Changes to the Policy and Contact Information.
We will now define a few terms to describe the terms used in this document.
Throughout the document, we will refer to The Landing Page as content accessible from the internet domains diggle.com and www.diggle.com. We will refer to The App as content accessible from the internet domains app.diggle.com, godiggle.com, puppeteer.diggle.com, mydiggle.com, diggleit.com, and any subdomain of diggle.com not mentioned.
The Platform encompasses The Landing Page and The App. The Service encompasses The Platform and support from Diggle employees.
A Supporting Service is defined as one of the sub-processors for The Service.
Diggle Users are people using The App in some capacity. They may be further classified into three categories:
Every Account will have one Account Owner, but may have several Diggle Creators (as agreed upon with our representatives). Because Account Owners are also Diggle Creators within their respective accounts, everything in this document that applies to Diggle Creators also applies to Account Owners.
Account: Data stored in The App for an Account Owner.
At Diggle, we value your privacy, and we will only collect information that we need to deliver The Service to you and continue to maintain and develop The Service. The following is a list of data we collect, process or store, with the purpose and legal ground listed for each item through the General Data Protection Regulation – https://www.eugdpr.org/.
User account information. Users that choose to register, will have to provide a valid email address and username. The information may be used to operate The Service and to ensure the security and integrity of The Service, maintaining back-ups of our databases, and communicating with you. This is required to deliver The Service to you as a user, by taking steps, at your request, to enter into such a contract (Terms of Service) cf. GDPR art. 6 (1) b.
Like many websites, our service providers and we may use cookies, web beacons, and other technologies to receive and store certain types of information when you interact with us through your computer or mobile device, subject to your opt-out preferences (see Your Rights and Choices section below). Using these technologies helps us customize your experience with our Services, improve your experience, and tailor marketing messages. Here are some of the information we collect:
Log & Device data. When you access The Platform, our servers automatically record information (“log data”). This log data may include the web address you came from or are going to, your device model, operating system, browser type, unique device identifier, IP address, mobile network carrier, and time zone or location. Whether we collect some or all of this information often depends on what type of device you’re using and its settings. For example, different types of information are available depending on whether you’re using a Mac, a PC, an iPhone, or an Android phone. To learn more about what information your device makes available to us, please check the policies of your device manufacturer or software provider.
We may use the information we collect about you, including personal information, to:
We do not share your personal information with others except as indicated within this Policy or when we inform you and allow you to opt out of having your personal information shared.
We may share information we collect about you, including personal information, in the following ways:
We rely on the following legal grounds to process your personal information:
We collect information globally and may transfer, process, and store your information outside of your country of residence to wherever our third-party service providers or we operate to provide you the Services. Whenever we transfer your information, we take steps to ensure your data is always safe, including preventive measures.
For all international transfers through our sub-processors, we ensure that the recipient of your Personal Information offers an adequate level of protection by entering into appropriate back-to-back agreements with our sub-processors. All international transfers are based on the EU Commission-approved standard contractual clauses (“SCCs”).
A special note:
On 04 June 2021, the EU Commission adopted two new sets of standard contractual clauses (SCC): one set for the transfer of personal data from the EU to third countries (Cross-Border SCC) and another set addressing specific clauses in controller-processor data processing agreements (DPA-SCC).
The Cross-Border SCC became applicable on 27 June 2021. Until 27 September 2021, both the “old” SCC and the new SCC could be used for contracts; after that, the old SCC was no longer used for new contracts but was continued to be deemed “appropriate” for another 15 months as long as the subject matter of these contracts remains unchanged and provided that the old SCC were “appropriate” before.
As of 27 December 2022, the use of the “old” SCC will no longer provide the necessary, appropriate safeguards for a data transfer to a third country. By then, they need to be replaced by the new Cross-Border SCC (or other appropriate means).
This means that (1) from 27 September 2021 onwards, only the new Cross Border SCC can be used for data transfers to third countries in new contracts, and (2) from 27 December 2022 onwards, all existing “old” SCC will need to have been replaced by the new SCC.
We have replaced our SCCs within this timeframe.
To ensure we comply with EU laws, we also moved our main server provider to Europe (Scaleway).
Please also refer to our DPA.
These are the third-party data processors we use to provide The Service.
Keeping your data secure is highly important to us. We have implemented technical and organizational measures to ensure that all data sent to Diggle is handled securely.
