Privacy Policy

1. Introduction and Scope

This Privacy Policy describes how Satellite Holding Company LLC, a Delaware limited liability company ("Satellite," "we," "us," or "our"), collects, uses, and shares information when you use Satellite SaaS (the "Service"). This policy applies to organizational users and administrators of the Service.

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use the Service.

Roles: To the extent that we process "Customer Data" (as defined below) on your behalf, we act as a Data Processor. For "Account Data" and other information we collect for our own business purposes (such as billing, security, and product improvement), we act as a Data Controller.

2. Information We Collect

2.1 Account Data (Controller)

When you create an account or manage your organization, we collect information such as:

• Name and work email address
• Organization name and details
• Account credentials (passwords are securely hashed)
• User role (e.g., Owner, Admin, Member) and permissions within your organization

2.2 Customer Data (Processor)

We process data that you upload, connect, or import into the Service ("Customer Data") on your behalf. This includes:

• Google Workspace Data: If you connect Google Workspace, we access User Directory (names, emails, org units) and Licensing Data (SKU assignments) via Google APIs. Connected app discovery may be available as a future feature and will be disclosed separately when enabled.
• Zoom Data: If you connect Zoom, we access user directory and license type information via Zoom APIs.
• Expense Data: Financial transaction data you upload, including vendor names, amounts, dates, and descriptions from expense reports or credit card statements.
• Imported Data: Application and vendor data you upload via CSV or manually enter into the Service.

We access this data solely to provide the Service's core functionality, including matching expense transactions to applications to provide consolidated spend visibility. We do not use Google Workspace or Zoom data for advertising purposes. Satellite's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2.3 Billing Data

If you subscribe to a paid plan, payment information (such as credit card details and billing address) is collected and processed by our payment processor, Stripe, Inc., a PCI DSS Level 1 certified service provider. Satellite does not store full credit card numbers on its servers. We store only Stripe-issued customer and subscription identifiers necessary to manage your subscription.

2.4 Product Usage Data

We automatically collect information about how you use the Service to improve our product and security, including:

• Log data (IP address, browser type, operating system)
• Device information
• Pages visited and features used
• Actions taken within the Service (e.g., creating applications, importing expenses, setting alerts)

Some of this data is collected via Google Analytics 4 (through Google Tag Manager) and is processed by Google. See Section 9 for details on the specific cookies used and your opt-out choices.

2.5 Support Communications

If you contact us for support, we collect information you provide such as your name, email address, and the content of your communications.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Authenticate users and secure your account
• Process transactions and send renewal notifications
• Respond to your requests, questions, and support inquiries
• Monitor and analyze usage trends to improve user experience
• Detect, prevent, and address technical issues and security vulnerabilities
• Send service-related announcements and updates (non-marketing communications)
• Measure the effectiveness of our advertising (using hashed, non-reversible identifiers — see Section 5)
• Comply with legal obligations and enforce our Terms of Service

Aggregated Data: We may aggregate or de-identify information so that it is no longer linked to you or your device. We may use such aggregated and de-identified data for any purpose, including but not limited to research, analysis of usage trends, and improvement of the Service.

We do not use your data for marketing purposes without your explicit consent.

4. Legal Bases for Processing

We process your personal information based on the following legal grounds:

5. Data Sharing and Subprocessors

We do not sell your personal information. We engage third-party entities ("Subprocessors") to assist in providing the Service. We currently use the following categories of Subprocessors:

• Infrastructure and Hosting: Amazon Web Services (AWS) and MongoDB Atlas.
• Email Delivery: AWS SES (Simple Email Service) for transactional emails (e.g., notifications, invites, password resets).
• Payment Processing: Stripe, Inc. for subscription billing and payment processing. Stripe is PCI DSS Level 1 certified.
• Background Processing: Upstash (serverless Redis) for job queue management. No customer personal information is stored in Upstash; only job metadata (job IDs and timestamps).
• Integrations: Google APIs (Google Workspace), Zoom APIs (when you connect these accounts).
• Analytics: Google Analytics 4 (via Google Tag Manager) for anonymous website usage analytics. See Section 9 for details on cookies used.
• Advertising Measurement: Google Ads for conversion measurement. When you sign up after clicking a Google ad, we send a hashed (SHA-256) version of your email address and, if available, the Google click identifier (GCLID) to Google Ads to measure ad effectiveness. No plaintext email addresses are shared with Google Ads.
• Website Visitor Identification: Apollo.io, which identifies the company (organization) associated with website visitors using firmographic data, to help us prioritize business outreach. We have enabled company-level identification only; we do not use Apollo to identify individual visitors.

We may also share your information to comply with legal obligations, enforce our terms, or protect our rights.

All third-party service providers are contractually obligated to protect your data and use it only for the purposes we specify.

