| title | sidebar_position |
|---|---|
Privacy Policy |
9 |
This Privacy Policy explains our practices regarding the collection, use and disclosure of the information we process to provide our Services. This Privacy Policy does not apply to any third-party websites, services or applications, even if they are accessible through our Services.
When we refer to "Retool" ("we", "our" or "us"), we mean the Retool entity that acts as the controller or processor of your information, Retool, Inc. Please refer to the section titled 'Identity of the Data Controller and Data Processor' for more information.
This Privacy Policy applies to: Retool's developer tools and platform that enable Customers and their Authorized Users to build, deploy and use Custom Apps (individually and collectively, the "Services"); Retool.com (the "Website"); and other interactions you may have with Retool.
In this Privacy Policy, "you" and "your" refer to the person or entity visiting our Website or using our Services. If you are a purchaser of our Services, you are a "Customer". If you are authorized by a Customer to use our Services, you are an "Authorized User". Where Retool collects information that is associated with an identified or identifiable individual and is protected as personal data under applicable data protection law, it is referred to as "Personal Data". Personal Data that is de-identified or aggregated to the extent that it is no longer reasonably associated with an identified or identifiable natural person may be used by Retool for any purpose.
Customers can create an application, workflow or process that is customized, programmed or developed using the Services ("Custom App"). Databases, applications and software products also interoperate with the Services which are provided by a Customer or a third-party, and not Retool ("Non-Retool Products").
This Privacy Policy does not apply to any Non-Retool Products or any third-party websites, services or applications, even if they are accessible through our Services, ("Third-Party Services") which are provided under their own terms of service and privacy policy. A separate master subscription agreement may govern the provision, access and use of the Services (the "Subscription Agreement"), including the processing of electronic data or content that an Authorized User submits to a Custom App ("Customer Data") but excluding Non-Retool Products and the Services. The Customer (e.g., your employer or another entity or person) that entered into the agreement with Retool controls its instance of the Services and any associated Customer Data. If you have any questions about specific settings and privacy practices, please contact the Customer whose Service you use.
*California Notice of Collection of Personal Information: We collect the information described below under "Information Retool Collects and Receives" for the business and commercial purposes described below under "Information Use." To learn more about exercising your California Privacy Rights please review the "California Privacy Rights" section below.
Certain jurisdictions distinguish between a "controller" or "processor" of Personal Data. A controller is the decision-maker and exercises overall control over how and why Personal Data is collected and used. In general, the Customer is the controller of Customer Data. A processor acts on behalf of, and only on the instructions of, the relevant controller. In general, Retool is the processor of Customer Data and the controller of Other Information (which is described in the 'Information Retool Collects and Receives' section below).
Retool Inc., a US company based in San Francisco, California is the controller of Other Information and a processor of Customer Data.
Retool collects and receives the following information through the Services, Website and your other interactions with Retool. This information includes Customer Data and other information and data ("Other Information"):
- Customer Data. Customers or Authorized Users submit Customer Data to Retool when they use the Services.
- Other Information. Retool also collects, generates and/or receives the following categories of Other Information:
- Service Information. We may collect information you post to, or collect from, Authorized Users of the Services. We use this information to operate, maintain, and provide to you the features and functionality of the Services. For example:
- Account Information: To help us deliver the Services, you or our Customer (e.g. your employer) may supply Retool with an email address, username, first and last name, your company's name, your (and/or your company's) physical address and other account set up details. Customers that subscribe to the Services provide Retool (or its third-party payment processors) with billing details such as payment information and a billing address. You can also choose to provide us with additional information through our Services, for example, your birthdate and/or phone number.
- Profile and Organizational Information: When your Retool account is active, you or your organization may provide information during the operation of your account, such as roles and permissions of particular Authorized Users, such as "administrators," "builders" or "end users."
- Usage Information: We may also collect and aggregate information about the use of our Website and our Services. That information includes:
- Device Information: browser and device data, device type, screen resolution, browser type, operating system name and version, language, as well as add-ons for your browser.
- Log Information: including your IP address, the pages visited and links clicked on our Website, the time spent on those pages, and the page that was visited before our Website.
