This Privacy Policy applies to information collected by Birdie through the Birdie Site, any Birdie computer software available from the Birdie Site ("Birdie Software") and any Birdie services purchased or otherwise made available from the Birdie Site ("Birdie Services") (collectively, the "Birdie Properties").
This Privacy Policy does not apply to the practices of any third party websites, applications or services that Birdie does not own or maintain (collectively, “Third Party Services”) or to any third parties that use the Birdie Application Programming Interface (API) to perform any function related to the Birdie Properties (“Integrated Platforms”). In particular, this Privacy Policy does not cover any information or other content you can view via the Birdie Properties on Integrated Platforms or information you provide to Third Party Services accessed via the Birdie Properties. As further detailed below, we cannot take responsibility for the content or privacy policies of any Third Party Services.This Privacy Policy also does not cover any information, recorded in any form, about more than one individual where the identity of the individuals is not known, cannot be inferred from the information, and is not linked or reasonably linkable to an individual, including via a device (“Aggregated Information”). Birdie retains the right to use Aggregated Information in any way that it reasonably determines is appropriate.
By using the Birdie Services or otherwise providing us with your Personal Information (as defined below), you are accepting the practices described in this Privacy Policy, as they may be amended by us from time to time, and agreeing to our collection and use of your information in accordance with this Privacy Policy. If you do not agree to the collection, use and disclosure of your information in this way, please do not use any of the Birdie Properties or otherwise provide Birdie with Personal Information.
Birdie (“our”, “us” or “we”), respects your privacy and is committed to protecting it through our compliance with this privacy policy (“Privacy Policy”).
Birdie collects only the information required to provide products and services to you. The amount of information provided by you and collected by Birdie depends on the circumstances. Birdie may collect two (2) types of information about you: Personal and Non-Personal.
“Personal Information.” Personal Information means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, or is otherwise defined as personal information under applicable law. Birdie may collect Personal Information when you use the Birdie Properties including, without limitation, setting up account information, filling out surveys, corresponding with Birdie, or otherwise volunteering information about yourself.
“Non-Personal Information.” Non-Personal Information refers to information that does not meet the definition of Personal Information above. Birdie may collect Non-Personal Information through any of the methods discussed above as well as automatically through use of industry standard technologies described further below.
Registration. Prior to using one or more of the Birdie Properties, Birdie may require you to provide us with certain Personal Information and Non-Personal Information to create an account (“Account”) or to enable features or functionality of the Birdie Properties.
Users. Birdie may gather Personal Information about organizational representatives via various methods (phone, email, online forms, in-person meetings) but only if such Personal Information is submitted voluntarily. Birdie may use such Personal Information for sales, marketing, and support of the Birdie Properties. This Personal Information is never shared with third parties other than Third Party Service Providers utilized by a User in connection with Birdie Services.
User communications. When you send email or other communications to us, we may retain those communications in order to process your inquiries, respond to your requests and improve the Birdie Properties.
Payment Information. When creating an Account, for certain Birdie Properties, or when you make online purchases, you may be asked to provide information, which may include your payment instrument number (e.g., credit card), your name and billing address, and the security code associated with your payment instrument (e.g., the CSV) and other financial data (“Payment Information”). We use Payment Information to complete transactions, as well as for the detection and prevention of fraud. When you provide Payment Information while authenticated, we will store that data to help you complete future transactions without your having to provide the information again. We do not, however, retain the security code associated with your payment instrument (e.g., the CSV) in this manner. To remove or modify Payment Information, please contact us. After you close your account or remove Payment Information, however, we may retain your Payment Information for as long as reasonably necessary to complete your existing transaction and for the detection and prevention.
Information Collected Through Technology. Birdie automatically collects and receives certain information from your computer or mobile device, including the activities you perform on the Birdie Site, the Birdie Software and the Birdie Services, the type of hardware and software you are using (for example, your operating system or browser), and information obtained from cookies (see below). If you have an Account, we may link this Non-Personal Information to your Account to better understand your needs and the needs of Users in the aggregate, diagnose problems, analyze trends, provide services, improve the features and usability of the Birdie Properties, and better understand and market to our customers and Users.
