Facet privacy & data

Facet acts in two distinct roles: Controller , for Facet's own commercial-relationship data

the account owner's email address and name; organization legal name and mailing address; billing address

Customer's website URL(s); subscription tier

Facet does not receive or store payment card numbers; card and bank data are handled by Stripe, Inc.

Individual visitor IP addresses are not stored, aggregated, or redistributed by Facet.

Facet collects anonymous page-view counts for product-improvement purposes

session activity metadata (sign-in timestamp, IP address at sign-in, user-agent)

support and sales communications

Job title, employer on account-owner profile

Operating the Services (authentication, routing, metering, signing, provenance generation)

Billing, tax recordkeeping, and financial-regulatory compliance

Security, anti-abuse, fraud prevention, and platform integrity

Support and Customer success

Product improvement using Aggregated or de-identified data only

Audit logs (admin sign-ins, configuration changes, key rotations, signature operations) Seven (7) years after event

Raw agent-call metadata Ninety (90) days

Support conversations Three (3) years after close

Backups Thirty (30) days rolling, then overwritten

Facet's primary Processing location is the United States

EU Standard Contractual Clauses. The European Commission's Standard Contractual Clauses adopted by Implementing Decision (EU) 2021/914 of 4 June 2021

EU-US Data Privacy Framework. For Personal Data transferred to U.S. subprocessors that have self-certified

Where an adequacy decision applies to a destination (for example, Japan private-sector adequacy, Republic of Korea adequacy, UK adequacy for Swiss/EU exports), Facet relies on the adequacy decision.

Customer is the Controller of this data; Facet Processes it on Customer's documented instructions under the Data Processing Agreement v2.1 at facet.llc/legal/dpa.html .

Where Customer or a data subject requests deletion, Facet deletes the identifiable record from production within thirty (30) days and overwrites backups in the ordinary course within ninety (90) days, except for records subject to legal hold.

Obtain confirmation that we Process Personal Data about you, a copy of the Personal Data, and information about the Processing.

Have inaccurate Personal Data corrected or incomplete data completed.

Erasure / deletion (GDPR Art. 17; CCPA § 1798.105; state-law analogues, subject to exceptions).

Receive Personal Data you provided in a structured, commonly used, machine-readable format and transmit it to another Controller.

Object to Processing based on Art. 6(1)(e) or (f), including profiling

Where Processing is based on Art. 6(1)(a) consent, withdraw at any time without affecting lawfulness of prior Processing.

Residents of Virginia, Colorado, Connecticut, Oregon, Texas, Montana, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Iowa, Indiana, Delaware, Rhode Island, and Kentucky may additionally exercise the statutory appeal mechanism

Facet does not sell Personal Information within the meaning of CCPA § 1798.140(ad)