- Services Metadata: When a Customer or an Authorized User interacts with the Services, metadata is generated that provides additional context about the way that Customer and Authorized User configures and uses the Services. For example, Retool logs page views (including page URL), query saves (including the name and type), component creation and the type, query preview (including name and type), and connections to Third Party Services (including name and type).
- Location Information: We receive information from you, our Customer and other third parties that helps us approximate your location. We may, for example, use a business address submitted by your employer (who is our Customer) or an IP address received from your browser or device to determine approximate location. Retool will also collect location information from your device in accordance with the consent process provided by your device.
- Cookie Information: We may also permit third-party online advertising networks to collect information (through cookies or similar tracking technologies) about your and others' use of our Services and any of your mobile or web applications, in order to allow those third-party networks to display ads that may be relevant to your interests on our Services as well as on other websites or apps.
- Third-Party Services: A Customer can choose to permit or restrict Third Party Services for its instance of the Services and Custom Apps. Typically, Third Party Services are databases, APIs, software or applications that integrate with our Services, and a Customer can permit its Authorized Users to enable and disable these integrations for its Custom Apps. Authorized Users should check the privacy settings and notices in these Third-Party Services to understand what data may be disclosed to Retool. When a Third-Party Service is enabled, Retool is authorized to connect and access Other Information made available to Retool in accordance with our agreement with the Third-Party Service and any permission(s) granted by our Customer (including, by its Authorized User(s)). Examples of information which Retool may receive in this manner include whether you successfully subscribed for a new account or license for a third-party application in a way that is attributable to Retool usage activity. We do not, however, receive or store passwords for any of these Third-Party Services when connecting them to the Services.
- Contact Information: In accordance with the consent process provided by your device or other third-party API, any contact information that an Authorized User chooses to import (such as an address book or calendar from a device or API) is collected when using the Services.
- Third-Party Data: Retool may receive data about organizations, industries, lists of companies that are Customers, Website visitors, marketing campaigns and other matters related to our business from parent corporation(s), affiliates and subsidiaries, our partners, or others that we use to make our own information better or more useful. This data may be combined with Other Information we collect and might include aggregate-level data, such as which IP addresses correspond to zip codes or countries. Or it might be more specific: for example, how well an online marketing or email campaign performed.
- Additional Information Provided to Retool: We also receive Other Information when submitted to our Websites or in other ways, such as responses or opinions you provide if you participate in a focus group, contest, activity or event, information you provide if you apply for a job with Retool, enroll in a certification program or other educational program hosted by Retool or a vendor, request support, interact with our social media accounts or otherwise communicate with Retool.
- Service Information. We may collect information you post to, or collect from, Authorized Users of the Services. We use this information to operate, maintain, and provide to you the features and functionality of the Services. For example:
In general, you are not subject to a statutory or contractual obligation to provide Customer Data or Other Information (together, "Information"). However, various Other Information is collected automatically and, if you do not provide certain information (such as account setup details), we may be unable to provide the Services.
Customer Data will be used by Retool in accordance with Customer's instructions, including any applicable terms in the Customer Terms of Service ("Terms"), Subscription Agreement, or DPA, and as required by applicable law. As explained above, in general, Retool is a processor of Customer Data and the Customer is the controller. The Customer may, for example, use the Services to provision or deprovision access to the Custom App, enable or disable Third Party Services, manage permissions and otherwise apply its policies to the Services.
Retool uses Other Information to operate our Services, Website and business for the following purposes:
| Why And How We Process Your Information | Information Categories Used |
|---|---|
| The actual information used depends on the specific legal obligation, but could include any of the following: | |
| To comply with a legal obligation We may access, preserve or disclose certain information if there is a valid legal request from a regulator, law enforcement or others. For example, a search warrant or production order from law enforcement to provide information in relation to an investigation, such as your profile picture or IP address. |
|
We rely on our legitimate interests or the legitimate interests of a third-party where they are not outweighed by your interests or fundamental rights and freedoms ("legitimate interests").
