Privacy &Policy

Product Env (“we,” “our,” or “us”) values your privacy and is committed to protecting your personal information. This Privacy Policy outlines how we collect, use, process, store, and protect your data when you use our website and services. By using ProductEnv, you agree to the practices described in this Privacy Policy.

We collect different types of information from users depending on their method of registration and interaction with our platform. ProductEnv uses passwordless sign-in: we never ask you to create a password, and we do not collect or store passwords. The types of personal information we collect include:

• Registration with a magic link: When you create an account with your email address, we collect your email address, first name and last name, and we create a workspace (organization) for you, which you can rename at any time. To sign in, we email you a one-time magic link that expires after a short time and can be used only once. We store only a cryptographic hash of that link, never the link itself.
• Sign-up via Google or GitHub: If you register with Google or GitHub, the provider shares your name, profile image, provider ID, and email address with us. Because these providers handle authentication, we do not collect or store passwords for these accounts.
• Stored secrets: The environment variables and secrets you save, and any integration credentials you connect, are encrypted before they are stored. Secrets are encrypted with AES-256-GCM using a per-project key that is itself encrypted with a master key held only on our servers.
• Plan, billing and trial records: As part of your account and billing data, we keep each organization’s plan history (plans, payments, and their start and end dates). For the free ENV+ trial, we record whether you have used it, its start and end dates, and the project creation that started it (the project, the organization and who created it).

Additionally, we may collect non-personal information such as device type, browser type, and general usage data to improve the user experience and enhance platform security.

We use the personal information collected from users to provide and improve our services. The primary purposes for which we use your information include:

• User Management: We utilize your data to create and manage user accounts, ensuring a seamless experience across the platform.
• Organization and Collaboration Features: Users can invite team members to their organizations. We use collected data to facilitate this process and maintain access controls.
• Search Functionality: We allow users to search for team members or other relevant users within the platform using their email addresses.
• Platform Security and Fraud Prevention: Your information helps us monitor, detect, and prevent fraudulent activities, unauthorized access, or other security threats.
• Communication and Customer Support: We may use your contact information to send important notifications, respond to inquiries, and provide technical support.
• Legal Compliance: We may process your personal data to comply with legal and regulatory requirements.

We understand the importance of protecting user data and take appropriate security measures to prevent unauthorized access, disclosure, or misuse of information. All personal data is securely stored in a PostgreSQL database hosted on AWS. AWS provides robust security features, including encryption, access controls, and continuous monitoring to ensure the highest level of data protection. We also implement industry-standard security practices such as:

• Encryption: We use encryption technologies to protect data at rest and in transit. Secret values are encrypted with AES-256-GCM, and sign-in links and CLI tokens are stored only as one-way hashes.
• Access Controls: Restricted access to sensitive data is enforced to authorized personnel only.
• Regular Security Audits: We perform routine security checks and updates to mitigate risks.

Despite our best efforts, no system can be 100% secure. Because sign-in links are sent by email, users are encouraged to keep their email account secure and to enable multi-factor authentication on the email, Google, or GitHub account they use to sign in.

We respect your privacy and do not sell, rent, or trade your personal information to third parties. However, we may share data in the following situations:

• Compliance with Legal Requirements: If required by law, regulation, or legal process, we may disclose personal information to regulatory authorities, law enforcement agencies, or other government bodies.
• Business Transfers: In the event of a merger, acquisition, or sale of our assets, user information may be transferred as part of the transaction.
• Protection of Rights: If necessary, we may share data to enforce our policies, protect against fraudulent activity, or address security concerns.
• Service Providers and Partners: We may share limited information with trusted third-party service providers who assist in operating our platform, such as cloud hosting and customer support providers. These providers are required to uphold data protection standards.

If you enable notifications in the ProductEnv dashboard, your browser registers with Firebase Cloud Messaging and we store the resulting device token so we can send you push notifications, for example when a teammate changes secrets in one of your projects. Notifications never contain secret values. You can turn them off at any time in your browser settings or with the “Notify me about secret changes” preference, and we delete tokens when you sign out or when they stop working.

We rely on the following processors to run the service. Each one receives only the data it needs for its task:

• Firebase (Google): Delivers web push notifications. It receives your device token and the notification title and text.
• Brevo: Sends our transactional emails, such as magic sign-in links, invitations, and payment receipts. It receives your email address, your name, and the content of those emails.
• Whish Money: Processes subscription and wallet payments. It receives the amount, currency, and an order reference. Payment details you enter with Whish are handled by Whish and are never stored by ProductEnv.
• GitHub: If you sign in with GitHub or install the ProductEnv GitHub App, GitHub shares your profile information with us, and we write the secrets you choose to sync to your repositories as GitHub Actions secrets.
• AWS: Hosts our infrastructure and database. If you connect AWS Elastic Beanstalk, we use the access keys you provide, stored encrypted, to update the environment properties you choose to sync.
• Google: Provides Google sign-in, reCAPTCHA bot protection on the sign-in form, and Google Analytics, which we use to understand aggregated traffic on our website and dashboard.

Users have certain rights regarding their personal information, including:

• Access and Updates: Users can review and update their personal data through their account settings.
• Data Deletion: Users may request the deletion of their account and associated data, subject to certain legal and operational requirements.
• Opt-Out Options: Users can opt out of non-essential communications, such as marketing emails, by adjusting their preferences.
• Data Portability: Where applicable, users may request a copy of their data in a structured format.

To exercise any of these rights, users may contact us via the methods outlined in the “Contact Us” section.

If you have any questions, concerns, or requests regarding your privacy or data protection, please reach out to us through our ticketing system on the ProductEnv platform or via email at contact@product-env.com. We aim to respond to inquiries promptly and ensure that all privacy-related concerns are addressed appropriately.

We may update this Privacy Policy periodically to reflect changes in our practices, services, or legal requirements. Any modifications will be posted on this page, and we encourage users to review this policy regularly to stay informed about how we protect their data. Continued use of ProductEnv after updates signifies acceptance of the revised policy.