Privacy Policy

Last updated: 25 September 2026

Plain-language summary

We collect only the data we need to run Depentra for you: your account details, your project data, billing information handled by Stripe, error reports that help us fix problems, and usage analytics only if you accept them. When you use an AI feature, the project context it needs is sent to OpenAI to produce the answer. We never sell your data. Email sales@depentra.com with any question, or to have your data exported or deleted.

1. Who we are

Depentra ("we", "us") is the data controller for personal data processed through the Depentra application and website.

2. Data we collect and why

  • Account data (name, email, organization name; your password is held by our authentication provider as a hash): to create and secure your account.
  • Project data (tasks, dependencies, resources, risks, budgets, comments, files you attach): to provide the service. This data belongs to your organization.
  • Billing data (plan, seat count, invoice history): to bill you. Card details are processed by Stripe and never touch our servers.
  • AI requests: when you ask the AI Assistant, run the AI Agent or create a project with AI, your question and the project data needed to answer it are sent to OpenAI. We record that the request happened (feature, model, credits used, outcome, and the agent or workflow it came from) to meter your allowance or your Team’s shared AI pool; that usage record holds no text.
  • AI assistant conversations: what you ask the AI assistant and its answers, with the project and view you asked from, are kept in your account so you can return to them on any device. Only you can see your conversations. You can rename, archive or delete any of them; deleting one removes its messages. When the assistant runs an agent or workflow for you, the run is kept in AI → Runs as your organization's record of what ran, even after the conversation is deleted.
  • Error reports and performance timings: when something fails in the app, we record the error message (email addresses removed), the page without its query string, the app version, and the organization and project it happened in; and we sample how long saves and loads take. No task names or content. This keeps the service working, so it is not tied to the analytics choice.
  • Usage analytics, only if you choose Accept All in the cookie banner: page-view counts through Cloudflare Web Analytics (no cookies, no identifier in your browser); visit and action counts through Google Analytics 4 when we switch it on (the _ga cookies; advertising features off; no names, email addresses or content); and a short list of product events recorded against your account while you are signed in (for example "project created"), with no task names or content.
  • Support data (messages you send us): to help you.

3. Legal basis under GDPR

We process account, project, billing and AI request data under contract performance (Article 6(1)(b)). We process usage analytics under consent (Article 6(1)(a)). We process error reports, performance timings, security logs and fraud prevention data under legitimate interests (Article 6(1)(f)): keeping the service secure and working. We process tax and accounting records under legal obligation (Article 6(1)(c)).

4. Retention periods

  • Account and project data: for as long as your account exists, or until you delete it. A project you delete stays in Recently deleted for 7 days so it can be restored, and is removed permanently after that.
  • A project's change history: for as long as the project exists.
  • AI assistant conversations: until you delete them, or your account.
  • Agent and workflow run records: for as long as the project they ran on, and its organization, exist.
  • Billing records: 7 years, as required by tax law.
  • Error reports and performance timings: 90 days.
  • Product events (analytics): 13 months.
  • Support correspondence: 24 months.

5. Where data is stored and how it is protected

Data is stored in Supabase-managed PostgreSQL and object storage, encrypted at rest and in transit with TLS 1.2 or above. Access is restricted by row-level security in the database and by project and organization roles. See our Security page for details.

6. Service providers we share data with

  • Supabase: database, file storage and authentication.
  • Cloudflare: hosting, content delivery, and page-view analytics if you accept them.
  • Google (Google Analytics 4): visit and action statistics, only if you accept analytics and only once we switch it on.
  • Stripe: payment processing.
  • Resend: transactional email such as invitations and account notices.
  • OpenAI: the AI features, for the requests you make.

Each provider processes data only to provide its part of the service. We never sell personal data and never share it with advertisers.

7. Your rights

Under GDPR you have the right to access, rectify, export, restrict, object to processing of, and erase your personal data, and the right to lodge a complaint with your supervisory authority (in the UK, the ICO).

8. How to exercise your rights

Email sales@depentra.com from your account email address. We respond within 30 days. You can correct your name and details yourself in Settings, delete projects you own, and export any view's data to Excel, CSV or PDF at any time. Deleting your whole account, or exporting everything in it at once, is done by us on request.

9. Cookies

We use essential browser storage for login sessions and optional analytics you can accept or reject at any time. Full details, including a table of everything we store, are in our Cookie Policy.

10. Contact

Privacy questions and requests: sales@depentra.com, marked "Privacy".

11. Changes to this policy

We will tell you about material changes by email at least 14 days before they take effect, and the date at the top of this page always shows the latest version.