| Why And How We Process Your Information | Legitimate Interests Relied On | Information Categories Used |
|---|---|---|
| To operate, maintain, and provide to you the features and functionality of the Services. This includes use of Other Information to support delivery of the Services under a Subscription Agreement, prevent or address service errors, security or technical issues, analyze and monitor usage, trends and other activities, or at an Authorized User's request. | In our and your interests to provide, update, maintain and protect our Services, Website and business. |
|
| To improve our Website and our Services. We continually strive to improve our site and product offerings based on the information and feedback we receive from you. If you contact us, we may use your Other Information to respond. | It is in our interest and in the interest of Customers and Authorized Users to continuously improve and develop the products and customer support we provide. |
|
| To improve customer service. Your Information helps us to more effectively respond to your customer service requests and support needs. If you contact us, we may use your Other Information to respond. | It is in our interest and in the interest of Customers and Authorized Users to continuously improve and develop the customer support we provide. |
|
| To send periodic emails. For example, we may use the email address you provide to send you information, send notifications that you request about changes to our Services, alert you of updates, and send periodic emails containing information relevant to your account. | In our Customers and Authorized Users' interests to address service-related issues. |
|
| To send you email marketing. We sometimes send emails about Retool products and services, invite you to participate in events or surveys, or otherwise communicate with you for marketing purposes. You can control whether you receive these messages and we allow you to opt-out from receiving marketing communications from us as described in the 'Your Rights' section below. | In our interest to promote the Website and Services and send our direct marketing. |
|
| To enable you to purchase, renew and appropriately use a commercial license to our Services. If you purchase our Services, we may need to contact you for invoicing, account management, and similar reasons. We use account data to administer accounts and keep track of billing and payments. | In our interest to facilitate the effective provision and administration of the Website and Services. |
|
To compile statistics and analysis about use of our Website and our Services. Retool tries to make the Services as useful as possible. For example, we may:
|
||
| To personalize your experience. | It is in our interest and in the interest of Customers and Authorized Users to personalize the Services and Website support we provide. |
|
| To investigate and help prevent security issues and abuse. We may use a variety of tools such as email, device and IP address login information to prevent issues and abuse. We may use Other Information to better understand how Retool is used or to prevent abuse. | In our interest to keep the Service secure and to detect, prevent, and address abuse (such as spam) and to investigate and take action in respect of suspicious activity on the Services. |
|
| To anonymize information. In some cases, we anonymize Personal Data that was associated with you. We may use, publicize or share the resulting information, such as to improve our Services and for our other legitimate business purposes. | In our interest to research and improve the Services; In the interests of Customers and Authorized Users to practice data minimization and privacy by design in respect of their information. |
|
We may also use your Information where necessary for us to comply with a legal obligation, including to share information with government and regulatory authorities when required by law or in response to legal process, obligation, or request. We cooperate with government and law enforcement officials or private parties to enforce and comply with the law. We may disclose your Information to government or law enforcement officials or private parties as we believe necessary or appropriate to, for example:
|
In our interest and the interest of the general public to prevent and address fraud, unauthorized use of the Services or Website, violations of our terms or other harmful or illegal activity; to protect ourselves, our users or others, including as part of investigations or regulatory enquiries; or to prevent death or imminent bodily harm. |
|
| Transfer, store or process your information outside the European Economic Area, the UK and Switzerland As the Website and Services operate globally, with Customers around the world, we need to share information we collect globally. We carry out necessary transfers outside the European Economic Area, the UK and Switzerland, including to the United States, to provide, update, maintain and protect our Services, Website and business. For more information, see 'International Data Transfers' below. |
|
Where required by law, we will seek your consent before we use or disclose your Information for a materially different purpose than those set forth in this Privacy Policy.
This section sets out how Retool may share and/or disclose the Information described under 'Information Retool Collects and Receives' above. Except as set out below, we do not sell, trade, or otherwise transfer to outside parties your Information. Designated members of our staff may access your Information to help our customers with any questions they have, including help using our Services, investigating security issues, or following up on bug fixes with a Customer. This activity is logged in our system for compliance, and we maintain different levels of access for its employees depending on their role in our company. The policies and practices for sharing and/or disclosure of Customer Data to third parties is determined by the Customer. Retool has no control over the Customer's or any other third parties' choice to share and/or disclose Information.
