EnglishENPolskiPLDeutschDEEspañolESBahasa IndonesiaID
Start free

Privacy Policy

Last updated: June 13, 2026

SquadBear (“SquadBear”, “we”, “us”) provides agent-native leave management, time tracking and team-health software (the “Service”), operated by SquadBear. This Privacy Policy explains how we handle personal data when you visit our website, create an account, or use the Service.

1. Our two roles: processor and controller

SquadBear is sold to organizations to manage their own people. Under the EU General Data Protection Regulation (GDPR) and equivalent laws, our role depends on the data:

  • Employee data your employer puts into the Service - leave records, timesheets, team membership, linked accounts and team-health responses - is controlled by your employer (the data controller), and SquadBear acts only as a data processor. We process it on your employer’s documented instructions under our Data Processing Agreement. If you are an employee, please raise privacy requests about this data with your employer; we will support them in responding.
  • Data we determine the purposes of - your sign-in credentials, billing-contact details, website and cookie data, and support correspondence - is data for which SquadBear is the controller, and this Policy governs it directly.

2. Personal data we process

  • Identity - name, work email, job title, avatar and country.
  • Authentication - password hash, SSO/OAuth tokens, and security metadata such as IP address and user-agent for active sessions.
  • Leave - requests, balances and ledger entries. Free-text fields (a request’s reason or cancellation note) may contain health or other special-category data if a user chooses to enter it.
  • Time tracking - time entries, notes and linked issue summaries.
  • Organizational - team memberships, work schedules and linked external identities (e.g. Slack, GitHub, Jira handles) used for cross-tool features.
  • Activity - audit logs, notifications and session participation needed to run and secure the Service.

Anonymous team-health and retro responses submitted in anonymous or alias mode are keyed to a one-way hash that is rotated when the session closes, so they cannot be re-attributed to an individual and are excluded from personal-data exports.

3. How we collect it

  • Directly from you when you register, sign in or contact support.
  • From your employer when an administrator adds you as an employee or invites you to a workspace.
  • From your identity provider (Google or Microsoft) - your account email, for authentication only - if your workspace enables single sign-on.
  • Automatically - strictly-necessary cookies and security logs, plus consent-gated analytics cookies on our marketing website (see our Cookie Policy).
  • When you create a workspace - any campaign parameters (such as utm_source), landing page and referring site that accompanied your sign-up, stored against the workspace so we can understand which channels bring customers. This is first-party data and is not shared with third parties.

For data where SquadBear is the controller, we rely on:

  • Performance of a contract - to create your account, provide the Service and process billing.
  • Legitimate interests - to secure the Service, prevent fraud and abuse, maintain audit trails, and send service-related communications.
  • Legal obligation - to meet accounting, tax and other statutory duties.
  • Consent - where we ask for it, for example optional product communications, which you can withdraw at any time.

For employee data we process on your employer’s behalf, the legal basis is determined by your employer as controller.

5. AI agents, the API and the MCP server

SquadBear is built to be operated by AI agents, with privacy boundaries we hold to strictly:

  • We do not send personal data to any large language model. The Model Context Protocol (MCP) server exposes typed tools that your agent calls; any AI model is operated by you or your AI vendor, under your own connection and agreements.
  • Agent access is scope-gated OAuth. A connected agent receives only the permissions approved on the consent screen and acts with the same authority as the person who connected it.
  • Analytics are deterministic. Team-health trends, coverage risk and similar insights are computed by ordinary statistics on our servers - never by an LLM.
  • No ad-tech. We use no third-party advertising or analytics trackers.

6. Sharing and subprocessors

We do not sell personal data. We share it only with service providers (subprocessors) that help us run the Service, under contracts requiring appropriate safeguards. The live list at /api/subprocessors always reflects what is actually enabled in your deployment:

  • Cloudflare, Inc. (always) - application hosting, database (D1) and transactional email delivery.
  • Stripe, Inc. (when a paid plan is enabled) - billing-contact name and email, and the workspace identifier.
  • Google LLC / Microsoft Corporation (when single sign-on is enabled) - account email address, for authentication only.

We may also disclose data where required by law, or to protect the rights, property or safety of users and the public.

7. International transfers

The production database is hosted in the European Union. Where a subprocessor processes data outside your region (for example Stripe, Google or Microsoft in the United States), the transfer is covered by Standard Contractual Clauses or another lawful transfer mechanism set out in that provider’s data processing agreement.

8. How long we keep it

We keep personal data only as long as needed for the purposes above, or as your employer instructs:

  • Webhook delivery logs: 30 days. Read in-app notifications: 90 days. Sent-email records: 30 days.
  • Event-feed history: per plan (30 days on Free, longer on paid plans).
  • Audit logs and the leave-balance ledger are retained while the workspace is active, for compliance and financial-history reasons; identifiers in them are pseudonymized when an employee is erased rather than deleted on a timer.
  • Account and billing data are kept for the life of the account and a reasonable period afterward to meet legal and accounting obligations.

9. Your rights

Subject to applicable law you have the right to access, rectify, erase, restrict or object to processing of your personal data, to data portability, and to withdraw consent. Because most employee data sits under your employer’s control:

  • Access & portability - request a machine-readable copy of your data via Notification settings → Your data → Request data export, the API (POST /api/me/export) or the MCP tool export_my_data. We prepare it in the background and notify you when it’s ready to download.
  • Erasure - initiated by your workspace administrator, because your employer holds the lawful basis and any statutory retention duty. Erasure pseudonymizes your identity while preserving the (now pseudonymous) balance ledger and audit trail.
  • Rectification - ask your workspace administrator to update your profile.
  • Opt-out - manage per-category email preferences in-app, or use the one-click unsubscribe link in any notification email. Account emails (password reset, invitations) are always sent.

Where SquadBear is the controller (account, billing and website data), contact us directly using the details below. You also have the right to lodge a complaint with your local data-protection authority.

10. How we protect it

We apply security measures appropriate to the risk: HTTPS/TLS in transit, encryption of the database at rest, salted password hashing, role-based access control enforced consistently across the web app, REST API and MCP server, managed secrets for credentials, and a policy of not writing personal data to operational logs. No system is perfectly secure, but we work to protect your data and to disclose incidents as the law requires.

11. Cookies

The app uses only strictly-necessary cookies. Our marketing website additionally uses Google Analytics cookies, set only with your consent via the cookie banner and revocable at any time. See our Cookie Policy for details.

12. Children

The Service is a workplace tool, not directed to children and not intended for anyone under 16. We do not knowingly collect personal data from children.

13. Changes to this Policy

We may update this Policy from time to time. We will post the new version here and update the date above, and communicate material changes as required.

14. Contact us

For privacy questions or to exercise your rights, contact privacy@squadbear.com. The data controller for controller-stage data is SquadBear. Any Data Protection Officer or EU/UK representative we appoint will be named here.