Privacy policy

1Who we are

Circlebak is made by Portside Labs, LLC (“Portside Labs”, “we”, “us”), 414 Falcon Ave, Miami Springs, FL 33166, United States. This policy covers the Circlebak app and website at circlebak.io.

2Whose information this covers

People with a Circlebak account

Anyone who signs up, accepts an invitation, or is added by their organization’s identity provider. For account information, such as your name, email address and sign-in methods, Portside Labs decides how it’s used.

What an organization puts into Circlebak

Videos, comments, collections, teams and the people invited belong to the organization that uploaded or created them. We hold that content on the organization’s behalf and use it only to run Circlebak for them. The organization decides who can see it, and its owners and admins answer for what’s in it. If a video shows or mentions you, the organization that uploaded it is the best place to start.

Visitors to circlebak.io

People who read the website without signing in. We count their visits with Google Analytics, and don’t run advertising scripts.

3Information we collect

When you create an account or sign in

• Your name and email address.
• Your preferred language. We set it the first time you sign in, from the language you were reading the site in or your browser’s language settings, and you can change it in your settings.
• Your password, stored only as a one-way hash. When you choose a password, we check it against known breached passwords by sending the first five characters of its hash to Have I Been Pwned. The password itself never leaves Circlebak.
• If you turn them on, your two-factor authentication secret and recovery codes (encrypted), and your passkeys’ public credentials and when each was last used.
• If you sign in with Google or Microsoft, your account ID at that provider, and the name and email address it shares. If you don’t have a profile photo in Circlebak, we copy your photo from that provider.
• If your organization uses single sign-on (SAML or OpenID Connect) or SCIM provisioning, the name, email address, ID and active status your organization’s identity provider sends us.

Your profile

A profile photo, if you upload one or we copy it from your sign-in provider. We crop it, convert it and strip its metadata, including any location, before storing it.

About organizations

• The organization’s name and logo, its members, teams, roles and pending invitations.
• Email domains the organization verifies, with the DNS record used to verify them.
• Single sign-on settings, including the identity provider’s address and certificate. Client secrets are stored encrypted.
• Its plan, trial and subscription details. Card details are handled by Stripe; we keep only the card type and last four digits so we can show which card is on file.

Videos and feedback

• The video files members upload, with each video’s title, description, file name, type, size, length, feedback deadline and who uploaded it. Files go straight from your browser to our storage. We don’t transcode, transcribe or analyze them.
• Comments and replies, the moment in the video they refer to, who they mention, whether they’re resolved, and links to issues in tools like Jira, Linear or GitHub. We store those links as typed and never open them.
• Collections, the people and teams attached to them as stakeholders, and each member’s notification settings.

While you use the app

• A session record with your IP address and browser user agent, to keep you signed in and protect your account (see Cookies and browser storage).
• A record of changes to the information above, kept for security, support and recovering from mistakes (see How long we keep it).
• Performance and error data from our monitoring service, tied to your user ID, such as which page was slow or which request failed. We don’t record the contents of what you submit.

We don’t track which videos you watch or for how long, and we don’t record your screen, clicks or keystrokes.

When you visit the website

If you aren’t signed in, the home page, this policy, the terms and the sign-in and sign-up pages count your visit with Google Analytics. Google receives the pages you view, the site that sent you, your browser, device, language and screen size, and an approximate location worked out from your IP address, which it doesn’t store. We use it only to see how people find Circlebak and which pages lead to sign-ups. It isn’t linked to your account, Google’s advertising features and Google signals are off, and nothing in the app behind sign-in uses it.

If you visit from the EEA, the UK or Switzerland, Google Analytics sets no cookies, so it can’t recognize you on a later visit. Anywhere else, you can turn it off with Google’s opt-out browser add-on or a content blocker.

Fonts are served from our own site, not from Google. Cloudflare, which our hosting provider uses, processes your IP address to deliver pages and protect them from abuse.

When you email us

We keep your message and our reply so we can help you, for as long as the conversation is useful.

What we don’t collect

• Full payment card or bank details. Stripe holds them.
• Your password at Google, Microsoft or your identity provider.
• Your date of birth, or any sensitive information we ask for. Don’t put sensitive personal information in videos or comments unless your organization needs it there.

4How we use information

• To run Circlebak: storing and playing videos, showing comments, and managing organizations, teams, roles and sign-in.
• To send the emails the service depends on: verifying your address, invitations, new videos, comments and mentions, feedback deadline reminders, sign-in codes, password resets, and storage and billing notices. Your notification settings control most of them. Comment emails include the comment’s text.
• To bill organizations for their plan, count creators and storage, and apply plan limits.
• To answer support requests, fix problems and keep the service secure. To troubleshoot, a small number of our staff can sign in as your account to see what you see. Every time they do, we record who did it, when, and from which IP address.
• To count visits to the public website and see which pages lead to sign-ups.
• To meet legal obligations.