6. International Data Transfers

The Service is hosted and operated primarily in the United States (AWS us-east-1 region). If you are located outside the United States, please be aware that your information will be transferred to, processed, and stored in the United States.

For transfers of personal data from the European Economic Area (EEA), United Kingdom, or Switzerland to the United States, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, as well as any applicable adequacy decisions. Our Subprocessors (including AWS, MongoDB Atlas, and Stripe) maintain their own SCCs and data processing agreements.

7. Data Retention and Deletion

We retain your information for as long as your account is active or as needed to provide the Service. If you close your account or request deletion:

• Personal information is scheduled for deletion upon account closure, with a 30-day grace period during which you may cancel the deletion and reactivate your account. After the grace period, your data is permanently and irreversibly deleted.
• Aggregated usage metrics are automatically purged after 90 days.
• Aggregated and de-identified data that cannot be linked back to you or your organization is not subject to deletion requests and may be retained indefinitely.

We may retain certain information beyond these periods where required by law, regulation, or legitimate security purposes (e.g., audit logs retained per legal requirements).

You may request deletion of your data at any time by contacting us at [email protected]. We will process your deletion request within the timeframes required by applicable law.

8. Security Measures and Breach Notification

We implement industry-standard technical and organizational measures to protect your information, including:

• Encryption of data in transit (TLS/SSL) and at rest (AES-256)
• Secure authentication mechanisms (bcrypt password hashing, JWT tokens)
• Access controls and role-based permissions
• Infrastructure monitoring and periodic security reviews

In the event of a security breach that affects your personal information, we will notify you and relevant authorities as required by applicable law, typically within 72 hours of discovery.

9. Cookies and Similar Technologies

We use essential cookies and client-side storage necessary for the Service to function, as well as analytics and advertising cookies to understand how visitors find and use our website and to measure the effectiveness of our advertising.

Google Analytics and Google Ads cookies are set via Google Tag Manager. Data collected by these cookies is processed by Google in accordance with the Google Privacy Policy. We use this data solely to analyze website traffic and measure advertising effectiveness; we do not use it for remarketing or interest-based advertising.

You can opt out of advertising and analytics tracking at any time using the "Your Privacy Choices" link in the site footer, which disables Google Analytics, Google Ads, and company-level visitor identification on your browser. We also honor the Global Privacy Control (GPC) signal: if your browser advertises GPC, we treat it as an opt-out automatically. In addition, you can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on, and manage your Google Ads personalization settings at Google Ads Settings.

10. Your Rights and Choices

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal information
• Data Portability: Request a copy of your data in a structured, machine-readable format
• Objection: Object to certain processing activities
• Restriction: Request restriction of processing in certain circumstances

To exercise any of these rights, please contact your organization's administrator or email us at [email protected]. For data export requests, we will provide your data in a structured, machine-readable format (JSON) within the timeframes required by applicable law. For account deletion requests, a 30-day grace period applies during which you may cancel the deletion by contacting us.

If you are located in the EEA, UK, or Switzerland, you also have the right to lodge a complaint with your local data protection authority if you believe we have not adequately addressed your privacy concerns. We encourage you to contact us first so we can try to resolve the issue.

11. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child, we will take steps to delete such information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice on the Service prior to the effective date of the changes.

Your continued use of the Service after such modifications constitutes your acceptance of the updated Privacy Policy.

13. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), provides you with specific rights regarding your personal information.

13.1 Your CCPA Rights

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale/Sharing: Satellite does not sell your personal information for money. To the extent our use of advertising and analytics cookies may be considered "sharing" for cross-context behavioral advertising under the CCPA, you can opt out at any time using the "Your Privacy Choices" link in the site footer, and we honor browser-based opt-out signals such as Global Privacy Control (GPC).
• Right to Limit Use of Sensitive Personal Information: We do not use or disclose sensitive personal information for purposes other than those permitted under the CCPA.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

13.2 Categories of Personal Information

The following table describes the categories of personal information we have collected in the preceding 12 months:

We have not sold or shared any personal information in the preceding 12 months.

13.3 Submitting a Verifiable Consumer Request

To exercise your CCPA rights, you may:

• Email us at [email protected] to submit your request
• Email us at [email protected]

We will verify your identity before processing your request by confirming your email address and account ownership. We will respond to verifiable consumer requests within 45 days of receipt. If we require additional time (up to an additional 45 days), we will inform you of the reason and extension period in writing.

You may designate an authorized agent to make a request on your behalf. We may require the authorized agent to provide proof of your written permission and verify their own identity.

14. Contact Information

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

• General inquiries: [email protected]
• Privacy, data protection, and security: [email protected]

Data Protection Contact: For privacy-related inquiries, including GDPR and CCPA requests, contact us at [email protected].