Privacy Policy

This policy explains what personal data Aeeiee Inc. collects when you visit our website or use 3mote, why we collect it, who we share it with, how long we keep it, and the choices you have. We have tried to say it plainly and to state only what the product actually does.

3mote is currently in private beta, and access is by invitation.

1. Who we are

3mote is an all-in-one remote-work platform: Kanban boards with tasks, tickets, events and announcements; chat; a wiki; time tracking and timesheets; performance reports; and workspace settings. It is provided by Aeeiee Inc., a Delaware corporation, 131 Continental Drive, Suite 305, Newark, DE 19713, USA (“Aeeiee”, “we”, “us”).

This policy covers:

• the marketing and documentation site at www.3mote.com;
• the 3mote web app, where each organisation’s workspace lives at its own address under 3mote.com, and the sign-in page at login.3mote.com;
• the 3mote iOS and Android apps.

Questions and requests about this policy go to 3mote@aeeiee.com.

2. Our two roles

How we handle your data depends on whose data it is.

Workspace content. Each customer organisation has a workspace. What the organisation and its people put into it (cards, comments, chat, wiki pages, files, timesheets, client records and so on) is the customer’s content. For that content the customer is the controller (in California terms, the business), and Aeeiee is a processor (a service provider) that handles it on the customer’s instructions. If you use 3mote through your employer or another organisation, that organisation decides what is collected and how it is used, and its own privacy notice applies alongside this one.

Account, website and service-operation data. For the data we need to run accounts, secure the service and operate the website, Aeeiee is the controller.

Where a request concerns content inside a workspace, please contact your workspace administrator first. We will help the customer respond.

3. Information we collect

3.1 Account information

When your workspace administrator invites you, or you set up your account, we hold:

• your name, email address, job title, phone number, time zone, language, theme preference and profile photo (some of these are optional);
• your workspace membership and role (owner, admin, manager, member, commenter, reader or guest);
• the invitation record that let you join.

Passwords are handled by Amazon Cognito, our authentication provider. Aeeiee never stores your password; it passes through our service once, when you accept an invitation and set it.

3.2 Signing in with Google, Apple or Microsoft

If you choose to sign in with Google, Apple or Microsoft, the provider sends us an identity token. From it we use only your email address (for Microsoft, only when the provider has verified it) and the account identifier that the provider assigns to you, which we store so that your 3mote account stays linked to that sign-in. We do not use the name the provider holds for you. Apple may give us a private relay address instead of your real email.

Social sign-in works for existing users only. It never creates a 3mote account and never adds anyone to a workspace. We do not receive your provider password, and we do not read your contacts, mail, calendar or files from these providers.

3.3 Workspace content

Depending on how your organisation uses 3mote, a workspace can contain:

• Cards and boards: tasks, tickets, events and announcements; their descriptions, comments, emoji reactions, labels, attendees and attachments; and a permanent per-field activity history that records who changed what, and when.
• Wiki: pages with their version history, comments and sharing settings, and a record of wiki actions (who edited, moved, published, restored or shared which page).
• Chat: messages, channels, direct messages, threads, reactions and attachments.
• Time and reports: time entries, timers, timesheet submissions and approvals, and the layout of your reports dashboard.
• Client records: company, contact name, email, phone, address, documents and notes. These can include personal data about the customer’s own clients, which the customer is responsible for having a proper basis to hold.
• Notifications and read state: what has been sent to you and what you have seen.

3.4 Presence and realtime activity

To make the app feel live, we derive whether you are online or offline from your open connections, and we show typing indicators and read receipts to the people you are working with. We keep records of open WebSocket connections for as long as the connection is open.

3.5 Devices and push notifications

If you turn on notifications, we store the token that identifies your device to its push service: Apple Push Notification service on iOS, and Firebase Cloud Messaging on Android, delivered through Amazon SNS. For the web app, we store the browser’s Web Push subscription, which is issued by your browser vendor’s push service. For mobile push tokens we also store the device name, the app version and the app’s bundle identifier; for web push we store the browser’s user agent. Push notifications can include the sender’s name and a short preview of the message, and that content passes through Apple’s, Google’s or your browser vendor’s push service on its way to your device. The tokens and this device information are used only to deliver notifications to you.

3.6 Link previews

When someone posts a link in chat, our servers fetch that page to build a preview (a title, a description and the address of an image), and we store that preview data. Each reader’s browser then loads the preview image directly from the linked website, so that website can receive the reader’s IP address and browser details.

3.7 Technical and operational data

Our hosting infrastructure (Amazon Web Services, including CloudFront and API Gateway) processes your IP address, browser and device type, and request metadata in order to deliver and secure the service. Our operational logs record the request method and path, user and workspace identifiers, and timings. We keep these logs for up to 90 days.

3.8 Email we send

We send transactional email only: invitations, password-reset codes, and notices when an account is deactivated or reactivated. These are sent through Amazon SES from noreply@3mote.com. We do not send marketing email today.

3.9 What we do not do

• We do not use analytics, advertising or tracking pixels.
• We do not sell personal data, and we do not share it for cross-context behavioural advertising.
• The marketing site (www.3mote.com) sets no cookies and loads no third-party scripts. Its fonts are served from our own domain.

3.10 Artificial intelligence

3mote does not currently use artificial intelligence to process Customer Content. Before we introduce any feature that does, we will update this policy and describe how that content is used.

4. How we use information

We use personal data to:

• provide, operate and support 3mote, including authenticating you, applying your workspace’s roles and permissions, and delivering messages and notifications;
• keep the service secure, prevent abuse, and investigate incidents;
• respond to your requests and communicate with you about your account and the service;
• meet our legal obligations and enforce our terms; and
• understand and fix operational problems, using the logs described above.