We don’t sell information, use it for advertising, or share it with data brokers. We don’t use your videos, comments or any other content to train machine learning models, and we don’t send them to AI services.

Our legal bases, where the law asks for one, are performing our contract with you or your organization, our legitimate interests in running and securing the service and in understanding how people find it, and complying with the law.

5Who can see it and who we share it with

Inside your organization

Other members of an organization can see your name, email address and profile photo, and the videos and comments you post there. What else each member can do depends on the role the organization gives them. Owners and admins can manage members, turn on single sign-on and provisioning, and remove access.

Videos, comments, avatars and logos are only shown to signed-in members. Videos play through private links that expire after a few hours.

Service providers

These companies process information for us, under contract, only to provide their service:

Services you choose to connect

If you sign in with Google or Microsoft, or your organization connects an identity provider, that service learns that you signed in to Circlebak and handles your sign-in under its own privacy policy. When you choose a password, Have I Been Pwned receives a short, anonymous fragment of its hash and nothing else.

When the law requires it

We disclose information if we have to by law, or to protect the rights, property or safety of our users, the public or Portside Labs. Where we’re allowed to, we tell the affected organization first.

If the business changes hands

If Portside Labs or Circlebak is sold or merged, information may move with it, under this policy’s protections. We’ll tell organization owners before that happens.

6Cookies and browser storage

The app uses only what it needs to work. The public website also uses Google Analytics cookies for visitors who aren’t signed in.

Where the law asks for consent to analytics cookies, in the EEA, the UK and Switzerland, Google Analytics sets none, so we don’t show a cookie banner. There are no advertising cookies.

7Where information is stored

Circlebak’s app, database and file storage run in the United States. If you use Circlebak from outside the United States, your information is transferred there. Where the law requires it, we rely on appropriate safeguards, such as standard contractual clauses, for those transfers.

Google Analytics processes website visit data in the United States and other countries.

8How long we keep it

When you delete your account

You can delete your account from your profile settings. We delete your account, profile photo, sign-in methods, sessions, memberships and notification settings. The videos and comments you posted belong to your organizations, so they stay there without your name attached until the organization deletes them. Ask an organization’s owners if you want something removed.

When an organization is deleted

An owner can delete an organization from its settings. Its subscription is cancelled, and its videos, comments, collections, teams, memberships, invitations, domains, single sign-on settings and logo are deleted. Stripe keeps its own records of past payments and invoices, as the law requires.

When a Free plan is over its storage

If an organization on the Free plan, including one whose trial has ended, stores more than its plan allows, we email its owners. If it’s still over 30 days later, we delete its oldest videos until it fits. Paid organizations are never trimmed this way; new uploads are paused instead.

Copies after deletion

Deleted information can remain in backups for up to 7 days, and in the record of changes for up to 365 days, where only our staff can reach it, for security and recovery.

9Security

• Everything travels over HTTPS.
• Passwords are hashed. Two-factor secrets, single sign-on secrets and the session cookie are encrypted, and invitation and provisioning tokens are stored only as hashes.
• Two-factor authentication, passkeys and single sign-on are available, and organizations can require single sign-on.
• Each organization’s records are kept separate, and every request is checked against the organization and the member’s permissions.
• Video links are signed and expire. Files are never public.
• Staff access to accounts is limited and every sign-in as a user is recorded.

No system is perfectly secure. If a breach affects your information, we’ll tell you without undue delay and as the law requires.

10Your rights

Wherever you live, you can ask to access, correct, delete or receive a copy of your personal information, to object to or restrict how we use it, and to withdraw consent where we relied on it. We don’t sell or share personal information for advertising, so there’s nothing to opt out of. We won’t treat you differently for using these rights.

Doing it yourself

You can change your name, email address, photo and sign-in methods in your profile settings, choose which emails you get, and delete your account.

How to make a request

Email support@circlebak.io from the address on your account. We’ll confirm who you are and answer within 30 days. You can also complain to your local data protection authority.

If your request is about an organization’s content

Videos and comments belong to the organization that holds them, which decides what happens to them. Contact that organization’s owners first; we’ll help them with your request.

11Children

Circlebak is a business tool. It isn’t meant for children, and we don’t knowingly collect information about anyone under 16. If you think a child has an account, tell us and we’ll delete it.

12Changes to this policy

When we change this policy, we’ll update the date at the top of this page. Before a change that materially affects how we use your information takes effect, we’ll email the owners of every organization. Our terms of service explain how changes to the terms work.

13Contact us

Questions about this policy or your information:

14US state privacy disclosures

Some US state laws ask for this summary of the categories of personal information we’ve collected in the last 12 months. The sources, purposes and recipients are described above.