Privacy Policy

Controller and privacy contact

Account data

We process your email address, organization membership, role, and authentication events to create and secure your account. Passwordless sign-in emails are delivered through Resend.

Application data

SpringRoll stores application manifests, source references or uploaded bundles, releases, deployments, approvals, access grants, and audit events so your organization can operate and review its internal apps.

Company data

SpringRoll does not store your company data. It queries approved sources through the connector boundary and returns only the approved view of a Data Product to the application. Source credentials are encrypted inside SpringRoll and are never given to the application.

Cookies and analytics

Two kinds of cookie may be set on this site. Strictly necessary cookies sign you in, protect the sign-in form against forgery, and remember your analytics choice; they cannot be turned off, because without them the site cannot do the thing you came for. Analytics cookies are optional, are not set before you accept them, and can be refused at any time from Cookie Settings in the footer.

Optional analytics are processed by Google Analytics and PostHog only after you accept. Google Analytics measures visits to public pages, including sign-in and signup pages. We send the public page path and editorial title without URL query strings or fragments; external referrers are reduced to their origin. We do not send account identifiers, email addresses, form contents, or private application paths to Google Analytics. Its tag and events connect directly to Google, which receives connection information such as your IP address and browser details. Advertising features and automatic interaction tracking are disabled.

PostHog records page views, which features are used, and unhandled errors, and captures session replay with every form input masked. Sign-in tokens, authorization codes, and verification parameters are removed from PostHog web addresses in your browser. PostHog analytics traffic is proxied through this domain.

Refusing analytics stops browser analytics collection and clears what analytics had already stored in your browser. Operational records such as authentication, deployment, and audit outcomes are still processed when needed to provide and secure the service. We do not use advertising, cross-site tracking, or profiling cookies, and we do not sell or share personal data with advertisers.

Service providers and retention

SpringRoll uses service providers required to deliver email, hosting, and infrastructure. Data is retained while the account or organization needs the service and as required to protect security and audit integrity.

Your choices

You can accept or refuse analytics cookies at any time from Cookie Settings in the footer of any public page; see Cookies and analytics for what each one does. Organization administrators can revoke memberships, agent connections, app identities, and data grants. To request access, correction, or deletion of personal data, use the contact page.