Privacy Policy

Last updated 2026-10-21

This policy explains how YDALIR SYSTEMS LTD (company no. 13144207, 167-169 Great Portland Street, London, England, W1W 5PF), the provider of Feestead, handles personal data. For questions or requests, email [email protected].

Our role

• For data about our customers and website visitors (account details, billing contacts, website analytics), we are the controller.
• For the content a workspace puts into Feestead — people's names and emails, time entries, notes, projects, clients and rates — we act as a processor on behalf of the workspace owner, who is the controller. We process it only to provide the Service.

What we collect

• Account data: name, email, company name, hashed password, access role, and optional job title and team.
• Workspace content: time entries and notes, work items and their status, projects, clients, task types, rates, budgets, and data you import from Harvest.
• Billing data: subscription status, seats and Paddle customer/subscription IDs. Card and payment details are collected by Paddle, not by us.
• Website analytics: pages visited, referrer, campaign parameters, device type and approximate country. We use our own first-party analytics: no third-party tracking scripts, no advertising cookies, and we do not store IP addresses in our analytics.
• Support emails you send us.

If you choose Google sign-in, we receive your Google account identifier, name and verified email address to authenticate you. We do not save Google access or refresh tokens.

When you import from Harvest, your Harvest token is used only while the import runs and is not saved.

Why we use it (and legal basis)

• To provide and secure the Service and your account — performance of our contract with you.
• To handle billing through Paddle — contract and legal obligations.
• To understand which pages and channels bring visitors and improve the product — our legitimate interests.
• To email you about your account, important changes and, occasionally, product updates — contract or legitimate interests; you can opt out of non-essential emails at any time.

We do not sell personal data and do not use workspace content for advertising.

Cookies

• hw_session — keeps you logged in (essential, up to 30 days).
• hw_google_state — protects the Google sign-in flow (essential, up to 10 minutes).
• hw_internal — excludes our own visits from analytics (up to five years).
• hw_flash — shows one-time messages after an action (essential, 60 seconds).
• hw_vid and hw_src — first-party analytics: a random visitor ID and how you first arrived (e.g. referrer or campaign), so we can count visits and signups by source. Kept for up to 400 days and 90 days respectively.

Paddle may set its own cookies on the checkout to process payments and prevent fraud.

Who we share data with

• Paddle (payments, invoicing, tax) — merchant of record.
• Cloudflare (network, security and delivery of the website).
• Zoho (our email provider, for support emails).
• Google (authentication, if you choose Google sign-in).
• Authorities, when required by law.

Where data is stored

Feestead runs on servers operated by us. Data may be processed outside the UK and EEA by us and by the providers listed above. Where that happens, we rely on appropriate safeguards such as the UK International Data Transfer Addendum or Standard Contractual Clauses.

How long we keep it

• Workspace content and account data: while your account is active. When a workspace owner asks us to delete the workspace, we delete it within 30 days (backups roll off within a further 30 days).
• Billing records: as long as required for tax and accounting.
• Analytics events: only as long as they are useful for understanding how people find Feestead; we review and delete old events at least once a year.

Security

Passwords are hashed, traffic is encrypted with HTTPS, session cookies are HTTP-only and secure, and access to production data is limited to people who need it to run the Service.

Your rights

Depending on where you live (including under UK GDPR and EU GDPR), you may have the right to access, correct, export or delete your personal data, to object to or restrict processing, and to withdraw consent. Email [email protected]; we reply within 30 days. If you are a member of a customer's workspace, we may refer your request to that workspace's owner. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

Changes

We will post updates here and, for material changes, email account owners.