This policy explains what personal data Missions (“we”, “us”) collects when you use this website and the Missions app, why we collect it and what choices you have. If anything here is unclear, write to hello@missionnops.com.

Who is responsible

For this website and for accounts we manage directly, the company that operates Missions is responsible for your data. When a company uses Missions for its team, that company decides who is invited and what is stored in its workspace; we process that content on its behalf.

What we collect

Account details: your name, email address, password (stored only as a secure hash), profile picture and role.
Workspace content: projects, missions, objectives, comments, sticky notes, custom field values and files that you or your team add.
Usage and security data: sign-in times, the devices and browsers you are signed in on, IP addresses and an audit log of important account changes.
Notification settings: your choices per notification type, and a browser push subscription if you turn push on.
Billing data: when you subscribe, Paddle collects your payment details, billing name, billing address and country, tax or VAT number (if you give one) and the transaction history. We do not see or store your full card number. We receive from Paddle what we need to run your subscription: your plan, billing period, subscription status, invoice and receipt links, the type and last digits of your card, and your billing country.
Website chat: If you use the chat on our website we keep the conversation, your name and email or phone if you share them, the page you were on, and a one-way hash of your IP address (never the address itself) so we can answer you and prevent abuse. We delete a conversation 180 days after it closes.
Live demo: If you open our live demo we keep the email (and name, if you give one) you enter, which pages and features you tried, the role views you switched to, when you visited, your device type, where you came from (for example an ad or another website) and a one-way hash of your IP address. We use it to see which features interest people and to follow up with you about Missions. The sample data you change in the demo stays in your browser and is not sent to us.
Messages to us: anything you send us by email, including the details you fill in on our contact form.

How we use it

To run the service: sign you in, show your work, send the notifications and emails you asked for, and keep your workspace in your brand.
To keep it secure: detect misuse, protect accounts and investigate problems.
To manage your subscription: start your plan, renew it, handle upgrades, downgrades, failed payments and cancellation, and send billing emails.
To support you and your company, and to reply when you contact us.
To meet legal obligations.

We do not sell personal data and we do not use your workspace content for advertising.

Cookies and local storage

The app uses one essential cookie to keep you signed in. Your browser’s local storage remembers preferences such as your theme and the last workspace you opened. Website fonts are loaded from Google Fonts, which receives your IP address when the page loads.

To measure how people find Missions and which of our ads work, our website and the sign-up and checkout steps use Google Tag Manager, Google Analytics, Google Ads and the Meta pixel. These set cookies and record visits and actions such as starting a trial or buying a plan. We remember the ad campaign that brought you (for example its UTM tags and click id) with your new workspace, and when a payment is confirmed we tell Google and Meta about it from our server, with your email address hashed so it cannot be read. We never send your workspace content, such as mission titles or comments. You can block these cookies in your browser or with an ad blocker, and Missions keeps working.

Our website also uses PostHog (hosted in the United States) to understand how visitors use it: which pages they view, what they click and recordings of their visit, with anything typed into forms hidden. It stores an anonymous id in a cookie and local storage.

Our product videos are hosted on YouTube. Nothing loads from YouTube until you press play; the player then runs in YouTube’s privacy-enhanced mode (youtube-nocookie.com) under Google’s privacy policy.

We use a small number of service providers to run Missions, and only share what they need:

Render, to host the app and its database.
Cloudflare R2, to store uploaded files, exports and backups.
Paddle, our Merchant of Record and payment processor. Paddle collects and processes your payment and billing data as an independent controller under its own privacy notice, and shares with us what we need to run your subscription.
Loops, to send account and notification emails.
Google (Tag Manager, Analytics and Ads), Meta and PostHog, to measure our website and advertising, as described under Cookies and local storage.
Your browser’s push service (for example Google, Apple or Mozilla), if you turn on push notifications.

These providers may process data outside your country. We may also disclose data when the law requires it.

How long we keep it

We keep your data while your account or your company’s workspace is active. When you delete your account, or an owner deletes the company, there is a 30-day grace period during which it can be cancelled; after that the data is deleted or anonymised. If a paid subscription ends or a payment fails, the workspace is locked but its data is kept for a limited time so you can subscribe again or export it; after that it is deleted or anonymised. The same applies when a free trial ends without a subscription. Billing records and invoices are kept as long as tax and accounting law requires, which can be longer. Read notifications are removed after 90 days. Backups are kept for a limited time and then overwritten.

We also keep usage data (how the service is used) for internal analysis. It is generally kept for a shorter period, except when we use it to strengthen security or improve how the service works, or when the law requires us to keep it longer.

Your choices and rights

Update your profile and notification settings at any time in the app.
See your active sessions and sign out other devices.
Delete your account from your settings, or ask your company’s owner to remove you.
Ask us for a copy of your data, or to correct or delete it, by writing to hello@missionnops.com. If your data belongs to a company workspace, we may pass your request to that company.

Security

Connections are encrypted, passwords are hashed, every support visit by our team is recorded in the audit log and the database is backed up daily. No system is perfectly secure, so please use a strong, unique password.

Children

Missions is a work tool and is not meant for children.

Changes

We may update this policy. When we make important changes we will update the date above and, where it makes sense, tell you in the app.

Contact

Questions or requests: hello@missionnops.com.

Have a question? Chat on WhatsApp