Eddish Privacy Policy
1. Who we are
Eddish is operated by Devbox LLC, a Wyoming limited liability company at 30 N Gould St #44071, Sheridan, WY 82801, USA ("Eddish", "we", "us"). This policy explains how we handle personal data when you visit eddish.net, use the Eddish web and mobile apps, API, or MCP server, or contact us.
It should be read with our Terms of Service. Capitalized terms such as Account, User, and Customer Data have the meanings given there.
This policy is effective October 29, 2026. Questions: legal@eddish.net.
2. Our two roles
Controller for account data. We decide how to use the data needed to run your Account and our business: who you and your Users are, how you sign in, your subscription, support requests, and how the Service is used. Most of this policy is about this data.
Processor for Customer Data. The time entries, expenses, clients, projects, invoices, and attachments you put in Eddish belong to you. They often include personal data about your clients and their contacts. For that data, you are the controller and we process it only on your instructions to provide the Service. If your clients ask us about their data, we will refer them to you.
Paddle. Paddle.com is our Merchant of Record and handles checkout, payment, tax, and invoicing for subscriptions. Paddle collects payment details directly and acts as an independent controller under its own privacy notice. We never see or store your full card details.
3. What we collect
| Category | Examples | Source |
|---|---|---|
| Account and profile | Name, email, password hash, Account name, role, language, time zone, currency | You or your Account Admin |
| Sign-in | Google or Microsoft profile ID, name, and email; SSO identity provider attributes and SCIM group membership; MFA settings | Your identity provider |
| Business details | Business name, address, tax ID, logo, and bank or payment instructions you choose to print on invoices | You |
| Subscription | Plan, Seats, billing country, subscription status, Paddle customer and transaction IDs | Paddle |
| Support and feedback | Messages, attachments, and feature requests you send us | You, via Freshdesk or Canny |
| Usage and device | IP address, browser and device type, pages and features used, API and MCP requests, log and error data | Automatically |
| Customer Data | Time entries, expenses, clients and contacts, projects, rates, invoices, imported Harvest data | You and your Users (we process it for you, see section 2) |
We don't ask for sensitive data such as health, religion, or biometrics, and you shouldn't put it in Eddish.
4. How we use it
| Purpose | Legal basis (EU/UK) |
|---|---|
| Create and run your Account, sign you in, provide the Service | Contract |
| Manage subscriptions, trials, Seats, and Free Tier limits | Contract |
| Send service emails: verification, security alerts, approval notifications, invoices you send to clients, billing notices | Contract |
| Answer support requests and review feedback | Contract; legitimate interests |
| Keep the Service secure, prevent abuse and fraud, debug errors | Legitimate interests |
| Understand feature usage to improve the Service | Legitimate interests |
| Send product updates and announcements | Consent or legitimate interests; unsubscribe anytime |
| Meet legal, tax, and accounting obligations; enforce our Terms | Legal obligation; legitimate interests |
We do not sell personal data, share it for targeted advertising, or use Customer Data to train AI models. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
5. Subprocessors and sharing
We use these providers to run Eddish. Each is bound by a contract to protect the data and use it only to provide its service to us.
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Microsoft Azure | Application hosting, database, cache, file storage, backups, logging and monitoring | All Account and Customer Data, usage and log data | United States (Central US) |
| Microsoft (Azure Communication Services) | Sending emails, including invoices to your clients | Recipient names and emails, email content | United States |
| Freshworks (Freshdesk) | Customer support portal and tickets | User name, email, support messages | United States |
| Canny | Feedback and feature requests | User name, email, feedback | United States |
We update this list before adding or replacing a subprocessor that handles Customer Data.
Other sharing. We also share personal data:
- with Paddle, to process your subscription (Paddle is an independent controller, see section 2);
- with Google, Microsoft, or your identity provider, when you choose to sign in with them;
- with people you direct, such as clients you send invoices to, or tools you connect through the API or MCP server;
- when required by law, or to protect the rights, safety, or property of Eddish, our users, or others;
- with a successor if Devbox LLC is involved in a merger, acquisition, or sale of assets, subject to this policy.
6. International transfers
We are based in the United States, and our providers may process data in the United States and other countries. When we transfer personal data from the EU, UK, or Switzerland to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where needed), or on a provider's certification under the EU-US Data Privacy Framework.
7. Retention
| Data | How long we keep it |
|---|---|
| Account and Customer Data | While your Account is active, including on the Free Tier. After Account deletion or termination, deleted within 30 days (see Terms section 13) |
| Backups | Overwritten on our normal backup cycle, within 35 days of deletion |
| Subscription and transaction records | As long as tax and accounting law requires, typically up to 7 years |
| Support tickets and feedback | Up to 3 years after the last interaction, unless you ask us to delete them sooner |
| Logs and usage data | Up to 12 months |
Archived records in your Account are kept, not deleted, until you or an Admin delete them.
8. Security
We protect personal data with encryption in transit (TLS) and at rest, database row-level security that isolates each Account's data, role-based access, multi-factor authentication for Users, and support for enterprise single sign-on. Access to production systems is limited to the people who need it.
No system is perfectly secure. If a breach affects your personal data, we will notify you, and the relevant authorities where required, without undue delay.
9. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and get a copy in a portable format;
- correct inaccurate data;
- delete your data;
- object to or restrict certain processing, including direct marketing;
- withdraw consent where we rely on it;
- complain to your local data protection authority.
Most of these you can do yourself in the app: edit your profile, export data, or delete your Account. Otherwise email legal@eddish.net. We respond within 30 days and may need to verify your identity first.
If you are a client of an Eddish customer, your data is controlled by that customer. Please contact them directly; if you contact us, we will pass your request on to them.
US state privacy laws. Residents of California and other US states with privacy laws may request access to, correction of, or deletion of their personal data. We do not sell or share personal data for cross-context behavioral advertising, and we will not discriminate against you for exercising your rights. You may use an authorized agent to make a request.
10. Cookies
We use only the cookies and similar storage needed to run Eddish: keeping you signed in, protecting against cross-site request forgery, and remembering preferences such as language. These are strictly necessary, so we don't ask for consent to them.
We do not use advertising, analytics, or cross-site tracking cookies.
11. Children, changes, and contact
Children. Eddish is a business tool for people 18 and over. We don't knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
Changes. We may update this policy. The current version is always at eddish.net/legal/privacy. For material changes, we will notify Account Owners by email or in the app at least 30 days before they take effect.
Contact. Privacy questions and requests: legal@eddish.net. General support: support@eddish.net. Mail: Devbox LLC, 30 N Gould St #44071, Sheridan, WY 82801, USA.