Scope and who we are
This notice covers the Logpagia website and the Logpagia workspace applications an organization uses for people, time, payroll, hiring, documents, contracts, electronic signatures, customers, accounting, visitors, messaging and the Pagia assistant. It also covers the signing pages that people outside an organization open from a signature request.
Pagenia, the talent marketplace, publishes its own notice for marketplace accounts and public profiles. This notice covers candidate information once a candidate applies to an organization that hires through Logpagia.
The legal entity that operates Logpagia, its registered address and its privacy contact are added here by the owner before this notice takes effect.
Our role and the customer’s role
An organization that subscribes to Logpagia decides which records it keeps about its employees, candidates, visitors, customers and signers, and why. For those records the organization is the controller, or the business under US state privacy laws, and Logpagia processes them on the organization’s behalf as its processor or service provider, following the organization’s instructions and the customer agreement.
Logpagia is the controller for the information it needs to run its own business: sign-in and account security data, billing and subscription records, website requests, service operations and support.
If you are an employee, candidate, visitor or signer and have a question about records an organization holds about you, contact that organization first. Logpagia supports the organization in answering the request.
Information we handle
The information depends on which products an organization enables and what its members enter. The main categories are:
- Account and sign-in: name, work email, password stored as an Argon2 hash, multi-factor authentication settings, sign-in history with network address and browser details, and security events.
- Workforce records: employee profiles, job and organization structure, locations, emergency contacts, national or tax identifiers the organization requires, documents, clock events, timesheets, time off and daily work reports.
- Payroll: pay rates, earnings, deductions, tax details, payslips and year-end forms, and the bank account details an employee provides for payment.
- Hiring: job applications, CVs, interview notes, assessments and offers, including applications a candidate submits from Pagenia.
- Visitors (Lobbia): visitor name, email, phone, company, host, purpose of visit, arrival and departure times, badge details, check-in requirements, screening results against the organization’s own watchlist, deliveries and emergency roll-call status.
- Contracts and signatures: documents sent for signature, signer name and email, one-time verification codes, the signer’s agreement to use electronic records, signature images and field entries, and a tamper-evident event history that stores hashed network address and browser details.
- Business records: customer contacts and accounts, invoices and accounting entries, inventory, tasks, calendars and internal service requests.
- Messages and AI: Spaces messages and attachments, Pagia conversations, and the facts a person asks Pagia to remember.
- Billing: billing contact, plan, seat counts, invoices and payment status. Card details are entered on Stripe’s payment page and are held by Stripe.
- Website: the requested page, network address and browser details that every web request carries, recorded in server logs.
Why we use it
Logpagia uses personal information to provide the service the organization requested, to keep accounts and records secure, and to run its own business.
The current service contains no advertising and no function that sells personal information.
- Create and secure accounts, verify email addresses and enforce each organization’s permissions.
- Carry out the workflows an organization uses, such as payroll runs, approvals, hiring, visitor check-in and signing.
- Send service email: verification, invitations, approvals, signature requests and notifications, each notification with an unsubscribe link.
- Bill subscriptions and add-ons and keep financial records.
- Provide support through audited staff tools, detect abuse, investigate incidents and keep audit trails.
- Meet legal obligations, such as tax, payroll and record-keeping duties.
Legal bases
Where the law of your location requires a legal basis, Logpagia relies on performance of a contract to provide the service, legitimate interests to secure and improve it and to communicate with business contacts, legal obligation for tax and record-keeping duties, and consent for optional choices such as Pagia memory.
For records Logpagia processes for an organization, the organization determines the legal basis and gives the notices its employees, candidates and visitors need.
Service providers and other recipients
Logpagia runs its application servers, PostgreSQL database, Redis cache and MinIO file storage on server infrastructure it operates. Electronic signature processing, including document conversion, malware scanning and signing keys, also runs on that infrastructure. Other providers receive information only for the purpose listed:
- Email delivery: Resend, or an SMTP mail service, sends service email.
- Subscription payments: Stripe processes card payments, invoices and taxes for Logpagia plans and add-ons.
- Pagia: when an organization turns on external AI processing, OpenRouter routes the request to the one model provider Logpagia has approved for that route.