We use technology to automatically gather information by the following methods:
Information You Provide About a Third Party. You may have the opportunity to communicate with others from the Birdie Properties, such as by sending an invitation to a friend. If you choose to take advantage of this functionality, we may ask you to provide us with certain information about the person with whom you wish to communicate (e.g., name, email address, etc.). Birdie collects such information for the purposes of facilitating the requested communication, which may contain a specific promotional message from you (e.g., an invitation to watch a video). Unless we explicitly say otherwise, Birdie will not use this information for other marketing purposes without first obtaining consent from the person to whom the relevant information pertains. Please be aware that when you use any invitation functionality on the Birdie Properties, your email address, name or username, and message may be included in the communication sent to your addressee(s).
Personal Information. Birdie identifies the purpose for which your Personal Information is collected and will be used or disclosed. If that purpose is not listed below, we will identify any additional purposes for which we will collect your Personal Information, before or at the time of collection, and we will obtain your consent to collect, use or disclose your Personal Information for such additional purpose(s).
By using the Birdie Properties, you will be deemed to consent to our use of your Personal Information for the purposes of:
Users utilize Birdie Properties to manage and deliver Content to Viewers. As part of this process, Birdie may collect Personal Information from you.
Otherwise, we will obtain your express consent (by verbal, written or electronic agreement) to collect, use or disclose your Personal Information. You can change your consent preferences at any time by contacting us (see the “How to Access, Change and Erase Your Personal Information” section below).
Birdie extends the rights granted to “data subjects” under the General Data Protection Regulation (Regulation (EU) 2016/679) (the “GDPR”) to all of its Users. Consequently, you have the right to withdraw your consent to our processing of your Personal Information at any time (if our processing is based on consent) and the right to object to our processing of your Personal Information (if processing is based on legitimate interests).
Non-Personal Information. Birdie may use Non-Personal Information for the following purposes:
Upon request, Birdie will allow Users to update or correct Personal Information previously submitted, but only to the extent such activities will not compromise privacy or security interests. Additionally, upon request, Birdie will delete Personal Information from the database where such information is stored; however, it may be impossible to entirely delete a User’s entry without some residual information being retained due to the manner in which data backups are maintained. Requests to delete Personal Information may be submitted to privacy@birdie.so
Users also have the right to receive their Personal Information from us in a structured, commonly used and machine-readable format, and the right to transmit their Personal Information to another controller without hindrance from us (data portability).
Birdie may use your Personal Information to send you emails periodically listing promotions or events relating to the Birdie Properties. You have the choice to opt-out of receiving such promotional emails by sending an email to privacy@birdie.so and/or following the instructions in such correspondence. Once Birdie's has processed your opt-out request, Birdie will not send you promotional emails unless you opt back in to receiving such communications.
Except as described below, we do not sell, transfer or otherwise disclose, sell, trade, or otherwise transfer your Personal Information to outside parties. This statement does not include trusted third party service providers who assist us in administering and providing the Birdie Properties or provide services to us. Examples include storing and managed Content, analyzing data, providing marketing assistance, integrations of Third Party Services such as CRM and MAP services, processing credit card payments, and providing customer service. These third party service providers will have access to Personal Information needed to perform their functions, but may not use it for other purposes, and they are subject to appropriate agreements with Birdie and/or its Users to secure and protect the confidentiality of your Personal Information.
We may use service providers located outside of the United States, and, if applicable, your Personal Information may be processed and stored in other countries and therefore may be subject to disclosure under the laws of those countries. You explicitly consent and agree to such transfer, storing and/or processing of your Personal Information outside of the United States or other country in which you are located.
We may share Payment Information with third parties for purposes of fraud prevention or to process payment transactions.
We may also release your information when we believe release is appropriate to comply with the law, enforce our policies, or protect our or others’ rights, property or for safety. We may also provide non-Personal Information to other parties for marketing, advertising or other uses.
