Privacy Policy

1. Scope and our role

This policy covers personal data processed through the Service. For the personal data a company adds about its employees, team members, and visitors, that company is the data controller and Ping acts as its processor, handling the data on the company's instructions to provide the Service.

For data we process for our own purposes — such as operating, securing, and improving the Service — we act as the controller.

2. Information we collect

Company and account data: company name, workspace identifier (slug), branding (logo, colors, theme), and administrator contact details.

Team and people data: names, work phone numbers, and email addresses you add for administrators and service-team members; optional requester names on requests.

Request data: the service requested, quantity, optional notes, room and floor, and the timestamps and status of each request.

Technical data: limited log, security, and device/connection information needed to operate, secure, and troubleshoot the Service.

Acquisition data: when you register in the same browser session after visiting a public Ping page, we may record the landing path, referring hostname, and approved campaign parameters. We do not store the full referring URL for this purpose.

We do not run third-party advertising or analytics trackers, and we do not build advertising profiles.

3. How we use information

To provide the Service — routing requests to the right team, showing live status, and producing operational analytics for your company.

To secure the Service, authenticate users, prevent and investigate abuse, and troubleshoot problems.

To send transactional messages such as email verification, password reset, and escalation notifications.

To measure, in aggregate, which public pages and campaigns lead to successful company registrations without third-party browser tracking.

To maintain and improve reliability, performance, and features.

4. Legal bases for processing

Where data-protection law requires a legal basis, we rely on: performance of our contract with your company; our legitimate interests in operating and securing the Service; compliance with legal obligations; and consent where it is specifically required. Companies are responsible for the legal basis of the people-data they add.

5. Sharing and subprocessors

We do not sell personal data. We share it only with vetted service providers ("subprocessors") that help us run the Service under contractual confidentiality and security obligations, and with authorities where required by law.

Current categories of subprocessors: cloud object storage for uploaded logos and assets (e.g. DigitalOcean Spaces) and a transactional email delivery provider. We will keep this description current as our providers change.

6. International processing and transfers

Ping is a global service. Personal data may be processed and stored in the regions where we and our subprocessors operate, which may be outside your country. Where data crosses borders, we rely on appropriate safeguards recognized by applicable law (such as standard contractual clauses or an adequacy determination) to protect it.

7. Data retention

We retain personal data for as long as your company's workspace is active and as needed to provide the Service, then delete or anonymize it within a reasonable period, unless a longer retention is required by law or to resolve disputes and enforce agreements.

8. Security

We use measures appropriate to the risk, including encrypted transport (HTTPS), hashed passwords, signed access tokens, rate limiting, audit logging of sensitive actions, and strict per-company data isolation. No method of transmission or storage is completely secure, but we work to protect your data and to address incidents promptly. If a breach is likely to affect your rights, we will notify the relevant company and, where required, the competent authority without undue delay.

9. Your privacy rights

Subject to applicable law, you may have the right to access, correct, delete, or receive a copy of your personal data, and to object to or restrict certain processing. Company administrators can manage most data directly in the app (rooms, team, requests). For other requests, or if you are an employee or visitor, contact us and we will route the request to the appropriate company controller where needed.

Where processing is based on consent, you may withdraw it at any time, without affecting prior processing.

10. Cookies and local storage

The Service does not use advertising or tracking cookies, and does not load third-party analytics. We use local storage for essential functions: keeping you signed in (access and refresh tokens) and remembering your language and light/dark preference. We use session storage to hold the first public landing path, referring hostname, and approved UTM fields until registration succeeds or the browser session ends. Clearing browser storage signs you out, resets preferences, and removes any unsent attribution.

11. Children

The Service is intended for workplace use by adults and is not directed to children, and we do not knowingly collect personal data from children.

12. Changes to this policy

We may update this policy and will revise the "last updated" date below. For material changes we will take reasonable steps to notify you.

13. Contact

For privacy questions or to exercise your rights, contact [email protected].