The privacy of our clients and other individuals is a priority for us, and we are committed to ensuring that all personal data is processed with the utmost respect for the rights of individuals. This Privacy Policy explains how we, Passwd s.r.o., a company existing under the Czech law with its registered address at Rohanské nábřeží 717/4, Postal Code: 186 00 Prague 8, Czech Republic, Id. No. 08647682 (the "Passwd", "we" or "us"), collect, use and share personal data when you visit passwd.team or use the Passwd password management service (the "Service").
We only process your personal data in accordance with existing data protection legislation. This includes, but is not limited to, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, the "GDPR") and applicable Czech national legislation.
1. Who we are
| Company | Passwd s.r.o. |
|---|---|
| ID No. | 08647682 |
| Registered address | Rohanské nábřeží 717/4, 186 00 Prague 8, Czech Republic |
| Contact e-mail | info@passwd.team |
| Website | passwd.team |
Passwd acts as a data controller for personal data collected in the course of operating the website and providing the Service. For data stored inside the Service by customers (the “Local Data”), Passwd acts as a data processor on behalf of the customer.
2. What personal data do we collect and why?
We collect personal data in the following contexts. The tables below set out for each activity: the data collected, the purpose, the legal basis under GDPR, and how long we keep the data.
2.1 Website visitors and interactive features
This section covers all instances where visitors actively interact with our website and provide personal data.
2.1.1 Website analytics
When you browse passwd.team, we may collect the following technical data to analyze and make our website even better:
| Personal data collected | Purpose | Legal basis |
|---|---|---|
| IP address, browser type and version, pages visited, referrer URL, timestamps, device type | Website security, fraud prevention, aggregate analytics | Art. 6(1)(f) — legitimate interest in operating a secure, well-functioning website |
Please refer to our Cookie Policy for more information regarding the collection of technical data (cookies) when you are using our website.
2.1.2 Live chat (chatbot)
Our live chatbot runs via SocialIntents platform. Initiating a chat requires you to provide a name and e-mail address. Your message is handled by the chatbot and routed to our team via a dedicated channel in Passwd's Slack workspace.
| Personal data collected | Purpose | Legal basis |
|---|---|---|
| Name, e-mail address, chat message content, IP address, browser type and version, referrer URL, Location | Responding to support and sales queries via live chat; routing queries to the appropriate internal team | Art. 6(1)(b) — pre-contractual steps at the request of the data subject (providing the requested live chat support and routing the query to the appropriate team) |
2.1.3 Product demo
You can start a self-service Passwd demo to see how password management works with Google Workspace. The product demo requires you to provide your e-mail address.
| Personal data collected | Purpose | Legal basis |
|---|---|---|
| E-mail address, IP address, browser type and version, referrer URL, Location | Sending demo access credentials; following up with product information | Art. 6(1)(b) — pre-contractual steps (providing the requested demo); or Art. 6(1)(f) — legitimate interest in product demonstrations |
2.1.4 Demo call booking
Scheduling a demo call is handled by Calendly. When you book a call, Calendly collects your name, e-mail address and preferred time slot and passes the booking details to our team.
| Personal data collected | Purpose | Legal basis |
|---|---|---|
| Name, e-mail address, calendar availability / selected time slot | Scheduling and conducting a product demo call; sending calendar invitations and reminders | Art. 6(1)(b) — pre-contractual steps; or Art. 6(1)(f) — legitimate interest in arranging product demonstrations |
2.1.5 E-mail compromise checker
Our website offers a free tool that checks whether a submitted e-mail address has appeared in any known data breaches.
| Personal data collected | Purpose | Legal basis |
|---|---|---|
| E-mail address | Checking the submitted address against databases of known data breaches and displaying the result to the user | Art. 6(1)(b) — contractual steps at the request of the data subject (providing the requested check of the submitted e-mail address); or Art. 6(1)(f) — legitimate interest in providing a useful security tool to visitors |
2.2 Registration and installation via Google Marketplace (Starter and Professional Plan)
When you install Passwd through the Google Workspace Marketplace (Starter or Professional Plan) and connect your Google Workspace account, Passwd requests access to the following data (via Google APIs) to deliver its core functionality. The table below lists every permission scope requested, the data accessed through it, and the purpose.
