Privacy Policy

Last updated: 6 October 2026

Introduction

This Privacy Policy explains what information SSO Portal ("we", "us") collects when you use the Service, how we use it, who we share it with and the choices you have. It applies to the Service itself; the applications you open through it have their own policies.

Information we collect

Account and profile: your name, email address, phone/WhatsApp number, profile photo, your password (stored only as a one-way hash), two-factor authentication settings, and your preferences such as theme and notification settings.
Company and organisation: the company you belong to or ask to join, your role, departments, position, who you report to and your employment type. A company administrator may enter some of this before you sign up (pre-registration).
Sign-in and security: IP address, browser and device type, sign-in times, your signed-in devices and sessions, when you were last active, verification and sign-in codes, and signals used to tell people from automated traffic on public forms (such as how a form was filled in and a small puzzle your browser solves).
Use of the Service: which applications and links you open (to show "recently opened"), notifications sent to you, and records of administrative actions taken on accounts and companies (audit and activity logs).
Messages: messages you send to colleagues (including images and GIFs you add), and when they were delivered and read. Records of emails and WhatsApp messages the Service sends you.
Push notifications: if you turn on browser notifications, the push address your browser gives us for that device.
Third-party sign-in: if you sign in with Google or Microsoft, we receive your name, email address and account identifier from that provider.

How we use your information

to create and secure your account and sign you in to the Service and your company's applications;
to run features such as sign-in codes, password reset, two-factor authentication, device and session management, messaging, notifications and the org chart;
to show members of your company whether you are online and how to reach you;
to keep your company's connected applications up to date with its people and organisation;
to send account, security and service messages, such as verification codes, sign-in alerts and notices;
to manage company membership, access approvals and support;
to detect and prevent abuse, fraud and automated attacks, and to keep the Service reliable;
to meet legal obligations.

Cookies and browser storage

We use cookies that are needed to sign you in and keep your account secure, and store a few interface preferences in your browser. We do not use advertising or analytics cookies. See our Cookie Policy for the full list.

Who we share it with

We do not sell your personal information. We share it only as follows:

Your company's owner and administrators can see your profile, roles, departments, signed-in status and activity within the company, so they can manage access.
Colleagues in your company can see your name, photo, position, department and online status in the people list and org chart, and the messages you send them. The platform administrator can also message, and be messaged by, company owners and administrators.
Applications your company uses receive your name, email address, phone number, roles, departments, position, reporting line and company details when you open them, and are kept up to date when these change. They handle that information under their own policies.
Service providers that help us run the Service: our email delivery provider, our WhatsApp gateway (messages travel through WhatsApp), your browser's push service (for example Google, Mozilla or Apple; notification contents are encrypted), GIPHY (only the search words you type when you search for a GIF; the GIFs load from GIPHY), Google and Microsoft when you choose to sign in with them, and content delivery networks that serve parts of our pages (they see your IP address, as with any web request).
Authorities, where the law requires it, or to protect the rights and safety of our users and the Service.

Support access

To help with a support request or a security issue, our administrators can temporarily sign in as your account to see what you see. These sessions end automatically after a short time and are recorded.

Data security

We use reasonable technical and organisational measures to protect your information, including password hashing, encrypted connections (HTTPS), signed requests between the Service and connected applications, two-factor authentication, and monitoring of sessions and devices. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Data retention

We keep account information for as long as your account is active. When you are removed from a company, your access ends and your account is deactivated; records may be kept for a reasonable period afterwards to meet legal obligations, resolve disputes, keep audit trails and enforce our agreements. Old notifications and some technical logs are deleted automatically after a set period.

Your choices and rights

You can view and update most of your information, change your password, manage two-factor authentication, sign out other devices and turn push notifications on or off from your profile.
You can ask for a copy of your information, ask us to correct it, or ask for your account to be deleted by contacting your company administrator or the platform administrator. Some records may need to be kept as described above.
Depending on where you live, you may have further rights under data protection law, such as objecting to certain uses of your information.

Children's privacy

The Service is for workplaces and is not directed to anyone under 16. We do not knowingly collect personal information from children.

Changes to this Policy

We may update this Privacy Policy from time to time. Changes are shown by the "Last updated" date above, and significant changes will be announced in the Service.

Contact

If you have questions about this Privacy Policy or your information, please contact your company administrator or the platform administrator.