- Customer's Instructions. Retool may share and disclose Information in accordance with a Customer's instructions and with appropriate consent, including any applicable terms in the Terms, Subscription Agreement, DPA and the Customer's use of Services functionality and in compliance with applicable law and legal process. Some sharing at a Customer's request may incur additional fees.
- To enable Retool to follow our Customer's instructions, we provide several administrator controls to allow Customers to manage their accounts. Some examples are:
- We follow Customer's instructions to allow Authorized Users to use various features, such as connecting a Custom App to a Third Party Service or publishing a Custom App to other Authorized Users.
- We also follow Customer and Authorized User instructions on how a user's profile may be displayed.
- Customers may also provide their Authorized Users with the ability to edit, delete or use Custom Apps and any associated Customer Data.
- To enable Retool to follow our Customer's instructions, we provide several administrator controls to allow Customers to manage their accounts. Some examples are:
- Displaying the Services. When an Authorized User submits Information to the Services or a Custom App, it may be displayed or discoverable to other Authorized Users in the same account or Custom App. For example, an Authorized User's email address may be displayed with their profile.
- Collaborating with Others. The Services provide different ways for Authorized Users working in independent Custom Apps to collaborate. Information, such as an Authorized User's profile and organizational information, may be shared, subject to the policies and practices of the Custom Apps you use. For example, to enable connecting, an Authorized User's profile may be shared. In many instances Retool either includes administrator controls or individual controls, depending on the use case. Authorized Users may also decide to expand the visibility of certain content.
- Customer Access. Authorized Users and other Customer representatives and personnel may be able to access, modify, or restrict access to Information. This may include, for example, your employer using Service features to export logs of Custom App activity, or accessing or modifying your profile details.
- Public Sharing or Embedding: If you enable a public sharing or embedding of your Retool applications, any information or content that you voluntarily disclose in your application may become available to the public. If you remove information that you posted to the Services, copies may remain viewable in cached and archived pages of the Service, or if other users of the Services have copied or saved that information.
- Third-Party Service Providers and Partners. We may disclose your Information to third-party service providers (for example, payment processing and data storage and processing facilities) that we use to provide the Services. We limit the Information provided to these service providers to that which is reasonably necessary for them to perform their functions, and we require them to agree to maintain the confidentiality of such Information.
- We may contract with third-party service providers to assist us in better understanding our Website visitors. These service providers are not permitted to use the information collected on our behalf except to help us conduct and improve our business.
- Third-Party Services. Customer may enable or permit Authorized Users to authenticate and enable Third-Party Services. We require each Third-Party Service to disclose all permissions for information access in the Services, but we do not guarantee that they do so. When enabled, Retool may share Information with Third-Party Services. Third-Party Services are not owned or controlled by Retool and third parties that have been granted access to Information may have their own policies and practices for its collection, use, and sharing. Retool may also receive payment from third-party services for licenses and subscriptions attributable to Retool usage activity. Please check the permissions, privacy settings, and notices for these Third-Party Services or contact the provider for any questions.
- Forums. The information you choose to provide in a community forum including personal data will be publicly available.
- Organizers and sponsors of Events/Webinars. If you attend an Event or Webinar organized by Retool we may share your Profile and organizational information with the Event or Webinar sponsors when you register, have your badge scanned, or join a breakout room. Please refer to the terms provided when you register for additional information.
- Corporate Affiliates. We may share Information with other companies owned by or under common ownership as Retool, which also includes our subsidiaries (i.e., any organization we own or control). These companies will use your Personal Data in the same way as we describe under this Privacy Policy, unless otherwise specified.
- During a Change to Retool's Business: In the event that we enter into, or intend to enter into, a transaction that alters the structure of our business, such as a merger, acquisition, reorganization, joint venture, assignment, sale of some or all of Retool's stock or assets, public offering of securities, financing, change of ownership, bankruptcy or dissolution or any actions taken in contemplation of such activities we may share or transfer Information for the purpose of facilitating and completing the transaction.
- Aggregated or De-identified Data. We may disclose or use aggregated or deidentified Information for any purpose. For example, we may share aggregated or deidentified Information with prospects or partners for business or research.