The legal basis for collecting these data is Art. 6(1)(b) of GDPR — performance of contract, i.e. providing the Service which requires Google identity.
All data obtained via Google APIs is used exclusively to provide the Service. Passwd does not sell, transfer, or use Google user data for advertising or any purpose unrelated to the functionality described above. Passwd does not use Google user data to develop, improve or train generalized AI or machine-learning models, and no human reads Google Workspace directory data except with your consent, for security purposes, to comply with applicable law, or where necessary to operate the Service. Passwd's use and transfer of information received from Google APIs adheres to the Limited Use requirements of the Google API Services User Data Policy.
A Google Workspace administrator can revoke Passwd's access to your directory at any time by uninstalling Passwd in the Google Admin console, and any user can revoke Passwd's sign-in access at myaccount.google.com/permissions. To have your Google user data deleted, e-mail info@passwd.team.
| OAuth scope | Personal data accessed | Purpose |
|---|---|---|
| userinfo.email | Primary Google Account e-mail address | Identifying and provisioning the user account; authentication via Google SSO |
| userinfo.profile | Full name, profile picture | Personalising the user account within Passwd; displaying user identity in the interface |
| admin.directory.user.readonly | Workspace domain user profiles: names, e-mail addresses, user IDs and administrator status | Synchronising the Workspace user directory with Passwd to provision and manage user accounts; enabling administrators to control Passwd access based on the Workspace user structure and letting users search for colleagues when sharing secrets |
| admin.directory.group.readonly | Google Workspace group names, e-mail addresses and member counts, and, to check who may open a shared secret, the IDs, e-mail addresses and types of group members (read live, not stored) | Enabling group-based access control within Passwd (assigning shared credentials to teams or groups) and checking, when a secret is opened, whether the user belongs to a group the secret is shared with |
2.3 Enterprise plan
The Enterprise Plan is deployed within the customer's own Google Cloud Platform (GCP) project. During the guided setup process, the following data is collected:
| Data collected | Purpose | Legal basis |
|---|---|---|
| Company name; chosen Passwd URL subdomain | Creating the company-specific Passwd instance and access URL | Non-personal data |
| Deployment region (GCP region selection) | Determining the Google Cloud region in which the customer's vault is hosted (data residency / data sovereignty) | Art. 6(1)(b) — performance of contract |
| Google Workspace Customer ID | Enabling multi-domain support; linking Passwd to the customer's Google Workspace environment | Art. 6(1)(b) — performance of contract |
| Google Workspace admin e-mail address | Communicating setup instructions, configuration updates and account notifications to the designated administrator | Art. 6(1)(b) — performance of contract |
| Error logs and analytics (optional) | Improving service quality; diagnosing and resolving technical issues | Art. 6(1)(a) — consent (opt-in during setup; can be disabled at any time in account settings) |
During the technical setup, you are asked to grant Passwd's installation account (install@passwd.team) Owner-level access to the GCP project. It is used solely to perform the installation. This access is revoked and permanently deleted by Passwd immediately after the installation is complete. Passwd retains no ongoing access to your GCP project after setup.
2.4 Browser extension (autofill)
The Passwd browser extension enables automatic filling of credentials on websites. To match stored records to the correct website, the extension reads the domain of the active browser tab.
| Personal data collected | Purpose | Legal basis |
|---|---|---|
| Domain/URL of the active browser tab (processed locally; not transmitted to Passwd servers) | Matching stored credentials to the correct website for autofill | Art. 6(1)(b) — performance of contract (core product functionality) |
2.5 Payment processing
We use Stripe for processing subscription payments. When you pay for a subscription, you are redirected to Stripe’s payment page. Payment card details are entered directly on Stripe's platform and are not transmitted to or stored on our systems. We can only access the following data:
| Personal data collected | Purpose | Legal basis |
|---|---|---|
| Billing details provided during checkout, payment confirmation status, transaction reference | Processing payment; issuing invoices; fraud prevention | Art. 6(1)(b) — performance of contract; Art. 6(1)(c) — legal obligation (invoicing, tax records) |
To see how Stripe processes your payment data, please refer to Stripe's Privacy Policy.
