Ashio whistleblowing software

Privacy Policy

1. Data controller

COWBOYS AND WITCHES OÜ
Tornimäe tn 5
10145 Tallinn
Estonia
info@cowboysandwitches.org

2. Data we collect

We collect only the data you provide when using Ashio:

  • Account information (email address and company name) provided at sign-up.
  • Report data submitted through our whistleblowing forms. Reports are anonymous — we do not collect IP addresses, browser fingerprints, or any identifying information.
  • Email addresses of team members you invite to your workspace.

3. How we use your data

We use your data solely to provide the Ashio service:

  • To operate your whistleblowing portal and dashboard.
  • To send transactional emails (invitations, report alerts).
  • To comply with legal obligations.

We never sell, share, or monetize your data.

4. Third-party services

We rely on the following third-party services to operate Ashio:

  • Resend (data processor) — transactional email delivery for account invitations, report alerts, and status notifications. Email addresses and message content are only processed for the duration of delivery and are not stored by Resend.
  • Sentry (data processor) — error monitoring for our application infrastructure. Sentry collects anonymized technical data (error stack traces, page URLs excluding report pages, browser metadata) to help us diagnose and fix bugs. No personal data, report content, or identifying information is transmitted. Sentry does not use cookies. Data is processed on EU-hosted infrastructure (Frankfurt, Germany).
  • Dodo Payments (independent data controller) — subscription billing and payment processing. Payment method details are collected and processed directly by Dodo Payments and are never shared with or stored by us.

5. Where your data is stored

All data is hosted in ISO 27001-certified data centers in Switzerland. Switzerland is recognised by the EU as providing an adequate level of data protection. No data leaves Europe.

6. Data retention

We retain your account data for as long as your account is active. Report data is retained according to legal requirements under the EU Whistleblowing Directive (EU) 2019/1937. You may request deletion of your account and associated data at any time by contacting us.

7. Your rights

Under the GDPR, you have the right to access, rectify, or erase your personal data; to restrict or object to its processing; and to data portability. To exercise these rights, contact us at info@cowboysandwitches.org.