Information, including Personal Information, is considered to be a business asset. As a result, in the unlikely event that we go out of business, enter bankruptcy or if we are acquired as a result of a transaction such as a merger, acquisition or asset sale, your Personal Information may be disclosed or transferred to the third-party acquirer in connection with the transaction.
We may also share information related to your account with your employer or organization if you have an individual Birdie account and your account email domain is owned or managed by your employer or organization.
Lastly, we may provide Users with certain usage information directly related to the videos and/or other Content that they make available through the Birdie Properties. Such information may include who watched a particular Content (if the viewer is logged into Birdie), which Content of a particular User was watched, and how many times a particular Content was watched.
Under certain exceptional circumstances, Birdie may have a legal duty or right to collect, use or disclose your Personal Information without your knowledge or consent. In accordance with applicable laws, We will not disclose any consumer information (which may include Personal Information) without your written consent, except where consumer information is required to be disclosed: (i) for billing or market operation purposes; (ii) for law enforcement purposes; or (iii) for the purpose of complying with a legal requirement.
When you create an account using a corporate email domain belonging to your employer or other organization, the organization may be able to (1) access information in and about the account, including your Personal Information; (2) disclose, restrict or access Content posted in connection with the account; and (3) control how the account is accessed or deleted.
You consent to disclosure of your information for the above purposes.
Birdie takes appropriate security measures to protect against unauthorized access, alteration, disclosure or destruction of Personal Information. These include, but are not limited to, internal reviews of: (a) Birdie's data collection; (b) storage and processing practices; (c) electronic security measures; and (d) physical security measures to guard against unauthorized access to systems where Birdie stores Personal Information.
Unfortunately, no data transmission over the internet can be guaranteed to be 100% secure. As a result, while we are committed to protecting your Personal Information, we cannot ensure or warrant the security of any information you provide to us.
All Birdie employees who access Personal Information are bound by confidentiality obligations and may be subject to discipline, including termination and criminal prosecution or unauthorized use or disclosure of Personal Information.
Some or all of the Personal Information we collect may be stored or processed on servers located outside your jurisdiction of residence, whose data protection laws may differ from the jurisdiction in which you live. As a result, this information may be subject to access requests from governments, courts, or law enforcement in those jurisdictions according to laws in those jurisdictions.
Birdie retains the Personal Information that we collect about you for as long as reasonably necessary for the purposes set out in this Privacy Policy. We also may retain your Personal Information for a longer period of time on the basis of our legitimate interests in providing or marketing our services to you or as necessary to comply with our legal obligations, to resolve disputes, and to enforce our agreements. Even if we delete some or all of your Personal Information, we may continue to retain and use information that has been aggregated or anonymised so that it can no longer be used for personal identification.
Birdie takes the privacy of children and students extremely seriously. Personal information we collect through the Birdie Services may be subject to the Children’s Online Privacy Protection Act (“COPPA”) and/or the Family Educational Rights and Privacy Act (“FERPA”).
COPPA Compliance. COPPA requires that operators of websites and online services that collect the personal information of children under 13 years of age (i) inform parents and legal guardians about their practices for collecting, using and disclosing such personal information and (ii) obtain verifiable consent from parents and legal guardians for doing so. We only collect personal information through the Birdie Services from a child under 13 if that student’s school, school district or teacher has agreed to obtain parental consent for that child to use the Birdie Services and disclose personal information to us for purposes of providing the Birdie Services, or we have directly obtained such parental consent.
