Snapshot of the source text at fetch time, not a live mirror of the policy page.
Plain-English summary
Your data may be transferred to and stored in the US, potentially lacking the same protections as in the EU/UK. If you cancel your account, content is permanently deleted within 60 days. Requesting data deletion may lead to account closure and inability to use services.
Even if you trash content, it can remain in backups for up to 90 days. While generally your content is private, they may access your account as a 'last resort' to investigate restricted uses, potentially notifying authorities.
90% confidence
Ask Verbaterm
Follow up on findings with grounded answers from this review. Not legal advice.
Risk Flags
These findings highlight potential risks and typically include significant privacy concerns, or terms that could lead to unexpected costs or difficulties.
high95% confidence
Data transferred to the US may not have the same level of protection as in the EU/UK.
If you are located in the European Union, UK, or elsewhere outside of the United States, any information provided to us will be transferred to and stored in the United States and by using their websites or Services and/or providing them with personal information, you consent to this transfer.
Why it matters: Your personal data, if transferred from the EU or UK to the US, may be subject to a different level of data protection than in your home country.
Our products and other web properties are primarily housed in the United States. If you are located in the European Union, UK, or elsewhere outside of the United States, please be aware that any information you provide to us will be transferred to and stored in the United States. By using our websites or Services and/or providing us with your personal information, you consent to this transfer.
Location of site and data, paragraph 1 · Citation strength: strong
high95% confidence
Account content is permanently deleted within 60 days of cancellation.
If you choose to cancel your account, your content will become immediately inaccessible and should be purged from our systems in full within 60 days.
Why it matters: Upon account cancellation, your content becomes inaccessible immediately and is permanently deleted from their systems within 60 days.
If you choose to cancel your account, your content will become immediately inaccessible and should be purged from our systems in full within 60 days.
What happens when you delete content in your product accounts, paragraph 2 · Citation strength: strong
high90% confidence
Deletion requests may result in account closure and inability to use services.
Fulfillment of some data deletion requests may prevent you from using 37signals services because our applications may then no longer work. In such cases, a data deletion request may result in closing your account.
Why it matters: Exercising your right to erasure may lead to your account being closed and you being unable to use their services.
Fulfillment of some data deletion requests may prevent you from using 37signals services because our applications may then no longer work. In such cases, a data deletion request may result in closing your account.
Your rights with respect to your information, paragraph 2 · Citation strength: strong
medium90% confidence
Content deleted from trash cans is still retained in backups for up to 90 days total.
Anything you trash in your product accounts while they are active will be kept in an accessible trash can for about 25 days. After that time, the trashed content cannot be accessed via the application. The trashed content may remain on active servers for another 30 days, and copies of the content may be held in backups of application databases for up to another 30 days after that. Altogether, any content trashed in product accounts should be purged from all systems within 90 days.
Why it matters: Even after you trash content, it remains recoverable for about 25 days, then inaccessible but present on servers for another 30 days, and in database backups for up to an additional 30 days, totaling 90 days before full removal.
Anything you trash in your product accounts while they are active will be kept in an accessible trash can for about 25 days (it varies a little by product). After that time, the trashed content cannot be accessed via the application and we are not able to retrieve it for you. The trashed content may remain on our active servers for another 30 days, and copies of the content may be held in backups of our application databases for up to another 30 days after that. Altogether, any content trashed in your product accounts should be purged from all of our systems and logs within 90 days.
What happens when you delete content in your product accounts, paragraph 1 · Citation strength: strong
Data Use
These findings concern how your data is collected, processed, and shared. They may highlight instances of broad data collection, sharing with third parties, or uses beyond the primary purpose of the service.
medium85% confidence
Aggregate billing information may be used for marketing purposes.
We occasionally use aggregate billing information to guide our marketing efforts.
Why it matters: Your billing information, in an aggregated form, may be used to inform their marketing activities.
We occasionally use aggregate billing information to guide our marketing efforts.
Full IP address is retained to mitigate spammy signups and for security/fraud prevention.
For most of our products, we log the full IP address used to sign up a product account and retain that for use in mitigating future spammy signups. We also log all account access by full IP address for security and fraud prevention purposes, and we keep this login data for as long as your product account is active.
Why it matters: Your full IP address is logged when you sign up and for all account access, and this data is retained for the duration your account is active for spam mitigation and security/fraud prevention.
For most of our products, we log the full IP address used to sign up a product account and retain that for use in mitigating future spammy signups. We also log all account access by full IP address for security and fraud prevention purposes, and we keep this login data for as long as your product account is active.
General Geolocation data, paragraph 1 · Citation strength: strong
medium90% confidence
Web analytics data, including IP address, is tied to your user account while active.
They collect information about browsing activity for analytics, including browser/OS versions, IP address, web pages visited, load times, and referring websites. If you have an account and are signed in, these web analytics data are tied to your IP address and user account until your account is no longer active.
