Privacy Policy

Devino operates Notifly, a hosted platform that lets engineering teams send product notifications — email, SMS, push, in-app, and chat — through a single API. Questions about this policy or your data can be sent to support@notifly.io.

Some data-protection laws (such as the EU GDPR) distinguish between a controller, who decides why and how personal data is processed, and a processor, who processes it on a controller's instructions. For our own websites and accounts we act as a controller. For the personal data your recipients generate when you route notifications through Notifly, we act as a processor on your behalf — see “Data we handle on your behalf” below.

• Services — the Notifly websites (notifly.io), the managed cloud, and the hosted platform at app.notifly.io.
• Personal data — any information that identifies you directly or indirectly, including identifiers such as IP addresses or cookie IDs.
• You — a visitor to our sites or a user of our Services.
• Customer — an account holder who uses Notifly to send notifications.
• End recipient — a subscriber or contact of a Customer who receives notifications sent through Notifly.

Where the GDPR or similar laws apply, we only process personal data when we have a lawful basis to do so. Depending on the situation, that basis is one of: your consent; the performance of a contract with you; compliance with a legal obligation; or our legitimate interests in operating, securing, and improving the Services, where those interests are not overridden by your rights.

When you use Notifly to deliver notifications, we process personal data about your end recipients strictly on your instructions and only to provide the Services. Depending on how you configure your workflows, this can include a recipient's name, email address, phone number, device or push tokens, locale, IP address, and the content and metadata of the messages you route to them.

For this data you are the controller and we are the processor — we do not use it for our own purposes. If you are an end recipient and want to exercise your rights, please contact the Customer that sent you the notification, since they control that data. Our handling of it is governed by our data processing terms.

When you interact with our own websites and accounts, we collect:

• Contact and newsletter details — if you message us through a form or subscribe to updates, we collect what you provide, such as your name, company, email, and the contents of your message.
• Account and registration data — to use the platform you create an account and provide at least your name and email. If you sign up through a third-party identity provider (for example GitHub or Google), we receive basic profile information from them, such as your email, name, username, and avatar.
• Billing information — for paid plans, payment is handled by our payment processor; we receive limited billing details (such as plan, status, and the last four digits of a card), not full card numbers.
• Where you came from (first-touch source) — when you create an account we record how you first reached us, such as the campaign tags on the link you followed, the website that referred you, or an ad click identifier. We store it on your account record, once, to understand which channels bring people to Notifly. See “Cookies” below.
• Usage and device data (cookies) — when you visit our sites or use the platform we automatically collect technical data such as your IP address, device and browser type, referring pages, and the actions you take. See “Cookies” below.
• Support communications — records of your correspondence with our support team.

If you add the Notifly app to a Slack workspace and connect it to your Notifly organization, we store:

• the workspace's Slack ID and name, and the Slack ID of the app's bot user;
• the bot access token Slack issues for the workspace, encrypted at rest. Our API and dashboard never show it in full;
• the Slack user ID of the person who approved the installation;
• the Slack channel IDs you choose as destinations for your notifications.

We use this data only to deliver the notifications you configure in Notifly to that workspace. The app can only post messages: we do not read your Slack messages, channels or members, and we do not use Slack data to train machine-learning or AI models.

When it is deleted.

• When the app is removed from your workspace, or Slack revokes its token, Slack notifies us and we delete the stored connection, its token, and the Slack user and channel IDs saved for that workspace, in every Notifly organization that connected it.
• Removing the Notifly Slack integration in the dashboard, or deleting your Notifly organization, deletes them too.
• An installation that is approved in Slack but never connected to a Notifly organization is held, encrypted, for at most 15 minutes and then discarded.
• Your organization's audit log keeps a record that the workspace was connected (its Slack ID and name) for up to two years, or until the organization is deleted.
• Records of the notifications you send to Slack, including their content and the Slack channel or user IDs they were sent to, are kept for the same period as the rest of your notification activity (see “Data retention” below). Removing the app does not delete these records.

To request access to, a copy of, or deletion of this data, including under the GDPR or the CCPA, email support@notifly.io.

• Provide, operate, and maintain the Services, and authenticate your account.
• Process transactions and manage subscriptions.
• Respond to your requests and provide support.
• Monitor, secure, and improve the Services and develop new features, including by generating aggregate analytics.
• Detect, prevent, and address fraud, abuse, and security incidents.
• Send you service and administrative messages — these are not marketing, and you can't opt out of them while you hold an account.
• With your consent or as otherwise permitted, send you newsletters and product updates.
• Comply with legal obligations and enforce our agreements.

We keep marketing to a reasonable level. You can stop marketing emails at any time using the “unsubscribe” link in any message, or by emailing support@notifly.io. Account, billing, and other service-related messages are part of the Services and will continue regardless of your marketing choices.

