Privacy policy

In effect from October 1, 2026.

Associates is a business management platform made and run by Elemental Softworks. This policy says what Associates keeps about the people who use it, and about the people whose details its customers put into it, how long it keeps it, and what happens to it.

What we keep

Your user. Your name and email address, and a phone number if you add one. Your password is never stored, only a one-way hash of it. If you sign in with Google, we keep your Google account’s identifier, the email address Google gives us, and the address of your Google profile picture. We also keep which version of our terms you accepted, and when.
Your sign-ins. For each session, the IP address and browser it started from, so you and your organisation can see where you are signed in and end a session. When a sign-in is refused, we keep the reason and the IP address, never the password typed.
Account activity. Each organisation’s account keeps a log its Owners can read: sign-ins and sign-outs, password and email address changes, sessions ended, invitations sent, resent, cancelled, expired and accepted, people joining, leaving and being removed, changes to roles and permissions, changes to the account’s settings and plan, website keys, requests to delete the account, and support sessions. Each entry says who did it, when, and from which IP address. Some entries name an email address, such as the address an invitation was sent to. Leads and shifts also keep a history of who changed them.
Billing. For an organisation that pays for a plan, what it has bought, how often it pays, and the Stripe customer and subscription that bill it. Its billing name, email address and address, its payment details and any tax ID it gives are held by Stripe, not by us.
What your organisation puts in. Its member roster (names, contact details, addresses, photos and uploaded files), schedules, qualifications, calendar events and leads. Your organisation decides what goes in and who in it can see it.

Contact forms on our customers’ websites

Some organisations that use Associates have websites whose contact forms file into it. If you send one of those forms, what you enter (usually your name, email address, phone number and message) is stored in that organisation’s account and emailed to it. That organisation decides what to do with your enquiry, and questions about it are best put to them.

How we use it

To run the service: signing you in, showing your organisation its own information, and keeping each organisation’s information apart from every other’s.
To keep accounts safe, for example by slowing repeated sign-in attempts and locking a user out for a short while after too many wrong passwords.
To send the email the service depends on: invitations, password resets, address verification and changes, notices about your account, and notifications of new leads.
To help when you ask us to. Our support staff can open an organisation’s account only through a support session that runs for a limited time and is recorded in the account’s activity log, where its Owners can see it, together with every change made in it.

We do not sell personal information, and we do not use it for advertising.

Who else handles it

DigitalOcean runs the servers and the database Associates is stored in.
Mailgun delivers the email described above.
Stripe takes payments for organisations that pay for a plan, works out the sales tax on them, and keeps the billing details described above. Card details go to Stripe, never to us.
Google, only if you choose to sign in with a Google account.
Sentry receives a report when something in Associates fails, so that we can fix it. A report can include the address of the page and details of the request that failed.

Cookies

This website’s public pages set no cookies. Signing in sets these, all of which the dashboard needs to work:

associates.session proves you are signed in. It lasts fifteen minutes.
associates.refresh keeps you signed in: up to 30 days after you were last active, and never more than 90 days after you signed in.
associates.account remembers which of your organisations you were working in.
sidebar:state remembers whether you left the menu open, for a week.

How long we keep it

A session ends 30 days after you were last active, and never lasts more than 90 days. An ended session’s record is deleted 30 days later.
A password reset link works for an hour, an email change link for an hour, and a verification link for a day. Each is deleted a day after it was used or ran out.
A refused sign-in is kept for 30 days.
Account activity is kept for a year, then deleted.
An email waiting to be sent is kept, with its recipient and its text, for up to a day.
When an organisation’s account is deleted, it is read-only for 14 days, so that the deletion can be cancelled, and then everything in it is deleted.
When you delete your user, your name, email address, phone number, password and Google links are removed straight away, and you are taken out of every account. Organisations’ records of what you did stay, naming a “former user”, except where an entry itself names an email address, such as an invitation that was sent to you.
Everything else is kept while the account it belongs to is in use, or until you or your organisation remove it.

Your choices

From your profile, you can change your name, phone number, password and email address, see and end your sessions, leave an organisation’s account, and delete your user.
An Owner of an organisation’s account can delete it from the account’s settings.
To ask for a copy of your information, or for it to be corrected or deleted, contact [email protected], or by post to Elemental Softworks, 421 College Park Drive, Monroeville, PA 15146. Information your organisation holds about you is also theirs to correct.

Associates is not for anyone under 16.

Changes

If this policy changes, the new version will be published on this page, and you will be shown what changed the next time you sign in.