If you are a student under 13, please do not send any personal information about yourself to us if your school, school district or teacher has not obtained this prior consent from your parent or guardian, or we have not obtained such consent, and please do not send any personal information other than what we request from you in connection with the Birdie Services. If we learn we have collected personal information from a student under 13 without parental consent having been obtained, or if we learn a student under 13 has provided us personal information beyond what we request from him or her, we will delete that information as quickly as possible. If you believe that a student under 13 may have provided us with personal information in violation of this Privacy Policy, please contact us at privacy@birdie.so
FERPA Compliance. FERPA protects personally identifiable information contained in students’ education records from unauthorized disclosure. Consistent with FERPA, we will only use education records, as defined under FERPA, for the purpose of providing agreed services to a school, school district or teacher. We will never share or sell FERPA-protected information, or use it for any other purposes, except as otherwise directed or permitted by the school, school district or teacher. If a parent or eligible student requests access to education records that are hosted on our servers, we will help facilitate such access.
Birdie complies with the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Information transferred from European Union member countries (as well as Iceland, Liechtenstein, and Norway), the United Kingdom ("UK") and Switzerland transferred to the United States in reliance on the Privacy Shield. Birdie has certified that it adheres to the Privacy Shield Principles with respect to such Personal Information. If there is any conflict between the policies in this Privacy Policy and data subject rights under the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification page, please visit www.privacyshield.gov
With respect to Personal Information received or transferred pursuant to the Privacy Shield Frameworks, Birdie is subject to the regulatory and enforcement powers of the U.S. Federal Trade Commission.
Types of EU, UK and Swiss Personal Information Collected. Our participation in the Privacy Shield applies to all Personal Information that is subject to this Privacy Policy and is received from the European Union and European Economic Area, the UK and Switzerland. We will comply with the Privacy Shield Principles with respect to all EU, UK and Swiss Personal Information. We may collect employment-related Personal Information regarding our employees located in the EU, the UK and Switzerland.
Purposes of EU, UK and Swiss Personal Information Collection and Use. We will only process EU, UK and Swiss Personal Information in ways that are compatible with the purpose for which we collected the EU, UK and Swiss Personal Information, or for purposes that the individual or entity providing the EU, UK and Swiss Personal Information later authorizes.
Pursuant to the Privacy Shield Frameworks, EU, UK and Swiss individuals have the right to obtain our confirmation of whether we maintain Personal Information relating to you in the United States. Upon request, we will provide you with access to the Personal Information that we hold about you. You may also correct, amend, or delete the Personal Information we hold about you. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data transferred to the United States under Privacy Shield, should direct their query to privacy@birdie.so. If requested to remove data, we will respond within a reasonable timeframe.
We will provide an individual opt-out choice, or opt-in for sensitive data, before we share your data with third parties other than our agents, or before we use it for a purpose other than which it was originally collected or subsequently authorized. To request to limit the use and disclosure of your Personal Information, please submit a written request to privacy@birdie.so
In certain situations, we may be required to disclose Personal Information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
Birdie’s accountability for Personal Information that it receives in the United States under the Privacy Shield and subsequently transfers to a third party is described in the Privacy Shield Principles. In particular, Birdie remains responsible and liable under the Privacy Shield Principles if third-party agents that it engages to process the Personal Information on its behalf do so in a manner inconsistent with the Principles, unless Birdie proves that it is not responsible for the event giving rise to the damage.
In compliance with the Privacy Shield Principles, Birdie commits to resolve complaints about your privacy and our collection or use of your Personal Information transferred to the United States pursuant to Privacy Shield. European Union and Swiss individuals with Privacy Shield inquiries or complaints should first contact Birdie by email at privacy@birdie.so or via post at:
Philo Labs - 46 quai Henri IV, 75004 Paris, France.
Birdie has further committed to refer unresolved privacy complaints under the Privacy Shield Principles to an independent dispute resolution mechanism, the BBB EU PRIVACY SHIELD, operated by the Council of Better Business Bureaus. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit www.bbb.org/EU-privacy-shield/for-eu-consumers for more information and to file a complaint. This service is provided free of charge to you.
Birdie commits to cooperate with the EU data protection authorities (DPAs), the UK Information Commissioner and the Swiss Federal Data Protection and Information Commissioner (FDPIC) and comply with the advice given by such authorities with regard to human resources data transferred from the EU, the UK and/or Switzerland, as applicable, in the context of the employment relationship with Birdie.
