Landfall

Privacy Policy

Last updated: February 2026

Landfall is committed to protecting your privacy and handling your data responsibly. This policy explains what data we collect, why we collect it, and your rights regarding that data.

1. Data We Collect

Account Information

When you create an account, we collect:

  • Email address - Used for authentication and notifications
  • Name - Used for display purposes and audit trails
  • Password - Stored securely using bcrypt hashing (we never store plain text passwords)

Project Data

When you use the service, we store:

  • Project names, descriptions, and configuration
  • Obligation mappings and applicability decisions
  • Backlog items and implementation status
  • Evidence and verification records
  • Assumptions and questionnaire responses

Audit Logs

For compliance integrity, we maintain detailed audit logs of all significant actions. These logs include:

  • User ID and timestamp of actions
  • Type of action performed
  • Before/after state of modified records
  • IP address (for security purposes)

Audit logs are cryptographically chained to prevent tampering and ensure integrity for regulatory review.

Integration Data

If you connect third-party integrations (GitHub, Jira, Linear), we store:

  • OAuth access tokens (encrypted)
  • Minimal metadata required for sync functionality

We do not access or store your source code or issue content beyond what you explicitly export.

2. How We Use Your Data

We use your data to:

  • Provide and improve the Landfall service
  • Authenticate you and secure your account
  • Maintain audit trails for compliance purposes
  • Generate anonymized, aggregated insights (only when threshold of 5+ projects is met)
  • Communicate service updates and security notices

3. Data We Do NOT Collect

Privacy by Design

  • No advertising or tracking cookies
  • No third-party analytics (Google Analytics, etc.)
  • No behavioral tracking or profiling
  • No selling or sharing of data with advertisers
  • No phone numbers, physical addresses, or unnecessary PII

4. Data Retention

  • Account data: Retained while your account is active
  • Project data: Retained until you delete the project or your account
  • Audit logs: Retained for regulatory compliance purposes (minimum 7 years for approved decisions)
  • Session data: Expires after inactivity period

5. Your Rights

Under GDPR and similar privacy regulations, you have the right to:

  • Access: Request a copy of your personal data
  • Rectification: Correct inaccurate data
  • Erasure: Request deletion of your data (“right to be forgotten”)
  • Portability: Export your data in a machine-readable format
  • Object: Object to certain processing of your data

To exercise these rights, contact us at privacy@landfall.app.

6. Data Security

We implement security measures including:

  • Encryption in transit (HTTPS/TLS)
  • Secure password hashing (bcrypt with salt rounds)
  • Role-based access control
  • Separation of duties enforcement
  • Rate limiting on authentication endpoints
  • Cryptographic audit log integrity verification

7. Third-Party Services

We use the following third-party services:

  • Authentication providers: If you sign in via Google or GitHub OAuth, their privacy policies apply to that authentication
  • AI processing: We use Anthropic Claude for AI-assisted features. Project data sent for AI processing is subject to Anthropic's data handling policies
  • Hosting: Our infrastructure is hosted on secure cloud providers with appropriate data processing agreements

8. Children's Privacy

Landfall is a business tool intended for compliance professionals. We do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, please contact us immediately.

9. International Transfers

Your data may be processed in countries outside your residence. We ensure appropriate safeguards are in place for international data transfers, including Standard Contractual Clauses where applicable.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or through the Service. Your continued use after changes constitutes acceptance of the updated policy.

11. Contact Us

For privacy-related questions or to exercise your rights:

This Privacy Policy should be read in conjunction with our Terms of Use.