Dovetail

Description Features Permissions Security & Compliance

Dovetail helps you make sense of all your customer research data in one intuitive, collaborative, and searchable research analysis and repository product.Dovetail works where you work. Share content from your repository, get updates about changes in your projects, and receive comments in real-time—all via Slack.:owl: Never miss an update. Get notifications for new comments and mentions that are relevant to you.
:leopard: Keep projects moving. Like or reply to Dovetail comments directly from Slack.
:shell: Search your repository from Slack. Reference findings without leaving the conversation. Loop insights directly into the chat using /dovetail.
:herb: Share research where your team works. When you share a Dovetail link in this Slack workspace, we will automatically show a rich preview so everyone has context, regardless of whether they have a Dovetail account.

Permissions

Dovetail will be able to view:

Dovetail will be able to do:

Review the details to better understand this app’s security practices. To learn more about assessing apps for your workspace visit our Help Center.

General

Privacy & data governance

Data retention policy

Deleting data • Users can delete projects and project data within Dovetail if they have the correct access rights. Deleted project data is kept in a "trash" facility (https://dovetailapp.com/help/the-basics/trash/) within the application and can be restored for up to 30 days before it is permanently deleted. It can take up to 60 days for all data to be removed from backups. Deleting workspaces • Users can delete their entire Dovetail workspace (https://dovetailapp.com/help/data-retention/) if they have the correct access rights. This will delete all data that you have provided to Dovetail. It can take up to 60 days for all data to be removed from backups. Subscription cancellation • Following the cancellation of a Dovetail subscription, you will have at least 30 days to download your customer data from Dovetail. After this period, we have no obligation to maintain or provide any customer data to you. We may delete all customer data provided to us after this period. Free subscriptions • For Free Plans, data will be retained in the workspace until a cancellation is submitted (in accordance with Section 8.3 of our Master Subscription Agreement). Dovetail reserves the right to, upon prior written notice to Customer, delete accounts for Free Plans (and all Customer Data contained therein) that have been inactive for more than 90 days.

Data archiving and removal policy

Data storage policy

What data does Dovetail store? • When provisioning a user account, users must provide personal information such as their email address, full name, and optionally, a profile photo. • While using the services, authorized users can upload, import via CSV or Zapier, or directly enter any data such as text, images, audio, video, or any other files. • To best understand the data that you expect to store in Dovetail, we recommend talking to the individuals and end-users who will be using Dovetail. Most Dovetail customers will store research data such as interview recordings, transcripts, survey responses, customer feedback, photographs, and other research data. The data that you enter into Dovetail may vary depending on the use cases of your individual end-users. Where does Dovetail store data? • We store data in Amazon Web Services (AWS) (https://aws.amazon.com/) who is our primary infrastructure provider.

Data center location(s)

United States, Ireland

Data hosting company

AWS

App/service has sub-processors

yes

Guidelines for sub-processors

https://dovetailapp.com/help/data-subprocessors/

Certifications & compliance

SOC attestation

https://dovetailapp.com/help/soc2-type-ii/

GDPR commitment

https://dovetailapp.com/help/dovetails-gdpr-commitment/

Data deletion request procedure

Data Subject Access Request • A Data Subject Access Request (“DSAR”) is any request made by an individual or an individual’s legal representative for information held by the Company about that individual. The Data Subject Access Request provides the right for data subjects to see or view their own personal data as well as to request copies of the data. • A Data Subject Access Request must be made in writing. In general, verbal requests for information held about an individual are not valid DSARs. In the event a formal Data Subject Access Request is made verbally to a staff member of the Company, further guidance should be sought from Data Protection Officer, who will consider and approve all Data Subject Access Request applications. • A Data Subject Access Request can be sent to us by emailing legal@dovetailapp.com or posting a letter to the address listed at the bottom of our about page (https://dovetailapp.com/company). DSAR Process Request • Upon receipt of a DSAR, the Data Protection Officer will acknowledge the request. The requestor may be asked to complete a Data Subject Access Request Form to better enable the Company to locate the relevant information. Identity verification • The Data Protection Officer needs to check the identity of anyone making a DSAR to ensure information is only given to the person who is entitled to it. If the identity of a DSAR requestor has not already been provided, the person receiving the request will ask the requestor to provide two forms of identification, one of which must be a photo identity and the other confirmation of address. • If the requestor is not the data subject, written confirmation that the requestor is authorized to act on behalf of the data subject is required. Information for Data Subject Access Request • Upon receipt of the required documents, the person receiving the request will provide the Data Protection Officer with all relevant information in support of the DSAR. • Where the Data Protection Officer is reasonably satisfied with the information presented by the person who received the request, the Data Protection Officer will notify the requestor that his/her DSAR will be responded to within the 30-day response period. The 30-day response period begins from the date that the required documents are received. The requestor will be informed by the Data Protection Officer in writing if there will be any deviation from the 30-day response period due to other intervening events. Review of Information • The Data Protection Officer will contact and ask the relevant department(s) for the required information as requested in the DSAR. This may also involve an initial meeting with the relevant department to go through the request if required. • The department which holds the information must return the required information by the deadline imposed by the Data Protection Officer and/or a further meeting is arranged with the department to review the information. The Data Protection Officer will determine whether there is any information which may be subject to an exemption and/or if consent is required to be provided from a third party. • The Data Protection Officer must ensure that the information is reviewed/received by the imposed deadline to ensure the 30-day response period is not breached. Response to Access Requests • The Data Protection Officer will provide the finalized response together with the information retrieved from the department(s) and/or a statement that the Company does not hold the information requested, or that an exemption applies. The Data Protection Officer will ensure that a written response will be sent back to the requestor. This will be via email. Archiving • After the response has been sent to the requestor, the DSAR will be considered closed and archived by the Data Protection Officer.

HIPAA compliant

While this app may offer HIPAA compliance, Slack does not have a business associate agreement with any third-party application providers, including those in the Slack App Directory, so you are responsible for validating the provider's compliance and executing an appropriate agreement before enabling.

Security