If your Privacy Shield complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See Privacy Shield Annex 1 here
California law grants additional privacy rights to California residents. In particular, the California Consumer Privacy Act (CCPA) requires businesses to disclose, for the past 12 months, (i) the categories of personal information collected, (ii) the sources of the collected personal information, (iii) the purposes for which the collected personal information is used, (iv) the categories of personal information disclosed for a business purpose, and (v) the categories of any personal information sold. Birdie provides these disclosures in the following table. Birdie has not sold personal information in the past 12 months.
Category: Identifiers
Sources of Collection: Website visits and registration for Birdie Services
Purposes of Collection: To allow use of Birdie Services and to enable Birdie to communicate with you
Disclosures for a Business Purpose: To Birdie service providers for the purpose of providing Birdie Services to you
Category: Personal information categories listed in the California Customer Records statute
Sources of Collection: Registration for Birdie Services
Purposes of Collection: Credit card information to permit payment for premium Birdie Services
Disclosures for a Business Purpose: To Birdie service providers to facilitate payment transactionsCategory: Internet or other similar network activity
Sources of Collection: Your browsing and search history on the Birdie Site
Purposes of Collection: To improve the visitor experience on the Birdie Site, diagnose server problems and administer the Birdie Site
Disclosures for a Business Purpose: To marketing specialist companies for the purpose of enhancing the Birdie Site and improving the effectiveness of our advertising
California residents also have the rights described below. We will not discriminate against any California resident who exercises these rights.
Right to access/know. You may request from us a list of (i) the personal information that we have collected about you, and (ii) the categories of third parties to whom we have disclosed your personal information. You have the right to up to two (2) access requests each twelve (12) months.
Right to delete your personal information. You may request, at any time, that we delete your personal information.
You may contact us to exercise these rights at privacy@birdie.so. To ensure the privacy and protection of individuals, we are required to verify your identity or otherwise authenticate your request(s). Please note that, under the CCPA, we are not required to grant a request to access/know or a request to delete with respect to personal information obtained from you in your role as an employee, owner, director, officer or contractor of a company and within the context of Birdie providing the Birdie Services to such company.
The Birdie Properties may contain links to third party websites or services, including Third Party Services, (collectively, “Third Party Sources”) who may collect Personal Information and Non-Personal Information directly from you. Links to Third Party Sources are intended for convenience only. Third Party Sources are wholly independent from Birdie. Third Party Source may have separate privacy policies and data collection practices, independent of Birdie. Birdie: (a) has no responsibility or liability for these independent policies or actions; (b) is not responsible for the privacy practices or the content of such websites; and (c) does not make any warranties or representations about the contents, products or services offered on such websites or the security of any information you provide to them.
The terms in this Privacy Policy may be changed from time to time, so you should review it periodically for changes. We reserve the right, at any time, to modify or replace this Privacy Policy. The date of the most recent version of the Privacy Policy is noted below under “Effective Date of this Privacy Policy.” We may also notify you via email or other direct electronic communication method of any changes that, in our sole discretion, materially impact your use of the Birdie Properties or the treatment of your Personal Information. Your use of the Birdie Properties following the posting of any changes to the Privacy Policy constitutes acceptance of those changes.
If you have any questions or concerns about this Privacy Policy or our privacy practices, you may contact us directly as follows:
Email us at: privacy@birdie.so, or write at: Philo Labs, 46 quai Henri IV, 75004 Paris, France.
If you are a resident of the European Union, and you believe that our processing of your Personal Information is inconsistent with your data protection rights under the GDPR and we have not adequately addressed your concerns, you have the right to lodge a complaint with the data protection supervisory authority of your country. Current list of National Data Protection Authorities and members of the European Data Protection Board found here.
This Data Processing Agreement forms an addendum to the Terms of Use between Birdie and Customer for the purchase ofServices, including any and all applicable Order Form(s), Purchases, exhibits and/or schedules (the “Agreement”).
