Privacy policy

Entitler helps software companies manage their plans, feature access, usage limits and customer grants. This policy explains how we handle personal information on our marketing site at entitler.co, our dashboard at entitler.app, our API at api.entitler.app and our SDKs.

Entitler is run by 1843 Inc., a Delaware corporation in the United States, which this policy calls “Entitler”, “we”, “us” or “our”. “You” means you, the person reading this, whether you visit our site, use the dashboard or write to us.

We handle personal information in line with the privacy laws that apply to us.

Entitler is a business service for companies building software. Our customers also put information about their own customers into Entitler. We handle that information differently, as explained in information about your customers.

We collect only the personal information Entitler needs to run. Most of it comes straight from you. Some is recorded automatically when your browser or code talks to our services.

Early-access list

When you ask for an invitation on entitler.co, we store your email address, which form you used and when you signed up. We use it only to invite you.

Contact form

When you write to us through our contact page, we collect your name, email address, company (if you give it), the topic you choose and your message. We store your message and email it to our team inbox at gday@entitler.co. If more messages arrive in a day than our daily limit for one sender or for the whole site, we store the extra messages without emailing them.

We never add contact-form addresses to any list, and we don’t send automatic replies.

The contact page uses Cloudflare Turnstile to check that you’re a person. Turnstile runs in a frame from challenges.cloudflare.com and processes information about your browser and device under Cloudflare’s privacy policy.

To stop our forms being misused, we use your IP address to limit how often they can be sent, and we pass it to Turnstile when we check a message. We don’t store it with your message or sign-up.

Your account

The first time you sign in to the dashboard, we create your account with your email address. We don’t ask for your name. Depending on how you sign in and protect your account, we also store:

• your password, only as an Argon2id hash with a secret pepper, never the password itself. When you set a password, we check it against Have I Been Pwned’s list of breached passwords by sending only the first five characters of its SHA-1 hash
• a recovery email address, once you confirm it, which you can use to sign in and which receives security notices
• your authenticator app’s secret, encrypted
• your recovery codes, only as hashes
• for each passkey or security key, its credential ID, public key, the name you give it, how it connects and when you last used it

Signing in with GitHub, Google, Microsoft or single sign-on

When you sign in with GitHub, Google, Microsoft or your team’s single sign-on provider, the provider sends us your account’s profile, which can include your account ID with that provider, your email address and whether it’s verified, your name and your picture. We keep only your account ID with that provider, linked to your Entitler account, and use the email address to find your account, or to create one with it. We don’t keep the rest of the profile or the provider’s access tokens.

Sessions

For each browser or device you sign in on, we store its IP address, the browser and its version, the device, the approximate city, region and country Cloudflare reports, how you signed in, and when you signed in and were last active. You can see them on your account page and sign out any device there.

When you ask for a sign-in or account link, we record the requesting browser, device and approximate city, region and country, so we can show them if you open the link on another device.

Provider requests and launch notifications

When you ask us in the dashboard to support a payment provider, we email the provider’s name, website and the details you give, with your team’s ID and name and your user ID, email address and role, to our team inbox.

When you ask to be told when a provider connection launches, we store that request with your account. When it launches, we’ll email the address your account has then, once. You can remove the request in the dashboard at any time.

Teams

We store each team’s name, its members and their roles. For each invitation, we store the email address of the person invited, their role, the inviting member and when the invitation expires. Invitations and member lists show each person by their email address.

Anyone with an invitation link can see the invitation page without signing in. It shows the team’s name, the invited email address, the role and the invitation’s sender. Treat invitation links like passwords.

Analytics, error reports and session recordings

We use PostHog to see how people use Entitler and to find and fix errors. Your browser sends it, through our own address, the pages you visit without their query strings or fragments, the referring site, any campaign tags in the link you followed, your browser, operating system, device type, screen size, language and time zone. Before anything is sent, your browser removes anything that looks like an email address and keeps only the properties we chose.

On entitler.co, PostHog doesn’t identify you. It tells visits apart with an irreversible hash of your IP address, browser and our site’s address, mixed with a random value it changes and deletes every day, so the same person counts as a new visitor each day. It also records where on each page people click and scroll, to show us which parts of a page people use.

In the dashboard, PostHog knows you by your user ID, never your email address or name, and the team you’re looking at by its ID and plan. We don’t send it your IP address. It records each dashboard session so we can see the steps that led to an error: the recording shows the layout, clicks, scrolling and the pages you move between, with every text, input and image masked, so it never shows a page’s text or anything you typed.

When something fails on either site, your browser sends PostHog the error’s name and message, with any email address and query string removed, a technical stack trace, and the API code, reason and request ID if there is one.

Logs and security

Cloudflare Workers logs record technical details of each request, such as the time, the URL and request metadata. Our own log lines record event names, internal IDs for teams, projects and users, status and timing. Our code doesn’t write email addresses, passwords, tokens, cookies or request bodies to logs.

