Privacy Policy

This Privacy Policy describes how Digisto d.o.o. ("Digisto", "we", "us") collects, uses, shares, and protects personal information when you visit our marketing site or use the Digisto workspace. This page is maintained by Digisto to answer common questions and is not a certification.

If you use Digisto on behalf of an organization, that organization is the "controller" of workspace data and we act as a "processor" under applicable data-protection laws.

We collect the following categories of information:

• Account data: name, email, avatar, workspace role.
• Workspace content: records, files, messages, and metadata you upload.
• Usage data: pages visited, features used, timestamps, and coarse device info.
• Billing data: plan, invoice history, and payment method tokens (via Stripe).
• Support data: correspondence with our team.

We use personal data to:

• Operate, secure, and improve the Digisto service.
• Authenticate users and enforce access controls.
• Send transactional notifications and product updates you have opted into.
• Detect abuse, prevent fraud, and satisfy legal obligations.

We do not sell personal data. We do not use workspace content to train foundation models.

For users in the EEA and UK, we process personal data under one or more of the following legal bases: performance of a contract, compliance with a legal obligation, legitimate interests (product security, analytics, service improvement), and consent (for optional cookies and marketing communications).

We share personal data with vetted sub-processors that help us deliver the service — for example, cloud infrastructure, email delivery, analytics, and payments. A current list is available on our Trust page.

We may also disclose data to comply with law, to protect rights and safety, or in connection with a business transfer, subject to reasonable notice.

We retain personal data for as long as your account is active and as needed to provide the service. Workspace content is deleted within 30 days of account termination unless a longer period is required by law. Backups are purged on a rolling 35-day window.

Depending on where you live, you may have the right to:

• Access, correct, or delete your personal data.
• Object to or restrict certain processing.
• Export a portable copy of your data.
• Withdraw consent for optional processing.
• Lodge a complaint with your local supervisory authority.

To exercise a right, email privacy@digisto.si.

Digisto is headquartered in the United States and operates globally. Where required, we rely on Standard Contractual Clauses (SCCs) and equivalent safeguards for cross-border transfers of personal data.

Digisto is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

We may update this Privacy Policy from time to time. Material changes will be announced by email or in-product notice at least 14 days before taking effect.