Skip to content
Udibo

Privacy Policy

Effective and last updated: 30 October 2026

Udibo LLC, an Ohio limited liability company ("Udibo", "we", "us"), is responsible for the personal information described here. This policy covers visitors to udibo.com, our waitlist, Udibo account holders and administrators, and people who contact or do business with us. Contact privacy@udibo.com with questions or requests about your information.

1. When we process information for a customer

Udibo also runs sign-in and account services for other organizations. If you use one of their products, that organization decides why your information is collected and how its product uses it. Its privacy notice applies to that use. Udibo processes the information on its behalf to provide and secure the service, including related usage and security records. We do not sell that information or use it for targeted advertising.

Contact the organization first about its records. If you cannot reach it, contact us and we will help identify the appropriate contact or pass on your request. We may need the customer's instructions before acting on its data. This does not limit rights or responsibilities that applicable law gives you or us. A customer-connected social sign-in provider, email service or other integration also receives information under that customer's arrangements.

The rest of this policy describes processing for which Udibo determines the purposes, such as your own Udibo account, website visits and communications with us.

2. Information we collect and why

Visits and security. Our systems and infrastructure providers process network addresses, browser and device information, requested pages, timestamps, responses, and diagnostic or security events. We use these to deliver the Site, prevent abuse, investigate problems and protect accounts. Security checks may limit repeated attempts or refuse a sign-in or form submission. Contact us if you believe a check has blocked you incorrectly.

The waitlist. We collect your email address, any answers you give on the form, and records of joining, invitations and removal. We use them to manage your entry, invite you or tell you when sign-ups open, and send confirmation and removal messages. We do not add you to a newsletter by joining the waitlist. To leave, use the removal form on the waitlist page and confirm the emailed link, or contact us. The confirmation email sent when you join links to that page. Security records of these actions are kept separately from the entry.

Your account. We collect the username, email address, name and optional profile details you provide; your sign-in credentials and linked sign-in identities; your organizations, tenants, roles and invitations; and records of your activity, devices and sessions. Passwords and recovery codes are stored as hashes. We also record the Terms version you accept and when you accept it. We use this information to provide and administer your account, authenticate you, manage access, measure service usage and protect the Services. We send account and service messages such as verification, sign-in, recovery, invitation, security and usage notices.

Social sign-in. If you choose a social sign-in option, we receive the information that provider supplies for the requested sign-in, such as an account identifier, name and email address. The provider learns that you used it to sign in and handles its own records under its privacy policy.

Payments, if you purchase a paid offering. Our payment provider, Stripe, processes payment details through its checkout. We receive billing-contact, subscription, transaction and payment-status information needed to administer your purchase and maintain financial records. We do not receive your full card number or card security code. A free account or waitlist entry does not by itself create a charge.

Messages and business relationships. We keep the contact details, organization information and messages you give us when you request support, report a problem or discuss doing business with us. Someone may also give us your business contact details to introduce you or invite you to an organization. We use those records to respond, manage the relationship, resolve disputes and handle legal obligations. Public issues and contributions you post on GitHub remain public under GitHub's own terms and privacy statement.

You choose whether to provide information. Fields required for a particular form or account function are marked there; without them we may be unable to provide that function. Optional profile information and optional analytics are not required to use the Site.

3. Cookies, browser storage and optional analytics

We use cookies and similar storage for sign-in, security, remembering a browser and keeping a sign-in process together. Browser storage also remembers interface preferences and, where available, your analytics choice. The cookie documentation describes these items and their lifetimes. Blocking necessary cookies may prevent sign-in or other requested functions from working.

Where Google Analytics is enabled, we use it to understand visits to our public marketing and documentation pages. We load it only after you choose Allow analytics. Declining it leaves those pages available. It does not run on customer tenant hosts or on sign-in, account or dashboard pages.

With your permission, Google receives information about page visits and interactions, browser and device characteristics, referral information and cookie identifiers. Its servers also receive your IP address when your browser connects. Google says Google Analytics 4 does not log or store IP addresses and uses them to derive approximate location. We do not send your Udibo account identifier, email address or sign-in credentials as analytics fields. Our integration disables advertising personalization and Google signals; we use it for site measurement, not targeted advertising.

