. | Until you or the company remove your account. Erased automatically 12 months after your last sign-in if you no longer have access to any company account. |
| Profile, roles and invitations | Name, email, phone, job title, and your roles and permissions in the company's account. | As long as the company keeps you in its account. |
| What you and others enter | Projects, schedules, tasks, progress reports, comments, photos and attachments, which may mention people. | As the company's agreement with us sets out. |
| Activity history | Who changed what and when, so the account can see how the plan changed. | As the company's agreement with us sets out. |
| Acceptance of the User Terms | User ID, document version, time of acceptance, web or mobile. The company's agreement with us requires its users to accept the User Terms. | While your account exists, and for 3 years after it is deleted. |
| Email and push notifications | Email address, device token for push notifications, and the notification content. | Device tokens until you sign out, remove the app or delete your account. Email delivery logs up to 30 days. |
| Support | Your messages to Sitedrive support about using the service and details of the conversation. | 3 years after your last contact with support. |
| Product analytics and error monitoring | A pseudonymous user ID, the features you use and when, device and browser type, and error reports. We don't use cookies for this, record sessions, or collect what you type. | 24 months. Only anonymised statistics are kept after that. |
| Feedback and surveys | User ID, score and comment in in-app satisfaction surveys (NPS). | 3 years after the response, or until your account is deleted, whichever comes first. |
| Security logs | IP address, user ID, time, and the action or request made. | 12 months. Longer only for logs needed in an ongoing security investigation or legal claim, and only until it is resolved. |
| Trial accounts | Everything in the trial account, including any schedule you upload. | The trial account becomes read-only when the trial ends and is deleted no later than 90 days after that, unless it becomes a paid subscription. |
If the company switches on Sitedrive's AI features, the schedule data needed for that feature is processed by Google Cloud's AI service inside the European Union. It is not used to train AI models. Our AI data processing description is available from dpo@sitedrive.com.
The company decides how this data is used. Contact that company about its use of your data. If you contact us, we pass your request on to the company. When the company's agreement ends, its data is returned or deleted as the agreement sets out.
4. Data Sitedrive controls
| Purpose | Personal data | Legal basis (GDPR) | How long we keep it |
|---|---|---|---|
| Sign-ins not linked to any company. Anyone can sign in to Sitedrive. Until a company gives you access or you start a trial, we keep your account only so that you can do so. | Email address, name if your sign-in provider shares it, user ID, sign-in method and times. | Steps you ask for before a contract (Art. 6(1)(b)). | Erased 30 days after your last sign-in, unless a company gives you access or you start a trial. You can delete it yourself at any time. |
| Trial and sales contacts. Contacting you about Sitedrive after you start a trial or ask us for a demo. | Name, email, company, and your phone number and job title if you give them. | Your consent (Art. 6(1)(a)), which you can withdraw at any time. | Until you withdraw consent, and no longer than 3 years after your last interaction with us. |
| Customers and billing. Managing the customer relationship, invoicing and bookkeeping. | Names, emails and phone numbers of customer contacts, and contract and invoice details. | Contract (Art. 6(1)(b)); legal obligation under the Finnish Accounting Act (Art. 6(1)(c)). | For the customer relationship, then as long as accounting law requires (up to 10 years). |
| Marketing and newsletters. Product news, events and offers. | Name, email, company, and whether you open emails or click links in them. | Your consent (Art. 6(1)(a)). For business contacts, where the law allows, our legitimate interest, which you can object to at any time. | Until you withdraw consent or unsubscribe, and no longer than 3 years after your last interaction with us. |
| Website. Running sitedrive.com, its forms and demo bookings. | Form contents (name, email, company, message), and cookie data if you agree to it. | Legitimate interest for necessary cookies and answering your request; consent for analytics cookies. | Form submissions: 2 years after your last contact. Cookies: see the Cookie policy. |
Deleted data can remain in encrypted backups for up to 30 days before the backups are overwritten.
We do not sell personal data. We do not use it for profiling or automated decisions that have legal or similarly significant effects on you.
5. Who receives the data
We use service providers to run Sitedrive: hosting, sign-in, email, analytics, support chat and network security. They process data only on our instructions and under data processing agreements. The current list, with what each provider does and where, is at sitedrive.com/subprocessors. How we process data for customer companies is set out in our Data Processing Agreement.
Inside a company account, other members of that account see your profile and activity according to their permissions. We may also disclose data when the law requires it.
6. Where the data is processed
All application data is stored in the European Union, in Google Cloud's Finland region, with backups in another EU region. Some providers process limited data outside the EU:
- Google Firebase. Processes sign-in records (email, user ID, sign-in metadata) and push notification delivery on Google's global infrastructure, including the United States.
- HubSpot. Handles support chat and our customer records in the United States.
- Cloudflare. Processes network traffic metadata at its global edge.
These transfers are covered by the EU–US Data Privacy Framework and the European Commission's Standard Contractual Clauses.
7. Your rights
You have the right to:
- access your personal data and get a copy;
- have incorrect data corrected. You can edit your name, phone and job title yourself in your profile.
- have your data erased. You can delete your user account yourself in the web app and the mobile apps, under your profile. This doesn't delete what you entered in a company's account, which belongs to that company.
- restrict processing or object to it, and object to direct marketing at any time;
- data portability for data you gave under a contract or with consent;
- withdraw consent at any time. This doesn't affect processing that happened before you withdrew it.
For data in section 3, contact the company whose account it is; if you contact us, we forward the request to them and help them answer it. For data in section 4, email dpo@sitedrive.com. We answer within one month. We may need to confirm your identity first.
You can also complain to the Finnish supervisory authority, the Office of the Data Protection Ombudsman (tietosuoja.fi), or to the supervisory authority where you live or work.
8. Security
Data is encrypted in transit and at rest. Sign-in uses single sign-on or one-time email codes; Sitedrive has no passwords. Access to production systems requires multi-factor authentication and is limited to the staff who need it. See Security at Sitedrive.
9. Changes to this policy
We update this policy when our processing changes. The version and date are at the top. We tell users about material changes in the service before they take effect.