To stop password guessing and abuse, we limit sign-in requests by IP address, with IPv6 addresses grouped by /64 network, and by email address, using Cloudflare’s rate limiting in 1-minute windows. We give Cloudflare a hash of the email address, never the address itself. We also count, in 1-hour windows, wrong sign-in codes for each email address, wrong two-factor codes for each account, and every confirmation of a sign-in account you link.

For dashboard accounts, we send these kinds of email:

• Sign-in and account links. We email a link to sign in, reset your password, sign in with your recovery email, change your email address (to the new address), confirm a recovery email and confirm it’s you before a sensitive change. Each link, and the code it shows, works once and expires after 10 minutes. Setting a new password signs you out on every other device within 5 minutes, the time an access token lasts.
• Security notices. We tell you when your email address was changed (to the old address), when your recovery email was changed or removed, or was used to sign in (to both addresses), when two-factor authentication was turned on, and when too many incorrect two-factor codes were entered within an hour.
• Invitations. The link works for 7 days. Each team sends at most 10 invitation emails to an address each day.
• Setup reminder. If, between 2 and 7 days after a project was created, it has plans but your app hasn’t asked Entitler about a customer, we email the team’s owners once with the code to connect it. Each reminder has a link that stops setup reminders for every project, and you can turn them off on your account page.
• Provider launch notifications. Only if you asked to be told when a provider connection launches, once, when it does.

We also email account owners notices about the service, such as changes to our terms, this policy, our prices or our service providers, and about their plan and payments. These emails come from no-reply@mail.entitler.app or our team, and replies go to gday@entitler.co. Apart from the launch notifications you ask for, we don’t send marketing emails.

We use personal information to:

• run the dashboard and API, and keep you signed in
• send the emails described above
• invite people on our early-access list
• read and reply to messages and provider requests you send us
• apply plan limits to teams
• find and fix errors
• see which pages and features people use, so we can improve them
• protect Entitler and its users from abuse, such as password guessing and form spam

We don’t sell personal information or use it for advertising. We use PostHog only to understand how people use Entitler and to fix errors, never to track you across other sites.

Each team is on a plan: Free, Team, Scale or Enterprise. The plan sets limits, such as how many projects, people and customers a team can have and how fast it can make API requests. Requests over a limit can be slowed or refused.

We use Entitler to run our own plans. When someone creates a team, we record it as a customer in our own Entitler account, with its ID and name and the first owner’s email address.

We also count use of some features to apply plan limits. For example, we count customer portal views once per team per day. We don’t send any individual user’s ID with this usage.

Our customers use Entitler to manage their own customers’ features and limits. To do that, they put in information about those end customers (customer data), which can include:

• an external ID, name and email address
• free-form metadata, up to 50 keys of 500 characters each
• an identity provider user ID
• subscriptions, and grants with a free-text reason
• usage events (the feature, amount, source and time) and daily totals

When someone changes customer data, we record the change’s author by their email address, or by the API key’s name when a key made it.

We handle customer data on our customer’s instructions and don’t use it for anything else. If you’re our customer, you’re responsible for giving your own customers a privacy notice and for having the right to share their information with us.

Don’t put sensitive information in metadata, such as health information, government identifiers or financial account details.

If you’re an end customer of a business that uses Entitler, please contact that business about your information. We’ll help them respond to your request.

Our marketing site, entitler.co, sets no cookies and uses no local storage of its own. Like the dashboard, it keeps your scroll position in your browser’s session storage, under tsr-scroll-restoration-v1_3, until you close the tab. On the contact page, Cloudflare Turnstile may use its own storage within its frame. We host our fonts ourselves and load no third-party scripts apart from Turnstile on the contact page and PostHog’s analytics scripts, which we serve from our own address.

The dashboard at entitler.app uses these cookies and browser storage:

The session and refresh cookies are HttpOnly, Secure and SameSite=Lax, and only the dashboard’s own address receives them. The sign-in link and sign-in provider cookies are HttpOnly, Secure and SameSite=Strict. Essential cookies and session storage are needed for the dashboard to work. Preference items only remember your choices. We use no advertising or analytics cookies: PostHog sets no cookies and no browser storage on either site.

Cloudflare runs Entitler for us. It hosts our services on Workers, stores our databases in D1 and key-value data in KV, sends our emails, and provides feature flags, rate limiting, logs and traces, and Turnstile.

PostHog receives the analytics, error reports and session recordings described above. Your browser sends them to our own address, which removes your cookies before passing them on, and PostHog stores them in the United States under the PostHog privacy policy.

Emails that reach our team inbox, including contact-form messages and replies to our emails, are stored by the provider that hosts our email.

When you sign in with GitHub, Google, Microsoft or your team’s single sign-on provider, you sign in with them directly, under their privacy policies, and they send us the details described above. When you set a password, we send Have I Been Pwned only the first five characters of its SHA-1 hash.

If you buy a paid plan, Stripe processes the payment. We give Stripe your team’s name, the email address of its owner and its Entitler ID, and you give your card or other payment details, billing address and any tax ID to Stripe directly; we never see or store card details. We keep the ID of your team’s Stripe customer with its plan. Stripe handles this information under the Stripe privacy policy.