You can change your choice using Analytics choices in the footer where analytics is enabled. Withdrawing consent stops further analytics collection from that browser and removes our Google Analytics cookies. It does not undo previous collection. Clearing browser storage may cause the choice to be asked again. You can also contact us about information already collected; identifying a particular analytics record may require the relevant cookie identifier.

See Google's partner-site privacy information and Google Analytics' data safeguards for how Google processes this information. The analytics permission applies to Google Analytics; it is separate from services needed for security or a social sign-in you choose.

4. Who receives information

We use providers for hosting, storage, security, delivery, communications, monitoring and payments. They receive the information needed for their role. Our current providers include:

  • Amazon Web Services — application hosting and associated infrastructure and operational records.

  • PlanetScale — database hosting.

  • Cloudflare — network delivery, security and anti-bot checks, including network addresses and browser signals.

  • Upstash — temporary records used to limit repeated requests and abuse.

  • Resend — delivery of account, service and waitlist email.

  • Fastmail — messages you send to our email addresses and our replies.

  • Grafana Labs — operational monitoring, such as traces, metrics and diagnostic logs. Diagnostic information may contain identifiers or information included in an error message; we limit and filter what is sent.

  • Stripe, when you purchase a paid offering — payment processing, including its own fraud-prevention and legal-compliance activities.

  • Google, only when you allow the optional analytics described above — website measurement.

Providers such as Stripe and providers you choose for social sign-in also have their own responsibilities and privacy terms. A provider's appearance here does not give it permission to use information for every purpose it offers.

We use development tools, including GitHub and AI tools from Anthropic and OpenAI, to build and maintain the Services. Consumer AI tools receive synthetic examples or material from which personal information and customer secrets have been removed. They may assist with deployment and configuration tasks we expressly authorize, using public, non-secret information; they may not access production customer records or receive identifiable customer data. We do not use identifiable personal information to train AI models. Customer-connected tools are governed by the customer's own instructions and arrangements, as Section 1 explains.

Your organization's administrators can see information needed to manage their accounts, such as membership, roles and administrative activity. We may also disclose relevant information to professional advisers under confidentiality duties, in response to valid and binding legal process, or in connection with a merger, financing, reorganization or sale of the business subject to appropriate confidentiality protections. For legally compelled disclosure we limit the information to what is required and notify the affected person or customer unless law prohibits it. A successor must respect the protections applicable to information already collected.

We do not sell personal information or share it for cross-context behavioral advertising. We do not disclose it to third parties for their direct marketing.

5. Legal bases and international processing

Where EU or UK data-protection law requires a legal basis, we rely on:

  • Contract to provide an account or paid service to an individual who is a party to our agreement, and take requested steps before that agreement.

  • Legitimate interests to operate and secure the Site and Services, administer an organization's relationship with us, provide support, prevent fraud, understand service use and protect legal rights. We consider those interests alongside the rights and reasonable expectations of affected people.

  • Consent for the optional analytics and waitlist communications you ask for. You may withdraw it through the controls above or by contacting us.

  • Legal obligations for records, requests and disclosures the law requires.

Security checks may automatically block activity that appears abusive or unsafe. We do not use personal information for automated decisions about credit, employment or similarly significant eligibility. You can contact us for human review of an account-access problem.

Udibo is based in the United States. Our providers may process information in the United States and other countries, whose laws may differ from those where you live. We are not certified under the EU–U.S. Data Privacy Framework. Contact privacy@udibo.com for information about the locations and safeguards applicable to particular processing. Acceptance of this policy is not consent to an otherwise unlawful international transfer. Where your organization's use requires a processing or transfer agreement, those arrangements must be in place before you submit that data, as our Terms of Service explain.