- Law Enforcement, Regulators and to Enforce our Rights, Prevent Fraud, and for Safety: We may release your Information when we believe it is appropriate to comply with the law, comply with or respond to a valid legal request, enforce our Site policies or our Terms, protect our or others' rights, property, or safety, or to respond to or address any other activity that may expose us, you, or any other of our Authorized Users or Customers to legal or regulatory liability. In particular, we may release your Information to third parties as required to (i) satisfy any applicable law, regulation, subpoena/court order, legal process or other government request, (ii) enforce our Terms, including the investigation of potential violations thereof, (iii) investigate and defend ourselves against any third party claims or allegations, (iv) protect against harm to the rights, property or safety of Retool, its users or the public as required or permitted by law and (v) detect, prevent or otherwise address criminal (including fraud or stalking), security or technical issues.
- With Consent. Retool may share Information with third parties when we have consent to do so. For Services registered to corporate entities, Retool may share Information with consent of the Customer or authorized corporate officer.
Your Personal Data may be transferred by Retool internationally. In line with Retool's obligations, where Personal Data is transferred to countries other than the one in which you reside, Retool will ensure compliance with the requirements of the relevant laws in the respective jurisdiction.
The following safeguards are applied where Retool transfers Personal Data between jurisdictions with different data protection laws:
- European Commission Standard Contractual Clauses. Retool uses the Standard Contractual Clauses ("SCCs") approved by the European Commission (and where appropriate the equivalent UK SCCs) to facilitate the provision of the Services for transfers of Personal Data to the United States. A copy of our data processing addendum which incorporates the SCCs, is available here.
Retool retains Customer Data in line with the Customer's instructions (including through use of the Services, the performance of any applicable terms in the Subscription Agreement and DPA), and as required by applicable law.
Depending on the Services, Customer may be able to customize its retention settings and apply those customized settings at the Custom App level or other level. The Customer may also apply different settings to Customer Data. The deletion of Customer Data and other use of the Services by the Customer may result in the deletion and/or de-identification of certain associated Other Information. For more detail, please review Retool's Security Practices Page or contact the Customer.
Other Information relating to you is retained by Retool for as long as reasonably necessary for the purposes described in this Privacy Policy (see the 'How We Process your Information and our Legal Bases for Doing So' section above). We may need to retain your Other Information for a period of time after you or your administrator has deactivated your account to pursue our legitimate business interests, comply and demonstrate compliance with relevant legal obligations, resolve disputes, conduct audits and enforce our agreements with the Customer or third parties. Retool retains data in accordance with records retention obligations and limitation periods that are imposed by applicable law.
For example, Retool will retain:
- Service Information for as long as you use the Services.
- Other Information for legal reasons where applicable (e.g. comply with applicable law when we have a legal obligation to retain information or to respond to a legal request).
Individuals in various jurisdictions, including the European Economic Area, the United Kingdom and Brazil, have legal rights in relation to their personal data. You may have the right to request access to your personal information and/or to request that this information is updated, corrected or deleted. You can do this by emailing [email protected].
Retool primarily relies on its legitimate interests, described in the "How We Process your Information and our Legal Bases for Doing So" section above, to process your Personal Data in the European Economic Area, UK and Brazil. You have a right to object to processing of your Personal Data where we rely on legitimate interests. You can exercise this right by emailing [email protected]. In the event that you submit an objection, we will cease processing your information for the relevant purposes unless we have compelling grounds to continue the processing or it is necessary for legal claims. Retool may also process Other Information that constitutes your Personal Data for direct marketing purposes. You have a right to object to Retool's use of your Personal Data for direct marketing purposes at any time by emailing [email protected].
You also have the right, subject to any applicable laws, to lodge a complaint with your local data protection authority. For a list of authorities in the European Economic Area, click here. Residents of the United Kingdom may direct queries or complaints to the UK data protection supervisory authority, the Information Commissioner's Office, if they believe Retool maintains their Personal Data in scope of the applicable laws which relate to personal data in the United Kingdom.
This section provides additional details about the personal information we collect about California consumers and the rights afforded to them under the California Consumer Privacy Act or "CCPA," as amended by the California Privacy Rights Act or "CPRA".