Diggle should be simple and intuitive to use. When inviting participants to join a Diggle, you can choose between different security settings. Choosing higher security settings to ensure the desired level of privacy entails additional complexity for you and the participants. It will therefore remain possible to choose simple, less secure ways to use Diggle, such as sharing a URL to invite participants without them verifying their identity or sending the final results report back to participants. Therefore, we cannot take responsibility for any breach of privacy due to Diggle being used as a simple and easy way of interacting, and this information later reaches unauthorized persons.
When asking people to join a Diggle, you have several security options:
We may change the configurations listed above without notice to provide a better or more secure experience for our users.
You should take steps to protect against unauthorized access to your device and account by, among other things, choosing a robust password that nobody else knows or can easily guess and keeping your log-in and password private. We are not responsible for any lost, stolen, or compromised passwords or for any activity on your account via unauthorized password activity.
We retain the personal data we collect for so long as reasonably necessary to fulfill the purposes for which the data was collected, to perform our contractual and legal obligations, and for any applicable statute of limitations periods to bring and defend claims.
Processing
Scaleway is the data center provider for the Diggle application. Scaleway is located in France, so you can get full protection from GDPR. They list the following compliance and certifications:
Scaleway employs a wide range of physical security measures to keep your data safe.
Scaleway’s compliance and certifications is covered here:
https://www.scaleway.com/en/about-us/our-certifications/
Scaleway’s security and resilience measures are covered here:
https://www.scaleway.com/en/security-and-resilience/
For the landing page we use DigitalOcean (US), for our hosting needs. The only personally identifiable information we store on this server is the contents of the access logs that we use to be able to identify malicious behavior. These access logs contain IP addresses. The logs are automatically deleted every two weeks.
Scaleway is also the hosting provider for images our users upload as part of the content they build
For the AI features in Diggle, we are using OpenAI. OpenAI receives only data relevant to the process of creating a Diggle, such as questions, responses, or additional prompts. This data is only used to provide the requested services and is not retained or used to train OpenAI’s models. OpenAI manages data according to strict retention policies and ensures compliance with GDPR and other applicable laws, including data encryption and access control measures.
Data at rest
Data in transit
We use standard TLS ≥ 1.2, so encryption of data-in-transit, and are rated A+ by 3rd party vendor, SSL Labs. Privacy and protection of user data are of the highest importance to us and we both have technical and operational support in place to ensure this.
Backups and Data Loss Prevention
Data is backed up continuously, and we have an automatic failover system if the primary database fails. We are running a high availability managed Postgres database from Scaleway.
User Passwords
We hash and salt all passwords with the bcrypt algorithm. So no passwords will be leaked in the event of a breach.
Employee Passwords
Passwords that are used in the line of work are stored using a password management system. We enforce 2FA where applicable and that employees use screen locks whenever they are not by their workstations.
Payment Details
Credit card information is stored with Stripe, which is a Level 1 PCI compliant payment processor. Source: https://stripe.com/docs/security/guide
Security routines
| Planned activity | Frequency |
| Re-evaluation of transfer tools at appropriate intervals, developments in the third country that may affect the level of data protection, the necessity of our own mechanisms and to the degree they have been sufficiently implemented | Minimum 2 times a year |
| Security training for personnel | Yearly and at beginning of employment |
| Revoke system, hardware and document access | At end of employment |
| Firewall settings verification for workstations and Network | 2 times a year |
| Ensure all critical system libraries are up-to-date | Continuously |
| Unit and integration tests to ensure system functionality and security | Continuously |
| External penetration tests to ensure system security | By continuously assessing the need for new tests |
Human Resource Security
Diggle is developed by Specifique Norge as, a consulting company based in Oslo, Norway. Not everyone in Specifique works with Diggle and is not given access to information and systems that relate to Diggle.
We have a process in place that ensures that employees are given access to information and systems on a need-to basis only. When employment has ended, we revoke all access that the concerned employee had.
Our lead developer is responsible for the security of the IT infrastructure, develops plans against security threats, vulnerabilities, and risks ensures IT infrastructure supports security policies, and responds to information security incidents.
For everyone with access to systems and information, these guidelines must be respected:
Continuous improvements
Our engineering practices ensure that we have security in mind in all stages of a development lifecycle. We will do our utmost to minimize any type of risk. Examples of Engineering practices:
This Policy is current as of the Effective Date set forth above. We may change this Policy from time to time, and if we do we’ll post any changes, including any material changes, on this page, so please be sure to check back periodically. If you continue to use Diggle after those changes are in effect, you agree to the revised Policy.
If you have any questions or comments about this policy, please contact us at [email protected]
Any notices must be sent to Diggle in English or Norwegian at [email protected].
