1. Introduction
ExactlyHow ("we", "our", or "us") respects your privacy and is committed to protecting it through our compliance with this policy. This Privacy Policy describes the types of information we may collect from you or that you may provide when you visit our website (exactlyhow.io) and use our Operational Knowledge & Business Continuity Platform (our "Services"), and our practices for collecting, using, maintaining, protecting, and disclosing that information.
2. Scope
This policy applies to information we collect on our website, in email, text, and other electronic messages between you and this website, and when you interact with our advertising and applications on third-party websites and services. It does not apply to information collected by any third party, including through any application or content that may link to or be accessible from our Services.
For clarification, the organization that opens an account with ExactlyHow (the "Customer") is the Data Controller of the Operational Knowledge uploaded to the platform. ExactlyHow operates as a Data Processor. Our processing of Customer Data is governed by our Data Processing Addendum (DPA), not this Privacy Policy.
3. Information We Collect
We collect several types of information from and about users of our Services, including:
- Business Account Information: Name, email address, job title, and employer details provided during registration.
- User Profile Information: Profile pictures, preferences, role classifications (e.g., Creator, Editor, Viewer), and time zone settings.
- Organization Information: Company name, billing address, tax identification numbers, and designated organization contacts.
- Documentation Uploaded: Text, images, standard operating procedures, and other Operational Knowledge submitted to the Process Library.
- Files and Attachments: Documents, spreadsheets, and media attached to specific operational processes.
- Comments and Collaboration: Text submitted via in-app comments, replies, and annotations in the Version History.
- Usage Analytics: Information about how you interact with our platform, features used, Process Ownership Transfer activity, and search queries within your organization's workspace.
- Log Data: IP addresses, browser type, operating system, the referring web page, pages visited, and timestamps.
- Device Information: Device identifiers, mobile network information, and hardware model.
- Cookies: Data collected through tracking technologies (refer to our Cookie Policy for detailed information).
- Support Requests: Information provided when submitting bug reports, feature requests, or help desk inquiries.
- Communications: Records of correspondence between you and ExactlyHow.
- Billing Information: Payment details and transaction history (processed securely via our third-party payment processors).
4. How We Use Information
We use information that we collect about you or that you provide to us, including any personal information, to:
- Provide, maintain, and improve our Services, including the Process Library and Business Continuity features.
- Authenticate your identity and manage Role-Based Permissions securely.
- Protect against malicious, deceptive, fraudulent, or illegal activity (Security).
- Process transactions and send related billing information.
- Provide customer support and resolve technical issues.
- Send administrative messages, security alerts, and product updates (Communication).
- Analyze usage trends to inform product improvements and new feature development (Analytics).
- Fulfill our legal obligations and enforce our Terms of Service.
5. Legal Bases for Processing (GDPR)
If you are a resident of the European Economic Area (EEA) or the United Kingdom (UK), our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it. We normally collect personal information from you only where we have your consent to do so, where we need the personal information to perform a contract with you, or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms.
7. International Transfers
ExactlyHow is headquartered in the United States. Information we collect may be processed and stored in the US or other countries where our service providers maintain facilities. By using the Services, you consent to the transfer of information to countries outside of your country of residence, which may have different data protection rules. We utilize Standard Contractual Clauses (SCCs) and other approved transfer mechanisms to safeguard data transferred from the EEA, UK, or Switzerland.
8. Data Retention
We retain personal information we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax, or accounting requirements). When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it.
9. Security Practices
ExactlyHow implements robust, enterprise-grade security measures to protect your Operational Knowledge. This includes data encryption at rest and in transit, role-based access controls, continuous application monitoring, and regular vulnerability assessments. While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet is 100% secure.
10. Customer Responsibilities
Customers are responsible for maintaining the confidentiality of their account credentials and ensuring that Operational Knowledge uploaded to the platform does not violate applicable privacy laws (e.g., unnecessarily uploading sensitive Personal Health Information without a BAA). Customers are also responsible for managing their Organization Workspaces and configuring Creator, Editor, and Viewer roles appropriately.
11. User Rights
Depending on your location, you may have the following rights regarding your personal information:
- Access: The right to request copies of your personal information.
- Correction: The right to request that we correct any information you believe is inaccurate.
- Deletion: The right to request that we erase your personal information, under certain conditions.
- Export: The right to request that we transfer the data that we have collected to another organization, or directly to you.
- Restriction: The right to request that we restrict the processing of your personal data.
- Objection: The right to object to our processing of your personal data.
12. California Privacy Rights
If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with specific rights regarding your personal information, including the right to know what personal data is collected, the right to delete data, and the right to opt-out of the sale of your data. ExactlyHow does not sell personal information.
13. GDPR Rights
If you are located in the EEA or UK, you have data protection rights under the General Data Protection Regulation (GDPR). To exercise your rights regarding data controlled by an ExactlyHow Customer, please contact your Organization's Administrator directly. For data controlled by ExactlyHow, contact our privacy team.
14. Children's Privacy
Our Services are intended for B2B enterprise use and are not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that a child under 16 has provided us with personal information, we will take steps to delete such information.
15. Third Party Services
Our Services may contain links to third-party websites or integrations. This Privacy Policy does not apply to the practices of third parties. We encourage you to review the privacy policies of any third-party services you access.
17. Policy Updates
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date at the top of this document. For material changes, we will provide notice via email or a prominent notification within the ExactlyHow application.
18. Contact Information
If you have any questions or comments about this Privacy Policy, our privacy practices, or if you would like to exercise your rights, please contact us at:
ExactlyHow, Inc.
Attn: Legal / Privacy
Austin, Texas, USA
Email: privacy@exactlyhow.io