California law requires that we detail the categories of personal information that we collect and disclose for certain "business purposes," such as to service providers that assist us with securing our services or marketing our products, and to such other entities as described in earlier sections of Privacy Policy. In addition to the information provided above in the 'Information Retool Collects And Receives' section, we collect the following categories of personal information from you, your employer, data analytics providers, data brokers, and Third-Party Services for our business purposes:
- Identifiers/contact information;
- Commercial information;
- Internet or electronic network activity information;
- Financial information;
- Geolocation information;
- Professional or employment-related information;
- In limited circumstances where allowed by law, information that may be protected under California or United States law; and
- Inferences drawn from any of the above categories.
We collect this information for the business and commercial purposes described in the 'How We Process your Information and our Legal Bases (under GDPR) for Doing So'' section above. We share this information as described in the 'How We Share and Disclose Information' section above. Retool does not sell (as such term is defined in the CCPA or otherwise) the personal information we collect (and will not sell it without providing a right to opt out). We may also share personal information (in the form of identifiers and internet activity information) with third party advertisers for purposes of targeting advertisements on non-Retool websites, applications, and services. In addition, we may allow third parties to collect personal information from our sites or services if those third parties are authorized service providers who have agreed to our contractual limitations as to their retention, use, and disclosure of such personal information, or if you use our sites or services to interact with third parties or direct us to disclose your personal information to third parties.
Subject to certain limitations, the CCPA provides California consumers the right to request to know more details about the categories or specific pieces of personal information we collect (including how we use, disclose, or may sell this information), to delete their personal information, to opt out of any "sales", to know and opt out of sharing of personal information for delivering advertisements on non-Retool websites, and to not be discriminated against for exercising these rights.
California consumers may make a request pursuant to their rights under the CCPA by contacting us at [email protected] or by filling out this form. We will verify your request using the information associated with your account, including email address. Government identification may be required. Consumers can also designate an authorized agent to exercise these rights on their behalf. Authorized agents must submit proof of authorization.
Retool takes security seriously. Our data centers have round-the-clock security, fully redundant power systems, two-factor authentication, and physical audit logs. Protecting Customer Data is a top priority for Retool. As a matter of principle, Retool takes a minimalist approach to any storing or processing of Customer Data. For example, for self-hosted versions of Retool that are configured with non-Retool databases, no Retool systems store Customer Data and no Retool personnel have technical or logical access to any Customer Data. For cloud-based software-as-a-service versions of Retool that are configured with non-Retool databases, Retool does not store any Customer Data unless your company enables a caching feature to improve functionality; even in those cases, Customer Data is only temporarily cached by Retool for the duration your company specifies and can be disabled or invalidated by your company at any time. For further information on the administrative, physical, and technical safeguards for the security, confidentiality and integrity of your information please see Retool's Security Practices Page.
Retool is unable to guarantee that Information stored on our systems or otherwise in our care during transmission through the internet will be absolutely safe from intrusion by bad actors given the nature of communications and information processing technology. We do not and cannot control or endorse what is on third-party sites that may be linked to our Service or Website.
These Services are not directed to individuals under the age of 18, and we kindly request they not provide any Information through the Services. Please contact us if you become aware that anyone younger than 18 has provided us with Personal Data and we will take steps to delete such information.
Our Data Protection Officer can be contacted at [email protected].
You can contact Retool directly at [email protected] or at our mailing address below if you are seeking to exercise any of your statutory rights or if you have any questions or concerns about Retool's practices or this Privacy Policy. We will respond within a reasonable timeframe. If you would like to submit a data subject rights request, please email [email protected].
If you have any other questions, comments, or concerns about this privacy policy, please contact us using the following contact information:
- Retool Inc.
- 1550 Bryant Street
- San Francisco
- CA 94103
- [email protected]
Retool may make occasional changes to this Privacy Policy. If we decide to change our Privacy Policy, we will post those changes on this page. If we are going to use Personal Data collected through the Site in a manner materially different from that stated at the time of collection, then we will notify users via email and/or by posting a notice on our Site for 30 days prior to such use or by other means as required by law. Please work with your administrator to deactivate your account if you disagree with any change to this Privacy Policy. To request the erasure of your Personal Data, please contact the Customer that authorized your access to the Services as they control this information.