Privacy Policy & GDPR
Effective Date: September 2026 • Employee Data Sovereignty
1. Fundamental Privacy Commitments
At Sferafy, privacy is not an afterthought or compliance checkbox—it is fundamental to our system architecture. We believe that employee operational data belongs strictly to the organization and its employees:
- We do not sell, rent, monetize, or broker employee or customer data.
- We do not deploy third-party advertising cookies, retargeting pixels, or behavioral tracking beacons.
- Sensitive compensation figures and signed identity documents are never sent to unprivileged client payloads or public endpoints.
2. Information We Process
We only process data necessary to provide autonomous workspace operations:
- Profile & Authentication: Work email, display name, job title, assigned role.
- Availability Data: Daily morning check-in state, leave requests (PTO, Remote, Sick).
- Hardware Registry: Device serial numbers and specs assigned to you.
- Invoicing: Digital invoice entries, banking identifiers for Stripe settlement.
3. European Union GDPR & Data Sovereignty
For organizations operating in the European Economic Area (EEA), Sferafy complies with GDPR requirements under Articles 15 through 22, including the right of access, rectification, data portability, and the right to erasure ("Right to be Forgotten"). Upon termination of a workspace, administrative data can be permanently exported or cryptographically purged within 30 days.
4. Data Protection Officer
For any questions regarding privacy practices, GDPR inquiries, or to exercise your statutory privacy rights, contact our Data Protection Officer at privacy@sferafy.io.