Why it matters: When you are signed in, your browsing activity and IP address are linked to your user account for analytics purposes as long as your account is active.
We collect information about your browsing activity for analytics and statistical purposes such as conversion rate testing and experimenting with new product designs. This includes, for example, your browser and operating system versions, your IP address, which web pages you visited and how long they took to load, and which website referred you to us. If you have an account and are signed in, these web analytics data are tied to your IP address and user account until your account is no longer active.
Email address hash may be shared with ad companies to exclude users from seeing ads.
Where permissible by law and if you have a Basecamp account, we may disclose a one-way hash of your email address with ad companies to exclude you from seeing our ads.
Why it matters: If legally allowed and you have a Basecamp account, a hashed version of your email may be shared with ad companies to prevent you from being shown their ads.
Where permissible by law and if you have a Basecamp account, we may disclose a one-way hash of your email address with ad companies to exclude you from seeing our ads.
When we access or disclose your information, paragraph 4 · Citation strength: strong
medium90% confidence
Aggregated and de-identified data may be used for any purpose, including marketing or analytics.
They may aggregate and/or de-identify information collected through the services and use this de-identified or aggregated data for any purpose, including marketing or analytics.
Why it matters: Data collected through the services may be aggregated and de-identified, and then used for any purpose, including marketing and analytics.
We may aggregate and/or de-identify information collected through the services. We may use de-identified or aggregated data for any purpose, including marketing or analytics.
When we access or disclose your information, paragraph 7 · Citation strength: strong
Cancellation and Renewal
These findings relate to the terms of service around account cancellation and subscription renewal. They may highlight conditions or processes that could be disadvantageous to the user.
✓
Looking good
No billing surprises spotted
Verbaterm only flags concerns it can cite. No cancellation, auto-renewal, or refund terms needed attention here.
Gotchas
These findings capture other potentially unfavorable terms not covered in the above sections. This might include limitations of liability, restrictions on use, or other clauses that could surprise users.
medium90% confidence
Service may not function properly if cookies are turned off.
You can adjust cookie retention settings and accept or block individual cookies in your browser settings, although our apps won’t work and other aspects of our service may not function properly if you turn cookies off.
Why it matters: Turning off cookies in your browser settings may prevent their apps from working and other parts of the service from functioning correctly.
You can adjust cookie retention settings and accept or block individual cookies in your browser settings, although our apps won’t work and other aspects of our service may not function properly if you turn cookies off.
Advertising and Cookies, paragraph 3 · Citation strength: strong
medium90% confidence
Accessing customer accounts to investigate restricted uses is a measure of last resort.
Accessing a customer’s account when investigating potential abuse is a measure of last resort. If they discover you are using products for a restricted purpose, they will take action as necessary, including notifying appropriate authorities where warranted.
Why it matters: They may access your account to investigate potential abuse, and if you are found to be using their products for a restricted purpose, they may take action, including notifying authorities.
Accessing a customer’s account when investigating potential abuse is a measure of last resort. We want to protect the privacy and safety of both our customers and the people reporting issues to us, and we do our best to balance those responsibilities throughout the process. If we discover you are using our products for a restricted purpose, we will take action as necessary, including notifying appropriate authorities where warranted.
When we access or disclose your information, paragraph 6 · Citation strength: strong
Protections
These findings highlight clauses or practices that benefit the user, such as strong data privacy commitments, clear control over personal information, or favorable terms for cancellation and refunds.
Protection95% confidence
They commit to never selling your data.
We never sell your data.
Why it helps: Your personal data will not be sold to third parties, ensuring greater privacy.
They commit to never selling personal information to third parties.
We’ll never sell your personal information to third parties, and we won’t use your name or company in marketing statements without your permission either.
Why it helps: Your personal information is protected from being sold to third parties, and your name or company won't be used for marketing without consent.
We’ll never sell your personal information to third parties, and we won’t use your name or company in marketing statements without your permission either.
Identity and access, paragraph 2 · Citation strength: strong
Protection90% confidence
Consent is required for sending newsletters and other updates.
With your consent, we will send you our newsletter and other updates.
Why it helps: You have control over whether you receive newsletters and other updates, as they will only be sent with your explicit consent.
With your consent, we will send you our newsletter and other updates.
Identity and access, paragraph 1 · Citation strength: strong
Protection90% confidence
Human access to user content is limited and requires express permission.
No 37signals human looks at your content except for limited purposes with your express permission, for example, if an error occurs that stops an automated process from working and requires manual intervention to fix.
Why it helps: Your content is generally private, with human access only for specific, limited error-fixing purposes and with your explicit permission.
No 37signals human looks at your content except for limited purposes with your express permission, for example, if an error occurs that stops an automated process from working and requires manual intervention to fix.
When we access or disclose your information, paragraph 3 · Citation strength: strong
Protection95% confidence
Consent is requested before accessing content for troubleshooting.