In the course of providing the Services toCustomer pursuant to the Agreement, Birdie may Process Personal Data on behalfof Customer. This DPA reflects the parties’ agreement with regard to theProcessing of Personal Data.
The Parties agree to comply with the following provisions with respect to any Personal Data, each acting reasonably and in good faith.
All capitalized terms not defined here in shall have the meaning ascribed to them in the Agreement. In this DPA, the following capitalized terms used shall further have the meanings given to them below:
The terms “Data Controller” and “DataProcessor” shall have the meaning ascribed by the GDPR. The terms “DataSubject”, “Personal Data” and “Process, Processing” shall have the meaningascribed by the GDPR, but shall only cover the scope of personal data processingspecified in Exhibit A of this DPA. However, in case that the Applicable DataProtection Laws define these terms differently and the GDPR does not apply tothe Processing, the definition set forth by the Applicable Data Protection Laws shall apply instead of the definition ascribed by the GDPR. In case that theApplicable Data Protection Laws define these terms differently and the GDPR applies to the Processing, the definition provided in the GDPR will prevail. Incase the Applicable Data Protection Laws define terms, which have the same or materially similar meaning to the terms “Data Controller”, “Data Processor”, “Data Subject”, “Personal Data”and/or “Process, Processing”, such terms will be considered as covered correspondingly by the definitions provided herein.
The terms "Business AssociateAgreement", "Covered Entity" and "Protected HealthInformation" shall have the meaning ascribed by HIPAA and shall be interpreted in accordance with relevant regulations issued by the U.S. Department of Health and Human Services.
“Admin User Email Address” means every email address associated with the Customer’s account with Birdie in the way that it is, at the given point of time, registered by Birdie as an email address of an admin user of the Customer’s account.
“Applicable Data Protection Laws” means alldata protection laws and regulations applicable to the Processing of PersonalData under this DPA, which may, depending on the circumstances, include but not be limited to the European Data Protection Laws and/or HIPAA, as defined below.
“Data Breach” means a personal data breach concerning Personal Data, which is likely to result in a risk to the rights and freedoms of the Data Subjects.
“EEA” means the European Economic Area.
“EU GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
“European Data Protection Laws” means the GDPR and/or the FADP, as applicable to the Personal Data Processing inquestion.
“FADP” means the Federal Act on DataProtection adopted by the Federal Assembly of the Swiss Confederation, as amended.
“GDPR” means the EU GDPR and/or the UKGDPR, as applicable to the Personal Data Processing in question.
"HIPAA" means the United States’Health Insurance Portability and Accountability Act of 1996.
”EU Standard Contractual Clauses for DataTransfers to Third Countries” means the standard contractual clauses as approved by the European Commission’s decision 2021/915 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to the EU GDPR, and any amendments thereto.
”Subprocessor” means any legal entity, including a subcontractor, engaged by Birdie to Process all or part of thePersonal Data for Birdie on behalf of the Customer.
“UK GDPR” has the meaning given to it insection 3(10) of the UK Data Protection Act 2018.
“UK International Data Transfer Addendum”means the International Data Transfer Addendum to the EU Standard Contractual Clauses, issued by the Information Commissioner and laid before Parliament in accordance with s.119A of the UK’s Data Protection Act 2018 on 2 February 2022 and any amendments thereto.
Subject Matter of Processing
The subject matter of the processing is the Personal Data submitted to the Services by Customer pursuant to the Agreement.
Duration of Processing
The processing will continue until the expiration or termination of the Terms.
Nature and Purpose of Processing
Processing by Birdie to provide theServices to Customer pursuant to the Agreement.
The frequency of processing
On a continuous basis?
Types of Personal Data
Personal Data provided to Birdie by Customer or its Authorized Users, including:
Measures pseudonymizing and/orencrypting personal data
Birdie maintains Customer Content encryptedin transit with TLS and at rest with AES 256-bit encryption.