We do not sell your personal data. We share it only as described here:

• Within a Customer's account — if you use Notifly under an organization, administrators of that organization can see activity associated with your use.
• Service providers (subprocessors) — vendors that process data on our behalf under confidentiality and data-protection terms, including cloud hosting and storage; delivery providers for email, SMS, and push; payment processing; error monitoring and logging; product analytics; and customer-support tooling. A current list of subprocessors is available on request.
• Business transfers — if we are involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction and remains subject to this policy.
• Legal and safety — where we believe it is necessary to comply with law or legal process, enforce our terms, or protect the rights, property, or safety of Notifly, our users, or others.

We and our service providers may process personal data in countries other than your own. Where we transfer personal data across borders — for example out of the EEA or the UK — we put appropriate safeguards in place, such as the European Commission's Standard Contractual Clauses or reliance on an adequacy decision, so that your data keeps an equivalent level of protection. Contact us for details of the safeguards we use.

Protecting your data is a priority. We use technical and organizational measures — including encryption in transit, access controls, and monitoring — to guard against unauthorized access, loss, or misuse. No system can be guaranteed perfectly secure, and the safety of your account also depends on you keeping your credentials confidential.

We keep personal data only as long as needed for the purposes described here, after which we delete or anonymize it. How long that is depends on the nature and sensitivity of the data, why we collected it, and our legal obligations. Subprocessors may retain data under their own policies. Email support@notifly.io for details on specific retention periods.

Depending on where you live, you may have some or all of the rights below. We may need to verify your identity before acting on a request.

• Access — ask what personal data we hold about you.
• Correction — ask us to fix inaccurate or incomplete data.
• Deletion — ask us to erase your data (we may keep what we're legally required to).
• Restriction and objection — ask us to limit or stop certain processing.
• Portability — receive a copy of the data you provided in a portable format.
• Withdraw consent — where we rely on consent, withdraw it at any time without affecting prior processing.
• Complain — lodge a complaint with your local data-protection authority (we'd appreciate the chance to resolve it first).

To exercise any of these, email support@notifly.io. If the data is held on behalf of a Customer, please contact that Customer directly.

Cookies are small text files (and similar technologies like pixels and device identifiers) that help our sites work and help us understand usage. We use:

• Necessary cookies that make the site function and can't be switched off.
• Functional cookies that remember your preferences.
• Security cookies that help protect your session and detect abuse.
• Analytics cookies that tell us how the site is used so we can improve it.

First-touch cookie. The first time you arrive from an outside link, campaign or ad, our websites set one first-party cookie named `nf_ft` on the notifly.io domain, so notifly.io and app.notifly.io can share it. It lasts 90 days, is sent over HTTPS only, and is never overwritten once it holds a record. It contains only: campaign tags from the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content, and a ref code), ad click identifiers (such as gclid or fbclid), the domain — not the full address — of the website that referred you, the first page you landed on with identifiers and tokens removed from its path, and the time it was recorded. Our pages also keep a copy of the same record in your browser's local storage, and both the cookie and that copy can be read by our own pages' scripts. When you create an account, our servers read it once to record your first-touch source on your account (see above); it is not used to track you across other websites.

Product analytics through our own domain. We run our own PostHog instance for product analytics. Your browser reaches it through a path on our own domains (notifly.io and app.notifly.io) rather than a separate analytics host. We relay only the analytics requests, and your cookies for our sites are not passed on to the analytics server.

Session recordings. To find and fix problems, we record a sample of visits to notifly.io and app.notifly.io with two tools we host ourselves: PostHog records about 10% of sessions, and our Sentry error monitoring records about 10% of sessions plus sessions in which it reports an error to us. A recording captures the layout of each page and what you do on it, such as clicks, scrolling, mouse movement and the pages you visit, along with technical details such as errors and how long pages and requests take to load. The recordings also include messages from your browser's developer console and the addresses of the requests your browser makes, but not the contents of those requests or their responses. The text shown on the page and everything you type into form fields are masked in your browser before anything is sent, so a recording does not show what you type. Sentry also masks placeholder text, titles and accessibility labels, and blocks images, video and other media. PostHog recordings travel through the same path on our own domains described above; Sentry recordings go straight to our own Sentry server.

Some analytics cookies are set by third parties such as our web-analytics provider (Google Analytics on notifly.io). Most browsers let you refuse or delete cookies; if you do, some features may not work properly.

The Services may link to or integrate with third-party products. Your use of those is at your own risk and subject to their own terms and privacy policies — we're not responsible for how they operate.

Notifly is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data without appropriate consent, contact us and we'll remove it.

We may update this policy to reflect changes in law or how we operate. We'll post the new version here and update the date above; significant changes may be highlighted. Please check back from time to time.

Questions or requests about this policy or your personal data? Email support@notifly.io and we'll be glad to help.