Privacy Policy
Last changed · In force from 12 October 2026
This policy says what personal data SisleLabs OOD ("Puncho", "we") holds about the people who use Puncho and visit this website, why we hold it and what you can do about it.
It covers data we decide about ourselves: accounts, sign-ins and billing. A workspace can also hold personal data that a customer chose to put there, such as a name in a brief. That data is the customer's, we handle it on their instructions, and the Data Processing Agreement covers it. If your data is in a workspace because an agency or a brand put it there, ask them first. We will help them answer you.
Who is responsible
The controller is SisleLabs OOD, EIK 208739066, registered at 4 Deseta Street, 4415 Zvanichevo, Bulgaria.
For anything about your personal data, write to support@puncho.app.
We have not appointed a data protection officer.
This website
This website sets no cookies and runs no analytics or advertising scripts. Its fonts are served from our own address, so your browser asks no font service for them.
Like any website, the server that sends you a page sees your IP address and your browser's description while it does so.
The "Ask AI about Puncho" links in the footer open ChatGPT, Claude, Gemini or Grok in a new tab. Nothing is sent to them unless you click, and what happens there is under their policies.
The app: what we hold about you
Puncho has no public sign-up. You get an account because someone invited you to a workspace.
| What | Details | Where it comes from |
|---|---|---|
| Your account | Name, email address, and a password stored only as a hash | You, when you accept an invitation |
| An invitation | The email address invited, the role offered, who invited, and when it expires | The person who invited you |
| Your membership | Which workspaces you are in, your role in each, and the last time you used each one | Your use of the app |
| Your sessions | A session token, the IP address and browser description you signed in from, and when the session expires | Your browser |
| API tokens | The name you gave the token, a hash of it, when it was made, last used and revoked. The token itself is shown once and not kept | You |
| Apps you connected | Which AI app you approved, for which workspace, and the tokens issued to it | You, when you approve the app |
| What your agent is doing | For an agent working under your account: which app, which project and concept, and its current step | The agent's calls |
| Your decisions | That you approved or rejected an ad, or scheduled a post, and when | Your use of the app |
Other people in the same workspace can see your name, your email address, your role and when you were last there. The time you were last seen is kept per workspace, so one workspace does not learn what you do in another.
Billing
Card payments go through Stripe. When an owner buys a plan, Stripe's own page asks for the company's name, billing address, company or VAT number and the card, and may ask for an email address. Those details are held by Stripe. We can read them in our Stripe account, and we use them for invoices and tax.
Our own database holds only the workspace's Stripe customer and subscription numbers, its plan, the billing period, the payment status, and whether the EU's register confirmed the VAT number. It holds no card number, no address and no VAT number.
These are mostly a company's details. They are personal data when the customer is a sole trader, or when the email address is a person's.
Why we use it, and on what legal ground
| Purpose | Data | Legal ground |
|---|---|---|
| Letting you sign in and use your workspace | Account, membership, sessions, tokens, connected apps | Performing the contract with the business you work for or with; our legitimate interest in running the service |
| Showing your team who did what and who is around | Membership, last seen, decisions, agent activity | Legitimate interest: a shared workspace needs to show who approved an ad that spends money |
| Keeping accounts secure | Sessions, IP address, token use | Legitimate interest in security |
| Charging for a plan and issuing invoices | Billing details at Stripe | Performing the contract; legal duties under tax and accounting law |
| Answering you when you write to us | Your message and address | Legitimate interest in answering; steps before a contract |
We make no automated decisions about you with legal effect, and we do not build profiles of the people who use Puncho for advertising.
We do not use your data, or the content of any workspace, to train AI models.
Who receives it
- Our hosting provider, Hetzner Online GmbH, in Nuremberg, Germany, runs the app and its database. Everything above sits there.
- Stripe receives billing details, as described under Billing.
- The people in your workspace see what the table above says they see.
- An AI app you connect receives whatever its tools read from the workspace. You chose that app, and it handles what it reads under your own agreement with its maker.
Your account data is not sent to the AI model providers, to Meta or to the file storage provider. Those companies receive workspace content, which the sub-processor list sets out.
We send no marketing email. The app sends no email at all today: an invitation is a link that the person inviting you copies and sends themselves.
We do not sell personal data. We disclose it when the law requires us to.
Transfers outside the EEA
Your account data stays in the European Union. Hetzner Online GmbH runs the app and its database in its data centre in Nuremberg, Germany, and under its terms data kept there is processed and stored only within the EU.
Billing details are the exception. We buy Stripe's service from its Irish company, and Stripe also processes data in the United States. Its data processing agreement covers that transfer with the EU-US Data Privacy Framework and the EU's standard contractual clauses.
How long we keep it
This is what the app does today:
- A session expires 7 days after it was last renewed, and signing out ends it. Its row is not removed from the database when it expires.
- An invitation expires, and an admin can cancel it. The record of it stays.
- A revoked API token stops working at once. Its record stays, without the token.
- A disconnected app has its approval and tokens deleted at once.
- A member removed from a workspace loses access at once. Their account stays, because it may belong to other workspaces, and so does the record of what they approved.
- Your account stays until it is deleted. You can have it deleted at any time, and once it is we keep nothing of it.
To have your account or any of the data above deleted, write to support@puncho.app. We delete it within 31 days. We do it by hand today, and a button in the app that does the same is being built.
When a workspace is closed, we delete the accounts that belonged only to it within 31 days.
Backups are kept for 31 days, so what we delete is gone from them 31 days later.
Stripe keeps billing records under its own rules, and we keep invoices for as long as tax and accounting law requires.
Cookies and browser storage in the app
The app sets one cookie when you sign in. It holds your session and is needed to keep you signed in. It is not readable by scripts and is sent only over HTTPS. Connecting an AI app goes through the same sign-in.
The board also keeps a few preferences in your browser's local storage: which panels are open, the image model you last picked, and which concepts you have already seen. They stay in your browser and are not sent to us.
The app sets no analytics or advertising cookies. Because the only cookie is strictly necessary, the app shows no cookie banner.
When you pay, you are on Stripe's page, and Stripe sets its own cookies there.
Security
- Every page and file in the app needs a signed-in member, apart from the sign-in page, an invitation link, and a client report opened with its own secret link.
- A few addresses answer without a sign-in and check a secret of their own: the address AI apps connect to (an API token or an approved app), the addresses our own scheduled jobs call, the address Stripe reports payments to, and the short-lived signed links Instagram uses to fetch a scheduled post's picture. A health check answers anyone and returns no data.
- Every read and write is limited to the workspace you belong to.
- Passwords and API tokens are stored as hashes.
- Files are served only to members of the workspace that owns them.
The Data Processing Agreement lists the measures in more detail.
Your rights
Under the GDPR you can ask us to:
- tell you what we hold about you and give you a copy;
- correct it;
- delete it;
- restrict how we use it, or object to a use that rests on our legitimate interest;
- hand it to you in a form another service can read.
Write to support@puncho.app. We answer within one month. There is no export or delete button in the app today, so we do these by hand. Both buttons are being built.
You can also complain to a supervisory authority. In Bulgaria that is the Commission for Personal Data Protection (КЗЛД), cpdp.bg.
Children
Puncho is a tool for businesses. It is not meant for anyone under 18, and we do not knowingly hold accounts for children.
Changes to this policy
We will post any change here with its date. If a change matters to how we use your data, we will tell the owners of each workspace before it takes effect.
Contact
SisleLabs OOD, 4 Deseta Street, 4415 Zvanichevo, Bulgaria. Privacy questions: support@puncho.app. Everything else: support@puncho.app.