Privacy Policy

Who we are

Phasal (“we”, “us”) provides a multi-tenant platform for project management, helpdesk, and AI-assisted TestOps. This Privacy Policy explains what we collect, why we collect it, and the choices you have. It applies to phasal.app and related subdomains, including workspace hosts such as your-team.phasal.app.

If you use Phasal through an organization workspace, that organization is typically the controller of workspace content. We process that content to provide the service to them.

Information we collect

We collect the following categories of information:

• Account information: name, email address, profile image, and job title you provide when you sign in.
• Authentication data: magic-link tokens, session cookies, and optional GitHub or Microsoft sign-in identifiers. We do not store account passwords for magic-link login.
• Workspace content: projects, tasks, issues, changes, helpdesk tickets, comments, attachments, test cases, releases, and similar records you or your teammates create.
• Customer and helpdesk data: requester names, email addresses, and message content submitted through the customer portal or inbound email.
• Usage and device data: approximate timestamps, browser type, and diagnostic logs needed to operate and secure the service.
• Billing details: plan, seat counts, and Stripe customer or subscription identifiers when billing is enabled. Card numbers are handled by Stripe, not stored by Phasal.

How we use information

We use personal data to:

• Provide, maintain, and secure the Phasal service, including routing you into the correct workspace.
• Send transactional email such as magic links, notifications, and helpdesk replies you configure.
• Operate optional integrations you connect (for example GitHub, Microsoft 365 / Graph mail, SMTP, or inbound email).
• Improve reliability, prevent abuse, and comply with law.

AI features and your keys

Phasal can use generative and embedding models for assistance, search, and TestOps. Workspaces may bring their own API keys (BYOK). When a workspace supplies keys, prompts and related content are sent to the providers that workspace configured. We do not use those keys for other customers.

Do not put secrets into prompts or tickets that you are not willing to send to the model providers your workspace has enabled.

Cookies and sessions

We use essential cookies to keep you signed in and to route requests to the correct workspace. We do not use third-party advertising cookies on the product. You can sign out at any time, which ends the session cookie.

Sharing

We do not sell personal information. We share data with subprocessors only as needed to run the service — for example hosting, email delivery, error monitoring, and payment processing — and with third parties you connect through workspace settings.

We may disclose information if required by law, to protect the service, or in connection with a merger or acquisition, with appropriate safeguards.

Retention

Account and workspace data is kept for as long as the workspace remains active and for a reasonable period afterward so we can restore or export it if requested by a workspace admin. Magic-link tokens expire in minutes. Backups and logs are retained for a limited operational window.

Your choices

You can update your profile, notification preferences, and (if you are a workspace admin) member access, signup settings, and integrations. You may request access, correction, or deletion of personal data we hold about you by emailing [email protected]. If you use Phasal through an employer, we may redirect that request to your workspace admin.

You can opt out of non-essential product notifications in workspace settings. Transactional mail required to sign in or deliver helpdesk messages cannot be turned off while you use those features.

International transfers and security

We host Phasal on infrastructure that may process data in the United States or other regions where our providers operate. We use encryption in transit, access controls, and tenant isolation so one workspace cannot read another workspace’s records.

No method of transmission or storage is perfectly secure. Please use unique work emails and treat magic links as secrets.

Children

Phasal is built for professional teams. We do not knowingly collect personal information from children under 16. If you believe a child has created an account, contact us and we will delete it.

Changes

We may update this policy as the product changes. We will revise the date above and, for material changes, provide additional notice in the product or by email when we have a contact address.

Contact

Questions about privacy: [email protected]. Legal notices: [email protected]. Support: [email protected].