6. How long we keep information

Retention depends on the information's purpose, account status, security and abuse-prevention needs, legal obligations and unresolved disputes. Specific current retention rules include:

  • Waitlist entries: removal clears the address and form answers from the entry. Otherwise, entries are eligible for deletion 90 days after the latest acceptance, denial or notice that sign-ups are open, and not before an active invitation expires. An entry still waiting, including an unused expired invitation without one of those events, is kept until it is removed or its purpose is completed.

  • Sign-in and administrative audit records: 365 days from the event. These security records can outlive an account or waitlist entry.

  • Recognized-browser records: 365 days after last use.

  • Sessions and sign-in credentials: sign-out, expiry and revocation end access. Ended session and token records can remain until related credential, security, usage-accounting and operational retention needs are met; ending a session does not immediately delete every associated record.

  • Accounts: disabling or closing a sign-in currently suspends it rather than erasing the account record. Its profile and credential records can remain so the suspension can be reviewed or reversed. Permanent erasure is a separate request to privacy@udibo.com, subject to applicable legal requirements and permitted retention. Transferring ownership of an organization or tenant may be necessary before its last owner's account can close.

  • Other records: we retain support correspondence, business-contact, payment, legal-request and operational records for the period needed to resolve the matter, maintain the relationship, meet legal requirements and establish or defend claims. Suppression records may be kept to avoid sending unwanted email again. Temporary abuse-limit records expire with their counting window.

Our cleanup processes run periodically, rather than deleting every record at the exact instant a retention window ends. Backup copies may remain until the provider's backup cycle replaces or expires them. Optional analytics records are retained under the applicable analytics settings and Google's processing terms; withdrawal of browser consent does not erase previously collected records. Contact us for information about a particular record or an erasure request.

7. Your choices and rights

You can request access, correction or deletion by writing to privacy@udibo.com. Depending on applicable law and the circumstances, you may also have rights to obtain a portable copy, restrict processing, object to processing, appeal a decision on your request, and complain to a regulator. We do not retaliate against you for exercising a privacy right.

Right to object. Where we rely on legitimate interests, you may object to processing on grounds relating to your situation. We will consider your request under applicable law, including whether compelling grounds or legal claims justify continued processing. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

We may need information sufficient to verify your identity or an agent's authority, protect someone else's information, and understand the request. We respond within the time applicable law requires and explain any permitted extension, refusal or exception. If you disagree, reply asking for a review or appeal. We will explain any further complaint route required by applicable law. Requests are normally free; any permitted fee or refusal for an excessive or unfounded request follows applicable law.

For European privacy complaints, you may contact your local supervisory authority, including an EEA authority, the UK Information Commissioner's Office, or the Swiss Federal Data Protection and Information Commissioner. You need not contact us first to exercise that right.

For US residents, the information categories, sources, purposes, recipients and retention criteria are described above. Our no-sale and no-targeted-advertising practices apply to everyone. A Global Privacy Control signal therefore does not need to stop a sale or advertising disclosure, and it does not automatically grant consent to optional analytics. You can use Analytics choices to control analytics independently. Applicable state-law access, deletion, correction, portability and appeal rights may be exercised through the contact above, including through an authorized agent where the law allows one.

8. Children and security

The Site and Udibo's own accounts and waitlist are intended for adults, not children. If you believe a child has supplied personal information directly to us, contact privacy@udibo.com so we can investigate and take appropriate steps, including deletion where required. Customers using Udibo for their own products are responsible for their audience and required parental permissions; their responsibilities do not remove our own obligations.

We use administrative and technical safeguards appropriate to the information we process, including access controls, protected connections and credential protections. No service can guarantee complete security. We will provide breach notifications when applicable law requires them, and notify affected customers as our agreement with them requires.

9. Changes and contact

We update the date above when this policy changes. For material changes we will provide a prominent notice on the Site or contact affected account holders, and obtain consent where required. We will not apply a materially incompatible new use to information already collected without the notice and permission applicable law requires. Correcting this notice does not eliminate obligations we made when information was collected.

Contact Udibo LLC at privacy@udibo.com about privacy or legal@udibo.com for other legal notices.