If at any point we need to access your content to help you with a support case, we will ask for your consent before proceeding.
Why it helps: Your consent is required before they access your content to assist with support cases or bug fixes, providing you control over your data.
If at any point we need to access your content to help you with a support case, we will ask for your consent before proceeding.
When we access or disclose your information, paragraph 5 · Citation strength: strong
Protection90% confidence
They commit to notifying users before disclosing data unless legally prohibited.
It is 37signals’ policy to notify affected users before we disclose data unless we are legally prohibited from doing so, and except in some emergency cases.
Why it helps: You will be notified before your data is disclosed, allowing you to be aware and potentially take action, unless legal constraints or emergencies prevent it.
It is 37signals’ policy to notify affected users before we disclose data unless we are legally prohibited from doing so, and except in some emergency cases.
When we access or disclose your information, paragraph 9 · Citation strength: strong
Protection90% confidence
Notification will be given if the company is acquired or merges and your data ownership changes.
If 37signals is acquired by or merges with another company, they will notify you well before any of your personal information is transferred or becomes subject to a different privacy policy.
Why it helps: You will be informed in advance if the company is acquired or merges, ensuring you are aware of any changes to how your personal information is handled and by whom.
Finally, if 37signals is acquired by or merges with another company — we don’t plan on that, but if it happens — we’ll notify you well before any of your personal information is transferred or becomes subject to a different privacy policy.
When we access or disclose your information, paragraph 10 · Citation strength: strong
Protection90% confidence
They offer various data rights to all customers, including knowledge, access, correction, erasure, complaint, restriction, objection, portability, and non-discrimination.
They strive to apply the same data rights to all customers, regardless of their location, including the Right to Know, Right of Access, Right to Correction, Right to Erasure / “To Be Forgotten”, Right to Complain, Right to Restrict Processing, Right to Object, Right to Portability, and Right to not Be Subject to Automated Decision-Making, and Right to Non-Discrimination.
Why it helps: You have comprehensive control over your personal data, including the ability to know what is collected, access it, correct it, request its deletion, complain about its handling, restrict its processing, object to its use, and port it, and you won't be discriminated against for exercising these rights.
pervisory authority. * **Right to Restrict Processing.** This is your right to request restriction of how and why your personal information is used or processed, including opting out of sale of your personal information.
Your rights with respect to your information, paragraph 2 · Citation strength: strong
Protection95% confidence
All data is encrypted via SSL/TLS when transmitted from servers to browsers.
All data is encrypted via SSL/TLS when transmitted from our servers to your browser. The database backups are also encrypted.
Why it helps: Your data is encrypted during transmission between their servers and your browser, providing security for your information in transit.
All data is encrypted via [SSL/TLS](https://en.wikipedia.org/wiki/Transport_Layer_Security) when transmitted from our servers to your browser. The database backups are also encrypted.
How we secure your data, paragraph 1 · Citation strength: strong
Protection95% confidence
Clear process for exporting data from various products is provided.
You have the right to receive the personal information we have about you and the right to transmit it to another party. If you want to export data from your accounts, you can do so directly by following these instructions for [HEY](https://www.hey.com/faqs/#if-i-don-t-like-hey-can-i-export-my-email-and-contacts), [Basecamp 5](https://5.basecamp-help.com/article/1139-export-your-basecamp-data), [Basecamp 2](https://2.basecamp-help.com/article/247-exporting-account-data), [Basecamp Classic](https://classic.basecamp-help.com/article/524-exports), [Highrise](https://support.highrise-help.com/category/314-imports-exports), [Campfire](https://support.campfire-help.com/article/146-how-do-i-export-cancel-my-account), and [Backpack](https://support.backpack-help.com/article/289-can-i-export-my-data-out-of-backpack).
Why it helps: You have the ability to easily export your personal data from various products, giving you control over your information and making it portable to other services.
If you want to export data from your accounts, you can do so directly by following these instructions for [HEY](https://www.hey.com/faqs/#if-i-don-t-like-hey-can-i-export-my-email-and-contacts), [Basecamp 5](https://5.basecamp-help.com/article/1139-export-your-basecamp-data), [Basecamp 2](https://2.basecamp-help.com/article/247-exporting-account-data), [Basecamp Classic](https://classic.basecamp-help.com/article/524-exports), [Highrise](https://support.highrise-help.com/category/314-imports-exports), [Campfire](https://support.campfire-help.com/article/146-how-do-i-export-cancel-my-account), and [Backpack](https://support.backpack-help.com/article/289-can-i-export-my-data-out-of-backpack).
Your rights with respect to your information, paragraph 2 · Citation strength: strong
Report an issue
Flag a citation problem, stale policy text, or incorrect company match.
Verbaterm boundaries
This public review is informational only and is not legal advice. Verbaterm shows only findings tied to the cited source snapshot above.