Measures for ensuring on going confidentiality, integrity, availability and resilience of processing systems and services
The infrastructure for the Application Services spans multiplefault-independent availability zones in geographic regions physically separatedfrom one another; a variety of tools and processes are in place to maintainhigh availability and resiliency.
Measures ensuring the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident
Backups of the Customer Content are performed on a regular schedule andrecovery testing is periodically conducted. Customer Content is encrypted intransit with TLS and at rest with AES 256 bit encryption.
Processes for regularly testing,assessing and evaluating the effectiveness of technical and organizationalmeasures in order to ensure the security of the processing
Birdie maintains an enterprise-wide security program that includes administrative, organizational, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of Customer Content. Birdie conducts periodic reviews of itssecurity program through various internal auditing services.
Measures for user identification andauthorisation
Birdie enforces password and multi-factor authentication requirements. Access rights are promptly removed with personnel termination. Birdie operates under the principle of least privilege which ensures that only those with a business need to access a system or data are authorized and utilizes role-based access controls (RBAC) to provision and control access.
Measures for the protection of data during transmission
Birdie maintains Customer Content encrypted in transit with TLS.
Measures for the protection of dataduring storage
Birdie maintains Customer Content encrypted with AES-256 bit encryption.
Measures for ensuring physical securityof locations at which personal data are processed.
Birdie hosts Personal Data primarily in AWS data centers that have been certified as ISO 27001, PCI DSS Service Provider Level 1, and/or SOC2 compliant. AWS infrastructure services include backup power, HVAC systems, and fire suppression equipment to help protect servers and ultimately your data. AWS on-site security includes a number of features, such as, security guards, fencing, securing feeds, intrusion detection technology, and other security measures. More details on AWS controls can be found at: https://aws.amazon.com/security
Measures for ensuring events logging
Birdie maintains application and infrastructure event logs. Events logs are managed centrally and contextually by the security team.
Measures for ensuring system configuration, including default configuration
Birdie maintains a change management policy with approval processes applicable to pre-production.Hardened security configuration and vulnerability fixes are used in the production environment.Pre-production and production environments are segregated.Birdie leverage tools to minimize security exposure including essential built-in security features such as minimal read-only root file system, file system integrity check, locked-down firewall, and audit logging.
Measures for internal IT and IT security governance and management
The security program at Birdie includes administrative, organizational, technical, and physical safeguards reasonably designed to protect the confidentiality, integrity, and availability ofCustomer Content taking into account the nature of the services provided byBirdie and data protection laws and regulations applicable to Birdie in its performance of its services. Birdie maintains information security and privacy policies considering these aspects. These policies are approved by management, regularly reviewed, and made available to all employees.
Measures for ensuring limited data retention
Customers may delete at any time theirCustomer Content directly through the Application Services. Additionally, Birdie deletes the Customer Content at Customer’s request in accordance with the data processing addendum in place with its customers.
Measures for ensuring accountability
Birdie employs multiple controls to ensure high visibility and enforcement of change management policies to ensure accountability, including comprehensive system logs, code reviews, infrastructure as code, and filtering requests through a centralized ticketing solution.
Measures for allowing data portability and ensuring erasure
Customers may delete at any time theirCustomer Content directly through the Application Services. Additionally,Birdie deletes the Customer Content at Customer’s request in accordance with the data protection addendum in place with its customers.
At Birdie, our users’ privacy is at the core of our decision making. We provide a service that changes the way support teams and their customers interact. It allows them to be more expressive and informative in their daily work communication. Sensitive information is passed through our systems, and we don’t take that lightly.We have created this page to show you how our systems use your information. If you wish to view our Privacy Policy, click here
Your text-based data is comprised of things like your name, notifications, password, linked accounts like Google and Slack, video names, comments, transcripts, and so on. The majority of this data is stored on an encrypted database at both rest and in-transit within AWS. This server is behind a VPC that only privileged servers have access to (such as our backend application servers). Some of this data is encrypted and sent to our caching layer where it is also encrypted at-rest. This caching layer is also behind a VPC and is additionally not accessible between data centers within AWS.
