Privacy Policy

Effective Date: August 1, 2026 Last Updated: August 1, 2026

Destato ("Destato," "we," "us," or "our") provides a blocker-tracking tool for engineering teams. This Privacy Policy explains how we collect, use, and protect information when you use our website and application (the "Service").

1. Information We Collect

1.1 Information You Provide

  • Account information: name, email address, workspace/organization name
  • Content you create in the Service: blockers, comments, status updates, and related metadata
  • Communications: messages you send us for support
  • Sign-up method: you can create an account with email/password or by linking a Slack account (in which case we still require and verify an email address). Authentication is handled via AWS Cognito.
  • Agreement records: when you create an account we record which versions of these Terms of Service and this Privacy Policy you accepted, and when
  • API/MCP access tokens: if you generate a Personal Access Token (PAT) for API or MCP access, we store it (hashed) to authenticate those requests. MCP access can also use OAuth instead of a PAT.

1.2 Information from Integrations

If you connect third-party services (e.g., Slack), we collect data via OAuth as authorized by you, limited to what's needed for the connected feature. Our Slack integration currently requests read and write permissions (e.g., reading messages to create blockers, posting notifications back to Slack).

1.3 Automatically Collected Information

  • Usage data: pages visited, features used, timestamps, device/browser type
  • Log data: IP address, error logs, performance data
  • Analytics: we use PostHog to understand product usage (page views, feature usage). We do not use session replay or record on-screen activity.
  • Error tracking: we use Sentry to capture crash reports and error logs, which may include contextual data present at the time of the error.

1.4 AI-Assisted Processing

Certain features (e.g., parsing Slack messages or free-text input into structured blockers) use Anthropic's Claude API to process content you or your team submits. This content is sent to Anthropic solely to generate the requested output and is handled under Anthropic's API terms, which — as of this writing — exclude API inputs/outputs from model training by default. We don't use these AI features to make decisions with legal or similarly significant effects on you without human review.

1.5 Cookies

We use strictly necessary cookies for authentication and session management. Our analytics (PostHog) run in cookieless mode and do not set tracking cookies.

1.6 Visibility Within Your Workspace

All members of a workspace can view content created by other members of that workspace (blockers, comments, status updates) — this isn't limited to admins/owners. If you invite someone to your workspace, they'll be able to see workspace data.

2. How We Use Information

We use collected information to:

  • Provide, maintain, and improve the Service
  • Authenticate users and maintain sessions
  • Send account and transactional emails (signup confirmation, email verification, password resets, invitations, and account changes) — these are necessary to operate your account and can't be turned off while your account is active
  • Send notification emails about system actions and activity from other users in your workspace (e.g., blocker updates, mentions) — configurable per-user, can be turned off in settings
  • Send optional scheduled briefing/digest emails summarizing activity — configurable per-user, can be turned off in settings
  • Monitor and improve product performance and reliability
  • Detect, prevent, and address technical issues, fraud, or abuse
  • Comply with legal obligations

We do not sell your personal information.

3. How We Share Information

We share information only with:

  • Service providers who help us operate the Service, including: AWS (application hosting, database, file storage, and content delivery), AWS Cognito (authentication), Purelymail (delivery of account, notification, and briefing emails), PostHog (analytics), Sentry (error tracking), and Anthropic (AI-assisted parsing features) — under contracts or terms requiring them to protect your data
  • Third-party integrations you connect (currently Slack) — data flows only as needed for the integration you configure
  • Legal authorities if required by law, subpoena, or to protect our rights or safety
  • Successors in the event of a merger, acquisition, or asset sale, with notice to you

Destato staff may access your data directly for customer support, troubleshooting, or debugging purposes.

4. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. Account deletion is currently a manual process — to request deletion of your account and associated data, contact us (see Section 9). Deleted data is removed from production systems promptly, but may persist in database backups for up to 30 days before those backups age out and are overwritten.

5. Data Security

We use industry-standard measures (encryption in transit, access controls) to protect your data. No system is 100% secure, and we cannot guarantee absolute security.

6. Your Rights

Depending on your location, you may have the right to:

  • Access, correct, or delete your personal data
  • Object to or restrict certain processing
  • Data portability — you can retrieve your data via our API or CLI tool at any time; we don't currently offer a CSV export from the web app
  • Withdraw consent where processing is based on consent

To exercise these rights, contact us at privacy@destato.com.

EU/UK users (GDPR): We process your data based on contract necessity (providing the Service) and legitimate interest (improving the product, security, and understanding product usage through analytics). You have the right to object to processing based on legitimate interest at any time by contacting us. You also have the right to lodge a complaint with your local data protection supervisory authority.

California users (CCPA/CPRA): You have the right to know what personal information we collect, request deletion, and opt out of sale/sharing. We do not sell personal information.

7. International Transfers

Destato is based in the United States (Alabama). If you access the Service from outside the U.S., your data will be transferred to and processed in the U.S.

8. Children's Privacy

The Service is not directed to individuals under 16. We do not knowingly collect data from children.

9. Contact Us

For privacy questions or requests, contact: Destato LLC 286 Slaughter Rd #13102, Madison, AL 35758 privacy@destato.com

10. Changes to This Policy

We may update this policy periodically. We'll update the "Last Updated" date and, for material changes, notify you via email or in-app notice.