2.6 Marketing communications
If you have consented or if you are an existing customer and have not opted out, we may send you product updates, feature announcements, and relevant offers by e-mail.
| Personal data collected | Purpose | Legal basis |
|---|---|---|
| E-mail address; name; account plan type | Sending product news, feature updates and relevant commercial communications | Art. 6(1)(a) — consent (new contacts); Art. 6(1)(f) — legitimate interest (existing customers, subject to right to object) |
You can unsubscribe from marketing e-mails at any time by clicking the unsubscribe link in any e-mail or by contacting us at info@passwd.team.
3. Passwd as data processor (Local Data)
Local Data is the personal data that you store inside the Passwd password manager (e.g. credentials, notes, associated metadata). For Local Data, Passwd acts as a data processor on behalf of the customer, who is the data controller. Passwd processes Local Data solely as instructed by the customer.
For Starter and Professional Plan customers:
All Local Data is stored in encrypted form. Access is strictly limited to your authorised employees in accordance with the Service's permission model, and to a minimal number of Passwd staff for the purpose of providing technical support where explicitly requested.
Passwd does not use Local Data for any purpose other than providing the Service.
For Enterprise Plan customers:
The Passwd password manager is deployed within your own GCP project and remains under your control at all times. We do not store your Local Data on our servers.
3.1 Data Processing Agreement (DPA)
Enterprise and Professional Plan customers who require a formal DPA for GDPR compliance purposes should contact us at info@passwd.team. A standard DPA aligned to Art. 28 GDPR is available on request.
4. Cookies and tracking technologies
Our website uses cookies and similar technologies. You can read more about how we use cookies in our Cookie Policy.
5. How long do we keep your data?
We retain your personal data for as long as necessary to fulfill the purposes of processing, as defined above for each context, or until you request its deletion or withdraw your consent, unless we have a legal obligation or a legitimate interest to retain such personal data for a longer period (for example, for the purposes of legal claims).
6. With whom do we share personal data?
We do not sell your personal data or provide it to third parties for their own marketing or other purposes. However, the data may be shared with the technical service providers we use, specifically:
| Recipient | Purpose |
|---|---|
| Google LLC (Google Cloud Platform, Google Workspace) | Core infrastructure for data storage and authentication. Data processed under standard contractual clauses (SCC). For Enterprise Plan customers, data is stored in the customer's own GCP project. |
| Google LLC (Google Analytics) | Website analytics. Only if consent is given. |
| Stripe, Inc. | Processing subscription payments. Full card details are not stored by Passwd. Governed by Stripe's own privacy policy. |
| SocialIntents LLC (live chat platform) | Processing chat conversations initiated via the website chatbot. |
| Calendly LLC (demo call scheduling platform) | Processing demo call bookings (name, e-mail, time slot). |
| Twilio Inc. (SendGrid email delivery platform) | Sending marketing emails such as product updates or feature announcements. |
| Slack Technologies Limited | Processing messages forwarded by the website chatbot. |
| Professional advisers (lawyers, auditors) | Legal and financial compliance; only where strictly necessary. |
| Public authorities | Where required by law (e.g. court orders, regulatory obligations). |
Passwd's infrastructure is operated on Google Cloud Platform, with data centres primarily located within the European Economic Area (EEA). Where data is transferred to countries outside the EEA (for example, when Google Analytics processes data on US servers), we ensure appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCC) according to Art. 46(2)(c) GDPR;
- Google's Data Processing Addendum, which incorporates SCC for transfers from the EEA.
7. Is your data secured?
In accordance with best practices, we employ appropriate technical and organisational measures in order to ensure proper security measures, confidentiality and the integrity of personal data (including protection against unauthorised or unlawful processing and against accidental or unlawful destruction, loss, alteration or damage, unauthorised disclosure or access to personal data). Passwd regularly monitors compliance with these measures. We strictly limit who is allowed to access such information and we keep the number of authorised individuals to a minimum. In addition, we maintain physical and cyber safeguards, such as the partial encryption of data, server protection devices, and software to negate the possible loss, misuse or alteration of your data.