- Payroll payments: Dwolla, in the United States, and Flutterwave receive payee and payment details only when an organization turns on live disbursement for a country those providers serve. Disbursement runs in a simulated mode by default.
- Public signing forms: Cloudflare Turnstile checks for automated submissions when an organization’s deployment turns that check on.
- Visitor messages: Lobbia sends emergency text messages through a message provider the organization connects.
- Health applications: when an organization links a Health application such as RevMind 360, opening it shares the person’s name, email, organization name and country so that application can sign them in.
- Platform staff: authorized Logpagia staff with an audited staff grant can view and support organization accounts. Support actions are explicit and audited.
- Legal and corporate: authorities when the law requires disclosure, and a successor in a merger or acquisition under equivalent protections.
International transfers
Several of the providers above, including Stripe, Resend and OpenRouter, are based in the United States, and model providers can process a Pagia request in other countries. Information can therefore be processed outside the country where it was collected.
The server location and the transfer safeguards Logpagia relies on, such as standard contractual clauses, are confirmed by the owner and legal review before this notice takes effect.
How long we keep information
Logpagia keeps an organization’s records for as long as its subscription is active and as the organization instructs. Records are archived rather than erased when someone removes them, so audit, approval and payroll history stays complete.
Retention periods that are set in the product today:
- A personal data export stays available to download for seven days.
- A member’s account deletion request can be cancelled for 30 days. The account is then anonymized.
- Documents sent for signature are kept for ten years by default, a period each deployment can change, and a legal hold keeps an envelope for as long as the hold applies.
- Facts removed from Pagia memory are deleted permanently 30 days after removal.
- A sign-in session cookie lasts seven days and ends when the person signs out.
Security
Every workspace query is limited to the requesting organization, and each person’s access follows the permissions their organization grants. Connections use HTTPS. Passwords are hashed with Argon2, multi-factor authentication is available, and repeated failed sign-ins lock the account.
Payroll identifiers, bank details, payment provider credentials and multi-factor secrets are encrypted with AES-256-GCM. Private files are served through short-lived signed links. Profile photos, organization logos and Pagenia profile media are served from public links so they can appear on shared and public pages.
No method of storage or transmission is completely secure. The incident notification commitments to customers are confirmed in the final customer agreement and data processing terms.
Your rights and how to use them
Depending on where you live, you can ask to access, correct, delete or receive a copy of your personal information, to restrict or object to its use, to withdraw consent, and to appeal a decision about your request. Logpagia verifies the requester’s identity before acting and treats people who use these rights the same as everyone else.
Workspace members can edit their profile, request corrections to fields their organization controls, download a personal data export and request account deletion from their own settings.
For records an organization holds, send your request to that organization; Logpagia helps it respond. For information Logpagia controls, use the privacy contact added here before publication.
Children
Logpagia is a business service for organizations and the people who work with them. It is not directed to children, and Logpagia does not knowingly collect personal information from children for its own purposes.
An organization that keeps records about young workers where local law allows is responsible for those records and any consent they require. The minimum age statement is confirmed during legal review.
Pagia and external AI processing
When an organization administrator turns on Pagia’s external processing, a person’s message and the records they choose to include can be processed by OpenRouter and the approved model provider. Checks on the organization, product, permissions and policy limit what is sent, and detected credentials, bank and payroll details, government identifiers and health information are blocked before sending.
Logpagia asks the provider route to deny data collection for training. That setting is not a promise of zero retention or of processing in a particular country. The Pagia AI page describes these controls in full.
Changes to this notice
Logpagia publishes each revision of this notice on this page with its effective date and tells organization administrators about material changes before they take effect. The notice period is confirmed during legal review.
Contact
The privacy contact email, the postal address and any local representative that privacy law requires are added here by the owner before this notice takes effect.
Review and publication gate
This page is a review draft and not a privacy notice in force. The owner supplies, and legal review approves, the following before publication:
- Legal entity name, registered address and privacy contact.
- Server hosting provider and location, and confirmation of the provider list above.
- Link to the data processing terms and the transfer safeguards.
- Retention after a subscription ends, the incident notification period and the minimum age statement.
- Reconciliation with the Pagenia notice and the current Pagia processing notice.