This includes your avatars, videos and thumbnails. These files are stored on our encrypted S3 buckets, which can only be accessed by certain robots and engineers within our organization who have special access.
In order to speed up delivery of your videos to your computer, we utilize our. Our CDN makes use of signed URLs. The CDN URL is not your video page URL. Your video page URL stays the same no matter what, but your CDN URL is the URL that actually delivers the video content.
When we sign these CDN URLs, we have complete control over deciding to not issue a URL to someone who requests it. Basically, even if you understand where a video is located on our CDN, you will not be able to access that URL unless you have the URL signed by us. This is how our password-protected videos work. In this case, we only give you a valid signed URL to view/download if you’ve provided the proper password. An additional benefit to signed URLs is that they expire, so old links will not be usable after some amount of time and you will then need to be issued a new one to access the same content.
We only send data to trusted third-party systems that are subject to strict privacy and security controls. We think it’s important you understand not only what these systems are but also why we send your data to these systems. If you don’t agree with or understand our reasoning, please email us at privacy@birdie.so. If you do not agree with your data going to a specific system, deleting your Birdie account will permanently delete all of your data from all our systems. If you participate in a Birdie Business or Birdie Enterprise account, only the Birdie account administrator at your organization can delete your data.
For folks coming to figure out GDPR compliance, the following third-party services act as data processors for us. When we work with these service providers in our capacity as a data processor for our customers' personal data, the General Data Protection Regulation (GDPR) calls these third-party service providers a sub-processor. A subprocessor is a third party data processor engaged by Birdie who may have access to or process personal data: (i) on behalf of Birdie customers; (ii) in accordance with customer instructions as communicated by Birdie; and (iii) in accordance with the terms of a written contract between Birdie and the subprocessor.
☁️ Amazon Web Services (AWS)
☎️ Intercom
📊 Customer.io
🐦 Sentry
Our non-technical team members have access to Intercom, which allows every person at Birdie to be able to do customer support. Over time, this will become more restricted as we scale up the team to only be customer support individuals.
Our technical team can be granted temporary access to our servers, video and thumbnail storage layers. This is only for debugging or development purposes. Each engineer has a unique key that identifies them within our systems. All actions are logged for 6 years. If their key is compromised, we have an instantaneous way of expiring that key, checking if their key was used by an outsider, and processes to remedy such situations and alert the affected user base. **So far, this has never happened in Birdie's history, and we’re very proud of that.
Videos: You can export all of your video data by downloading each individual video.
Text-based Data: Your user information, video titles and video metadata and tags can be exported. Just send us an email at privacy@birdie.so
If you ever want to delete your data, deleting your account will permanently delete all of your data off our systems.
🔒 Encrypted
Encryption is a process where data is scrambled with a specific secret that only a select few have. If this data is stolen, it cannot be understood unless the stealer has the proper secret. All of your personally-identifiable data (videos, images and text) are encrypted at-rest and in-transit across all systems.
🏃 In-transit
Your data is being sent from one location to another (usually one server/computer to another)
🛌🏾 At-rest
Your data is physically being stored on a device (usually a server)
🕳️ S3 Bucket
This is where we store larger (usually media) files such as images and videos
⚡ Cache Layer
A group of servers that uses faster storage for the purpose of being able to retrieve it faster
🤝 Database
This is a server that stores data that relates to one another. In other words, this is where we can query to answer questions like: "what is a user?", "does a user own one or many videos?", "could you get me a list of all of this user's comments?"
🔥 VPC
A firewall that blocks access to a server or group of servers only to users/robots that have the proper permissions
🌐 CDN
A CDN (Content Delivery Network) is a network of computers around the world whose purpose is to store data as close as possible to the downloader to speed up delivery of media.
🤖 AWS
Short for Amazon Web Services. This is the cloud provider we use at Birdie that allows us to rent storage and compute capacity from their data centers.
If you have any questions about privacy at Birdie, we are here to help. Email us at privacy@birdie.so
Click here to open our Terms of Service
