Last updated: 16 August 2026

1. Who we are

HashOffice provides a hosted customer-communication workspace. When you sign up for a plan, we are the data controller for your account and billing information. For the conversations and contacts inside your workspace, you are the controller and we act as your processor. Questions about any of this go to [email protected].

2. What we collect

Account information. Your name, email address, and a hashed version of your password. We never store your password in a readable form.

Business information you give us at checkout. Your business name, phone number, website, industry, and business address. We ask for these because we build and configure your workspace by hand, and it is what we need to set it up correctly.

Payment information. Card details are entered on Stripe's own hosted checkout page and are held by Stripe. They never pass through our servers and we never see or store your full card number. We keep a Stripe customer reference, your plan, and your billing history so we can show you your subscription and issue refunds.

Workspace content. The messages, contacts, and files that flow through your workspace. This is your data. We access it only when you ask us to — for support or setup — or where we are legally required to.

Technical information. Server logs including IP address, browser type, and pages requested, kept for security and troubleshooting. If you buy a domain through us, we also collect the registrant contact details that registries require.

3. Why we use it, and on what basis

To provide the service — creating your workspace, signing you in, showing your subscription. Basis: performance of our contract with you.
To take payment — processing subscriptions, trials, renewals, and refunds. Basis: performance of our contract.
To email you about your account — welcome and sign-in emails, trial reminders, failed-payment notices. Basis: performance of our contract.
To keep the service secure and working — rate limiting, abuse prevention, error monitoring. Basis: our legitimate interest in a service that stays up and is not abused.
To meet legal obligations — tax and accounting records. Basis: legal obligation.

We do not sell your personal information, and we do not use it to train machine-learning models.

4. Who we share it with

We share data only with the providers needed to run the service, and only what each one needs:

Stripe — payments, subscriptions, and refunds. Receives your name, email, and payment details.
HighLevel (LeadConnector) — the platform your workspace runs on. Receives your business details and, once you are live, your workspace content.
SendGrid (Twilio) — delivery of account emails. Receives your email address and the content of those emails.
Cloudflare — sits in front of our website to serve it quickly and filter malicious traffic. Processes IP addresses and request data.
Sentry — error monitoring, so we find faults before you report them. Receives technical error data.
Openprovider — domain registration, only if you buy a domain. Receives the registrant details registries require.
ImprovMX — email forwarding, only if you set up forwarding on a domain with us.

We may also disclose information where the law requires it, or to establish or defend legal claims. If our business is ever sold or merged, your information may transfer with it — we will tell you before that happens.

5. Where your data is held

Our application and database run on servers in the United States. Our providers above operate in the United States and the European Union. Where data leaves the UK or EEA, transfers rely on the relevant Standard Contractual Clauses or an adequacy decision.

6. How long we keep it

We keep your account and workspace data for as long as your subscription is active. If you cancel, we keep it for 90 days so you can change your mind and so you have time to export anything you need, then delete it. Billing records are kept for seven years because tax law requires it. Server logs are kept for 90 days.

7. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or send it to another provider. You can also object to processing we carry out on the basis of legitimate interests. Email [email protected] from the address on your account and we will respond within 30 days. There is no charge for this.

If you are in the UK or EEA and you think we have handled your data badly, you can complain to your local data protection authority. We would rather you told us first so we can put it right.

8. Security

The site is served over HTTPS. Passwords are hashed, and credentials we hold on your behalf are encrypted at rest in our database. Access to production systems is limited to the people who need it. No system is perfectly secure, so if a breach ever affects your data we will tell you and the relevant regulator without undue delay.

9. Children

HashOffice is a business product and is not intended for anyone under 16. We do not knowingly collect their information.

10. Changes to this policy

If we change this policy materially, we will update the date at the top and email account holders before it takes effect.