8. Automated decision-making and profiling
We do not carry out automated decision-making or profiling that would have legal effects or otherwise significantly affect you.
9. Use by children
The Service is designed exclusively for business users and is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data relating to a child, please contact us at info@passwd.team and we will delete such data promptly.
10. Your rights
In accordance with the GDPR, you have the following rights in relation to your personal data:
- Right of access: the right to obtain confirmation of whether we process your personal data and to receive a copy of that data.
- Right to rectification: the right to request correction of inaccurate data or completion of incomplete data.
- Right to erasure ("right to be forgotten"): the right to request deletion of your data where the purpose of processing has ceased or consent has been withdrawn.
- Right to data portability: the right to receive your data in a machine-readable format and transfer it to another controller (applies to processing based on consent or contract).
- Right to withdraw consent: at any time and without penalty; withdrawal does not affect the lawfulness of processing carried out prior to withdrawal (applies where processing is based on consent).
If you believe that Passwd is processing your personal data in a manner that is inconsistent with the protection of your privacy or in breach of applicable law, you may also:
- request an explanation;
- request restriction of the processing of your personal data;
- object to the processing and request that we remedy the situation (e.g. by blocking, correcting, supplementing or erasing the personal data);
- lodge a complaint with the Czech supervisory authority: Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.cz.
You may exercise the above rights by sending an e-mail to info@passwd.team. We will respond as soon as possible and in any event within one month of receiving your request.
11. Third-party links and integrations
Our website and documentation may contain links to third-party websites (e.g. Google Workspace Marketplace, Trustpilot, G2, Clutch). This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party services you use in connection with Passwd.
12. Additional information for US residents
This section applies to individuals located in the United States and supplements the information set out in this Privacy Policy. Where there is a conflict between this section and the rest of the Policy, this section prevails for US residents.
We do not sell your personal data. Passwd does not sell, rent, or share personal information with third parties for monetary or other valuable consideration, and has not done so in the preceding 12 months.
12.1 California residents (rights under CCPA/CPRA)
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):
- Right to know: the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the sources from which it was collected, the business or commercial purposes for collecting it, and the categories of third parties with whom we share it.
- Right to delete: the right to request deletion of personal information we have collected from you, subject to certain exceptions (e.g. where retention is required by law or necessary to complete a transaction).
- Right to correct: the right to request correction of inaccurate personal information we maintain about you.
- Right to data portability: the right to receive a copy of your personal information in a portable and, to the extent technically feasible, readily usable format.
- Right to opt out of sale or sharing: the right to opt out of the sale or sharing of your personal information. As noted above, Passwd does not sell or share personal information for cross-context behavioural advertising purposes.
- Right to limit use of sensitive personal information: the right to limit our use of sensitive personal information to purposes necessary to provide the Service.
- Right to non-discrimination: you will not receive discriminatory treatment for exercising any of your privacy rights.
12.2 Other US state residents
Residents of other US states that have enacted comprehensive privacy legislation (including Virginia, Colorado, Connecticut, Texas, and others) may have similar rights under their applicable state law, including rights of access, correction, deletion, portability, and the right to opt out of certain processing activities. Where such rights apply, you may exercise them using the contact details below.
12.3 Passwd as a service provider
For personal data processed within the Passwd Service on behalf of your employer or organisation (Local Data), Passwd acts as a service provider or data processor and processes that data solely on the instructions of the organisation that has contracted with Passwd. If you wish to exercise rights in relation to such data, please contact your employer or the organisation that manages your Passwd account directly, as they are the party responsible for responding to such requests.
12.4 How to submit a request
To exercise any of the rights described above, please contact us at info@passwd.team. We will respond within 45 days of receiving your request. We may ask you to verify your identity before processing a request. If we are unable to fulfil your request, we will explain the reason in our response.
13. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. Material changes will be notified to registered users by e-mail at least 14 days before they take effect, and the updated policy will be published on our website with a revised effective date. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.