For workspace content, we do these things only on the customer’s instructions and for the purpose of providing the service to that customer.

5. Legal bases

Where the GDPR or UK GDPR applies to our role as controller, we rely on the following bases:

• Contract: to provide the service you or your organisation signed up for.
• Legitimate interests: to secure and operate the service, prevent abuse, and keep operational logs, balanced against your rights and reasonable expectations.
• Legal obligation: where the law requires us to keep or disclose information.
• Consent: where we ask for it, for example when you turn on push notifications. You can withdraw consent at any time in your device or browser settings.

When we act as a processor, the customer determines the legal basis for its workspace content.

6. Who we share information with

We do not sell personal data. We share it only as follows.

Subprocessors and other providers. We use the following providers to run 3mote. Those that process personal data for us do so only to provide their service to us; others, such as a public content delivery network, simply serve files to your browser and receive your IP address and browser details when they do.

Some of these providers also receive information directly from your browser. The web app loads fonts from Google Fonts, so Google receives your IP address and browser details, and the emoji picker loads emoji images from jsDelivr (cdn.jsdelivr.net), so jsDelivr receives the IP address and browser details of people who open it. The sign-in page loads Google’s and Apple’s sign-in scripts, and Microsoft’s library when you use that button, so those providers receive your IP address and browser details when the page loads or the button is used. Their own privacy policies govern what they do with it.

Your workspace. Other members of your workspace can see what you put there, subject to the roles and permissions your administrators have set. Workspace owners and admins manage users, roles and guests, and can deactivate accounts.

Legal and safety. We may disclose information if we believe in good faith that the law requires it, or to protect the rights, safety and security of our users, the public or Aeeiee.

Business transfers. If Aeeiee is involved in a merger, acquisition or sale of assets, personal data may be transferred as part of it. We would tell affected customers before it became subject to a materially different policy.

If we add or change a provider, we will update this list.

7. Cookies and local storage

The web app uses strictly necessary cookies on .3mote.com. They hold your sign-in session: access, ID and refresh tokens, where the refresh token is valid for up to 30 days. Because they are strictly necessary to provide the service you asked for, they are set without a consent banner.

Your browser’s local storage and IndexedDB hold your preferences (such as theme, language and layout choices), cached data, and unsaved draft autosaves. The mobile apps keep your session in the device keychain or encrypted storage.

On the sign-in page, Google’s sign-in script sets a functional cookie named g_state to remember the state of the Google button. That cookie is set by Google, not by us. There are no analytics or advertising cookies. Because we do not track you across websites, we do not change how the service works in response to a “Do Not Track” signal.

You can clear cookies and local storage in your browser at any time. Doing so signs you out and removes locally saved preferences and drafts.

8. Where your data is processed

Our production data is stored on Amazon Web Services in the US West (Oregon) region, in the United States. Content is delivered through CloudFront’s global edge network, which caches static content close to visitors.

If you are located outside the United States, your data is transferred to and processed in the United States. Where the law requires it, we rely on appropriate safeguards for those transfers, such as the European Commission’s Standard Contractual Clauses. We will enter into a data processing agreement, including those clauses where they apply, with customers on request.

9. How long we keep information

Deleting a workspace. On request (write to 3mote@aeeiee.com) we delete or anonymise the workspace’s data without undue delay, except for what we must keep for legal, security or dispute reasons. Backups roll off within 30 days, and residual file versions within about 12 months.

Exceeding plan limits. If a workspace goes over its plan’s storage limit, nothing is deleted automatically. New uploads are blocked until the workspace is back under the limit.

We may keep information longer where the law requires, or where we need it to resolve a dispute or enforce our terms.

10. Security

We use technical and organisational measures to protect personal data:

• Data is encrypted in transit with TLS, and encrypted at rest across our AWS storage. Chat message bodies are additionally encrypted with keys managed in AWS KMS.
• Workspaces are isolated from one another at the database level using row-level security, so one workspace cannot read another’s data.
• Access within a workspace follows role-based permissions.
• When an administrator deactivates a user, that user’s sessions are revoked immediately.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your data, we will notify affected customers as the law requires.

To report a vulnerability, write to 3mote@aeeiee.com with “Security” in the subject.

11. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct data that is inaccurate;
• delete your personal data;
• port your data to another service;
• object to or restrict certain processing, under the GDPR and UK GDPR; and
• under the CCPA and CPRA, know what we collect and why, delete and correct your data, and not be discriminated against for exercising these rights. We do not sell or share personal data as those laws define the terms.

To exercise a right, write to 3mote@aeeiee.com. We will confirm who you are before acting, and we respond within the time the law allows. Many profile details can also be changed directly in the app.

Content that a person authored inside a customer’s workspace belongs to that customer, so requests to delete it are handled with the workspace administrator, and we will assist the customer in responding. Where records must be kept, we may anonymise your data rather than delete it.

You also have the right to complain to your local data protection authority. We would welcome the chance to address your concern first.

12. Children

3mote is built for businesses and is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has given us personal data, write to 3mote@aeeiee.com and we will delete it.

13. Changes to this policy

When we change this policy, we post the new version here and update the “Last updated” date at the top. For material changes, we will notify workspace owners by email or in the app before the changes take effect.

14. Contact

Aeeiee Inc.
131 Continental Drive, Suite 305
Newark, DE 19713, USA

For privacy, legal and security questions: 3mote@aeeiee.com.