Privacy Policy

This Privacy Policy explains how The Productive ("we", "us") collects, uses, and protects personal information through the SuccessionStack platform and website.

What we collect

• Account information — name, work email, organization, role.
• Customer Data — the employee, role, and scoring data you upload to operate the Service.
• Usage data — pages visited, features used, and aggregated performance metrics.
• Communications — emails and form submissions you send to us.

How we use it

• To deliver the Service and authenticate users.
• To respond to support requests and security incidents.
• To improve product reliability and performance.
• For marketing communications you have explicitly opted into. You can unsubscribe at any time.

How we protect it

• TLS 1.2+ in transit; AES-256 at rest.
• Row-level security per tenant in our Supabase Postgres database.
• Audit logging of every privileged action.
• Bcrypt password hashing.
• Least-privilege access controls for staff.

Subprocessors

We use a small number of subprocessors, listed in full — separately for this marketing site and for the product — in our Data Use & Subprocessors document, along with what each one receives and the region it processes in. A Data Processing Addendum is available from each provider and from us on request; we are collecting countersigned copies as part of our SOC 2 work and do not claim that exercise is finished.

Analytics on this site

This marketing site uses PostHog for product analytics, including click tracking, aggregated heatmaps and a session replay with form fields masked, plus Vercel Analytics and Vercel Speed Insights for cookieless page-view and page-performance measurement. We also keep a visit counter and any campaign parameters in the link you arrived from.

If you are in the EEA, the UK or Switzerland, none of it runs until you turn it on. Everywhere else it runs by default and you can turn it off at any time. There is no cookie banner; the control lives on Privacy Settings, and the individual cookies are itemised in our Cookie Policy.

When you submit a form we send its contents, including your message, to PostHog and use your email address as the identifier for your activity on this site. That happens whether or not analytics is switched on, because it is how we handle and answer your enquiry rather than behavioural tracking — but you should know it, so we say it here rather than leaving it to be inferred.

The product application is different and deliberately stricter: it identifies people by an internal account ID and never by email address, and its session replay masks every piece of text on the page. Do not read a claim about one as a claim about the other.

Your rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or export your personal information. Email privacy@successionstack.com to exercise any of these rights. We respond within 30 days.

Cookies

We use a minimal set of cookies — see our Cookie Policy for the full breakdown and how to manage your preferences.

Data retention

Customer Data is retained for the duration of your subscription. On termination, we delete Customer Data within 30 days, and it ages out of our database backups within a further 7 days — seven daily backups are kept. In-product deletions are recoverable for 90 days from an archive, described in our Data Retention & Erasure Policy. Marketing and analytics data is retained for up to 24 months.

Children

The Service is intended for use by businesses. We do not knowingly collect personal information from anyone under 16.

Changes

We may update this Privacy Policy from time to time. Material changes will be notified at least 30 days in advance.

Contact

Privacy questions: privacy@successionstack.com.