If you connect your own Stripe account to an environment, we keep the restricted key you give us encrypted and never show it again. We use it to create the webhook that reports payments to us, read your prices, open checkouts and billing pages, and change the Stripe subscriptions of your customers when their plans change in Entitler. We create Stripe customers in your account with the name, email address and ID you hold for each customer checking out. Disconnecting deletes the key and the webhook.

We don’t sell personal information or share it for advertising. We may disclose it:

• if the law requires it
• to protect the rights and safety of Entitler, our users or others
• to a successor if our business is sold or restructured, bound to handle it on the same terms as this policy

Our databases are Cloudflare D1 databases. Cloudflare stores each one in one of its D1 regions: Western or Eastern North America, Western or Eastern Europe, Asia-Pacific or Oceania. Cloudflare’s network processes requests in data centres around the world, close to where you are.

This means we disclose personal information to Cloudflare and store it in the regions that hold our databases, and it may be processed in other countries where Cloudflare operates. Our email provider may also store messages in other countries, Stripe stores payment information in the United States and other countries where it operates, and PostHog stores analytics, error reports and session recordings in the United States.

We protect personal information with:

• HTTPS everywhere
• passwords hashed with Argon2id and a secret pepper, and checked against breached passwords
• authenticator app secrets encrypted with AES-256-GCM
• recovery codes, sign-in link tokens and codes, and invitation tokens stored only as hashes
• refresh tokens never stored: each session keeps only a random seed they’re derived from, and using an old refresh token again ends the session
• passkeys, security keys, authenticator apps and single sign-on to protect accounts
• HttpOnly and Secure session cookies
• role-based access within each team
• rate limits, including on sign-in requests, passwords, codes and forms

If a data breach is likely to cause you serious harm, we’ll tell you, and we’ll notify any regulator the law requires us to.

• Early-access list: until we no longer need it to invite you, or until you ask us to remove you. There’s no way to remove yourself on the site, so just ask.
• Contact messages and provider launch requests: until you ask us to delete them, or until you remove a launch request in the dashboard. We don’t delete contact messages automatically yet, so ask us if you want yours removed.
• Accounts: until you delete your account on your account page. Deleting it signs you out everywhere, deletes your password, authenticator app and recovery codes, deletes teams where you’re the only member, removes you from the others, revokes the invitations and keys you created (see invitations below), and deletes your setup email preferences, stop links and launch requests. We keep a record of the deleted account, with its email addresses, and of its passkeys and linked sign-in accounts, marked as deleted. There’s no self-serve export, and no way yet to remove that record yourself, so ask us through the contact page or at gday@entitler.co. We handle these requests by hand, within the 30 days described below. We’ll delete or de-identify your information, or send you a copy of it, unless we need to keep it to meet a legal obligation, resolve a dispute or enforce our terms.
• Teams: until you ask us to delete them permanently. Deleting one in the dashboard keeps its record, as described below.
• Sessions: while you stay signed in, and for at most about an hour after a session ends, then we delete it with its IP address, browser, device and location. A session ends when you sign out, 14 days after it was last active or 30 days after you signed in, whichever comes first.
• Sign-in and account links and wrong-code counts: we delete expired ones the next time anyone asks for a sign-in or account link.
• Invitations: we delete an invitation 30 days after it’s accepted or removed, and we remove the email address from it as soon as it’s removed. Until then, a pending, expired or revoked invitation keeps the invited email address, including invitations revoked when their sender deleted their account. Anyone with the Invite and manage members permission can remove an expired or revoked invitation; for a team that has been deleted, ask us. We keep counts of invitation emails for 24 hours.
• Setup reminder stop links: 1 year, then we delete them.

When a team, member, project or customer is deleted in the dashboard, it stops being used straight away. We keep the record so plan history and audit trails stay accurate. Ask us if you want it removed permanently.

You can ask for access to the personal information we hold about you, or ask us to correct it. Use our contact page and choose “Privacy”, or email gday@entitler.co.

We’ll respond within 30 days and may need to verify your identity first. There’s no charge for making a request.

Depending on where you live, the law may give you more rights, such as asking us to delete your information or stop using it. We’ll honour them.

You can browse entitler.co without telling us your identity. We need your email address to create an account, and your name and email address to reply to a message.

Entitler is a service for businesses and isn’t intended for children. You must be 18 or older to use it.

If you’re concerned about how we’ve handled your personal information, contact us first through our contact page or at gday@entitler.co. We’ll respond within 30 days.

If you’re not happy with our response, you can complain to the privacy or data protection regulator where you live.

When we change this policy, we’ll update the “last updated” date at the top. We’ll tell account holders about significant changes by email or in the dashboard at least 30 days before they take effect.

For privacy questions or requests, use our contact page and choose “Privacy”, or email gday@entitler.co.

Our terms of use also apply when you use Entitler.