Skip to content
Sopable
Book a demo

Legal

Privacy policy

Not published yet — this page is a drafting outline

Sopable handles employee personal data on behalf of its customers, and this site collects contact details through the demo form. A SaaS site doing either without a published privacy policy is a legal exposure, not a design gap. This page must be replaced with text reviewed by BYXL Software LLC’s legal counsel before the site goes live. The outline below lists what the document needs to cover.

What the document needs to cover

  • Identity and contact details of the data controller (BYXL Software LLC) and a privacy contact address
  • What personal data the website collects: demo-form fields (name, company, work email, phone, team size, trade), roadmap notification emails, analytics identifiers
  • What personal data the product processes on customers' behalf: employee names, work emails, designations, photos, reporting lines, acknowledgment and signature records, quiz attempts and scores
  • The lawful basis for each processing purpose
  • How long each category of data is retained, including what happens to a deactivated employee's compliance history and to a trial account's data if it does not convert
  • Sub-processors and third-party services: hosting provider and region, email delivery (Amazon SES), analytics, any AI/model provider used for quiz generation
  • Whether any personal data leaves its region of origin, and on what transfer mechanism
  • Data subject rights and how to exercise them, for both Indian and US customers
  • Security measures, described specifically rather than as “enterprise-grade”
  • Cookie and analytics disclosure, matched to whatever is actually installed
  • How changes to the policy are communicated, and an effective date

Facts that must be confirmed before drafting

  • Hosting provider and region for application data and backups
  • Encryption at rest and in transit — what is used, and for what
  • Backup frequency, retention and tested recovery procedure
  • Complete sub-processor list, including the AI provider behind quiz generation and what document text is sent to it
  • Whether customer document text is used for any purpose beyond serving that customer
  • Data residency answer for Indian and US customers
  • Whether a data export capability exists (unconfirmed — see PLACEHOLDERS.md)
  • Any certification held or in progress (SOC 2, ISO 27001), stated honestly either way