Privacy policy

This policy explains how Enlist processes personal data about the people we are the controller for: people who have an Enlist account, people on Enlist's own waitlist and roadmap, and visitors to enlist.dev. The signups our customers collect on their own waitlists we process on the customer's behalf, see People on a customer's waitlist.

#Controller

Enlist is run by a private individual in Denmark and has no CVR (company) number.

• Controller: Mike Hagen Eggertsen
• Address: Peder Hjorts Vej 7, 2500 Valby, Denmark
• Privacy contact: support@enlist.dev

We have not appointed a data protection officer (DPO). One is only required for public authorities and for those whose core activities are regular and systematic monitoring of people on a large scale or processing of sensitive data on a large scale (Article 37). That does not apply to Enlist.

#Account holders

You sign in to Enlist with GitHub. When you create an account, we process:

• Account details: the name, verified email address and profile picture URL GitHub sends us, and the account name.
• Sign-in: your GitHub user ID and the OAuth tokens GitHub issues for the sign-in. We do not store passwords.
• Sessions: IP address and browser details (user agent) for each active session. A session expires after 30 days.
• Plan and billing: your plan, billing cycle, subscription status, and the customer and subscription IDs from our payment provider, Stripe. Card details go to Stripe and never reach us.
• API keys: a name, the first characters of the key and a one-way hash of it, the scopes, and when the key was created, last used and revoked.
• Usage: how many signups and managed emails your account uses, and which usage alerts we have emailed you.
• Your configuration: waitlists, custom fields, email templates and their translations, the email provider you chose, the from and reply-to addresses you set for signup emails, and the integrations you set up. Credentials you give us for other services are stored encrypted.

Purpose and legal basis: to provide the service and take payment for it (Article 6(1)(b), performance of a contract), to keep it secure and prevent abuse (Article 6(1)(f), legitimate interest), and to keep accounting records where the law requires it (Article 6(1)(c)).

We email you about your account, for example when you approach or reach a plan limit. These emails are part of the service, not marketing.

#Enlist's own waitlist and roadmap

Enlist runs its own waitlist on enlist.dev, and on the roadmap you can vote for a feature with your email address. Both run on Enlist itself, on our own account, so we are the controller for them.

• Data: your email address, where you came from (the referring page and a source tag), the position and referral code Enlist issues, and, for a roadmap vote, the feature and the version of the consent text you saw.
• Waitlist on the home page: the form is a live demo of the API. Joining adds you to our list and sends you the signup email with your position. The legal basis is that you asked to join (Article 6(1)(b)). Beyond that, we email the list only to tell you when you can get access.
• Roadmap votes: as the form says, a vote adds your email to that feature only, and we email you once, when it ships. The legal basis is your consent (Article 6(1)(a)).

You can ask to be removed from either at any time by writing to us.

#Site visitors

enlist.dev sets no tracking or advertising cookies and runs no analytics scripts. Fonts are served from enlist.dev itself. If you choose a light or dark theme, the choice is stored only in your own browser (localStorage).

When you sign in, we set necessary session cookies. They keep you signed in and do not require consent, as they are necessary to provide the service you ask for.

Our hosting provider records technical details such as IP addresses in its operational logs to deliver and protect the site. Runtime logs are kept for 1 day.

The free tools run in your browser. The Open Graph preview tool fetches the URL you enter from our server; nothing about you is stored.

#People on a customer's waitlist

If you joined a waitlist on a website or app that uses Enlist, the company or person that runs that waitlist is the controller for your data. Enlist is their processor and processes the data only on their instructions, as set out in our data processing agreement.

This means, among other things:

• The customer decides what is collected, what you are emailed and how long you are kept on the list.
• Questions about your data, and requests to access, correct or erase it, go to the customer. They can look up, export and delete your signup in Enlist.
• If a customer has connected other tools (for example Slack, Kit, Loops or PostHog), your signup is sent there on the customer's instruction, under the customer's own agreement with that tool.

If you contact us about a signup a customer is responsible for, we pass your request on to the customer.

#Who we share data with

We never sell personal data. We use providers for hosting, database and email; the current list, with location and transfer basis, is on the Sub-processors page. In addition:

• GitHub processes your sign-in under its own terms. It receives nothing from us beyond the sign-in itself.
• Stripe processes payments for paid plans. We send it your email address and your Enlist account ID when you start a subscription. Stripe processes payment details under its own terms and privacy policy.

#Transfers outside the EU/EEA

Enlist's servers run in the USA (Washington, D.C.), and our providers are American companies. Transfers are based on the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses. The basis for each provider is on the Sub-processors page.

#How long we keep data

• Account: as long as you have an account. You can delete it in Settings at any time. That deletes your account, sessions, API keys, waitlists, signups, email settings, integrations and delivery logs at once, and cancels any subscription.
• Sessions: expire after 30 days.
• Rate-limit counters: the IP address of a request to the public signup endpoint is kept in a per-minute counter. Counters older than one hour are deleted by a routine cleanup.
• Billing records at Stripe: Stripe keeps its customer and invoice records after you delete your account, as accounting and financial regulation require. Danish bookkeeping law requires accounting records to be kept for 5 years.
• Enlist's own waitlist and roadmap: until you ask to be removed, or until we no longer need the list.
• Backups: deleted data may remain in our database provider's restore history (Neon) until it ages out, no later than 30 days after deletion.
• Operational logs at our hosting provider: 1 day.

#Your rights

You have the right to access the data we hold about you and to have it corrected or erased. You may also have the right to restrict processing, to object to it and to receive your data in a common format (data portability). Where you have given consent, you can always withdraw it.

Write to us at support@enlist.dev. We reply within one month.

#Complaints

You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk. We would like the chance to solve the problem first.

#Changes

If we change this policy, we update the date at the top. We announce significant changes by email to account holders.