aspen.
Privacy Policy
Version 1.0 · effective 14 October 2026 · Symphony, Inc. (Aspen)
This policy explains what personal data Symphony, Inc., doing business as Aspen by Everwork, 251 Little Falls Drive, Wilmington, Delaware 19808, United States ("Aspen", "we"), handles when you visit joinaspen.app, use the customer portal at onboarding.joinaspen.app, sign an Aspen contract, or run an Aspen installation. Questions and requests: hello@joinaspen.app.
1. Who is responsible
Aspen decides how data is used, and is the controller, for the data in sections 2 to 6: website enquiries, portal accounts, contracts and signatures, billing and licence usage counts.
The content inside an Aspen installation (messages, files, records, recordings) belongs to the customer that runs it. In a self-hosted installation Aspen has no access to it. In a managed installation Aspen hosts it for the customer as a processor, under the customer's instructions and the data processing agreement that comes with the managed plan.
2. What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Website enquiries: name, work email, company, team size, the tools you use, your message | To answer you and talk about your setup | Your request; our legitimate interest in replying |
| Portal accounts: name, email, company, role, password (stored as a hash) or your Aspen sign-in | To give your team onboarding, support and billing | The contract with your company |
| Contracts and electronic signatures: signers' names, titles, emails, the time, IP address and device of each signature, the one-time codes' verification, and the signed PDF | To make and prove the agreement (Terms, section 1.6) | The contract; legal obligations to keep records |
| Billing: company details, billing contact, invoices and payments | To invoice and collect | The contract; tax and accounting law |
| Support tickets and their attachments | To help you | The contract |
| Licence usage data from installations: counts only, such as users in use, AI calls and tokens per provider, storage, call minutes, versions and a code fingerprint | To check the licence and plan support (Terms, section 5) | The contract; our legitimate interest in enforcing the licence |
Licence check-ins never carry names, email addresses or anything a person typed. Card details go straight to Stripe; Aspen never sees or stores them.
3. Who processes it for us
| Service | What for | Where |
|---|---|---|
| Vercel | Hosting the website and the customer portal | United States |
| Neon | The portal's database | United States |
| Stripe | Invoices and payments | United States and the EU |
| Resend | Sending the portal's emails (signing codes, reminders, invoices) | United States |
| Hetzner Online | Servers for managed installations | European Union |
| DigiCert | Time-stamping signed contracts; it receives only a fingerprint of the document, never the document | United States |
We do not sell personal data or use it for advertising. Transfers outside your country rely on the providers' standard contractual clauses or equivalent safeguards. We disclose data to authorities only when the law requires it.
4. How long we keep it
Website enquiries: 24 months after the last contact. Portal accounts: while your company uses Aspen, then 12 months. Contracts, signature records and invoices: for the life of the contract plus 10 years, or longer where tax or contract law requires. Licence usage data: for the life of the licence plus 24 months (Terms, section 5.5). Support tickets: while your company uses Aspen.
5. Your rights
You can ask to see, correct, export or delete your personal data, and object to or restrict its use, by writing to hello@joinaspen.app. We answer within 30 days. Data we must keep by law, such as signed contracts and invoices, is kept for that period. If you are in the EU or the UK you can also complain to your data protection authority.
6. Cookies
The website uses no tracking or advertising cookies. The customer portal uses only the cookies it needs: your sign-in session and, while you sign a contract, a short-lived signing session.
7. Security
Data is encrypted in transit; passwords are stored as hashes; secrets such as signing links are encrypted at rest; every consequential action in the portal is recorded in an audit log; signed contracts are sealed so any change to them shows.
8. Changes
We will post changes here and, for material ones, tell portal owners by email at least 30 days before they apply.