Cookie Policy
This Cookie Policy explains how we, Passwd s.r.o., a company existing under the Czech law with its registered address at Rohanské nábřeží 717/4, Postal Code: 186 00 Prague 8, Czech Republic, Id. No. 08647682 (the "Passwd", "we" or "us"), use cookies and similar technologies on passwd.team and the Passwd password manager (the "Service").
1. What are cookies?
Cookies are small text files stored in your browser when you visit a website. They allow the website to recognise your device and remember information about your visit (such as your preferences or login session) to make your next visit easier and the site more useful to you.
2. What types of cookies do we use?
We use the following categories of cookies:
- Strictly necessary cookies — these cookies are essential for the website and the Passwd application to function correctly. They enable core features such as authentication, session management, and security. These cookies cannot be disabled without affecting the functionality of the Service.
- Statistical cookies (Analytics) — these cookies help us understand how visitors interact with our website (e.g. which pages are visited most, how long visitors stay, and where they come from). We use this data in aggregate form to improve our website.
- Cookies for personalization (Functional) — these cookies remember your preferences (such as language settings or UI preferences) to provide a more personalised experience. They do not track you across other websites.
- Marketing cookies — these cookies track your visit to our website (the pages you have visited and the links you have followed) in order to deliver relevant advertising. These cookies include UTM tracking and affiliate measurement.
3. What tools do we use?
A detailed list of all cookies and third-party tools we use, including their purpose, provider, and expiry, is available in our cookie declaration table below.
All non-essential cookies are only activated after you give your consent via the cookie banner on our website.
4. How to manage cookies?
You can manage or withdraw your consent for non-essential cookies at any time via the cookie settings banner on our website.
You can also delete or block cookies directly in your browser settings. For instructions, please refer to the help page for your browser:
Please note that disabling certain cookies may affect the functionality of our website or the Passwd Service.
5. Contact
If you have any questions about our use of cookies, please contact us at info@passwd.team.
This Cookie Policy should be read together with our Privacy Policy.
List of tools and trackers collected by our website:
| Third-party service | Category | Purpose | Cookies / storage keys | Retention |
|---|---|---|---|---|
| Social Intents | Functional | Live-chat widget (visitor ID, visit count, chat state) and load-balancer stickiness for the chat backend | si_* (local / session storage); AWSALB, AWSALBCORS, AWSALBTG, AWSALBTGCORS (third-party) | Persistent (local storage) / session (session storage); 7 days (AWSALB*) |
| Google Analytics 4 | Analytics | Distinguishes users and sessions to measure how the website and app are used | _ga, _ga_* | 400 days |
| Hotjar | Analytics | Hotjar user ID, current session and tracking of open tabs for session recording | _hjSessionUser_*, _hjSession_*, hjActiveViewportIds (local storage) | 365 days (user); 30 minutes (session); persistent (local storage) |
| Woopra | Analytics | Visitor ID for customer-journey analytics | wooTracker | 400 days |
| Google Ads | Marketing | Conversion attribution (ad click ID), view-through conversion and remarketing | _gcl_aw, _gcl_au, _gcl_ls (local storage); cookies on ad.doubleclick.net and googleads.g.doubleclick.net (third-party) | 90 days; third-party cookies as set by Google |
| Reddit Pixel | Marketing | Reddit ad visitor ID and ad click ID for conversion tracking | _rdt_uuid, _rdt_cid | 90 days |
| OpenAI Ads Pixel | Marketing | Ad referral ID and per-session pixel state for conversion tracking | __obref, oaiq_cs:* (session storage) | 365 days (__obref); session |
| Trackdesk | Marketing | Affiliate click ID used to measure partner commissions | trakdesk_cid | 1 month by default, or the campaign’s cookie window |
| Apollo.io | Marketing | Anonymous visitor ID and event queue for B2B lead identification; session for the Apollo tracking endpoint | apolloAnonId, <appId>_canTrack, <appId>_eventQueue (local storage); X-CSRF-TOKEN, _leadgenie_session (third-party, aplo-evnt.com) | Persistent (local storage); session (cookies) |