Legal
This is the whole story of what Solar does with data about you. No hedging, no "may, from time to time". If something is true, it says so. If it depends, it says exactly when.
Last updated 31 August 2026
Solar is operated by [LEGAL ENTITY], registered at [REGISTERED ADDRESS]. For data protection law, that entity is the controller of the personal data described here.
Write to us at [PRIVACY CONTACT EMAIL]. We have not appointed a Data Protection Officer [CONFIRM DPO STATUS].
One thing worth being clear about up front: if your employer or your agency put you into a Solar workspace, then for the project content inside that workspace they decide what is collected and how long it is kept. We run the system for them. Requests about that content usually have to go through them, and we will tell you when that is the case.
Three buckets: who you are, what you make, and how the product is used. Nothing else.
Your email address, your name, and a bcrypt hash of your password. We never store the password itself. We also store your account preferences — which projects you show, how you group them, your default capacity — and the dates the account was created and last changed.
If you sign in, we issue a JWT session token to your browser or app so you stay signed in. If you reset your password, we store a single-use reset token that expires.
Issues, epics, sprints, comments, time logs and their notes, knowledge base articles and their revision history, decisions, context notes, checklists, contacts you add to the CRM, and files you attach. We store the edit history and the activity trail for this content, which records who changed what and when.
Some of this is free text you control. If you paste personal data about someone else into an issue or a document, we hold it, but we did not choose to collect it — you did. Treat Solar the way you would treat any shared work system.
Attachments are stored in Vercel Blob. We record the filename, the size, the MIME type, the storage URL, who uploaded it, and whether it was marked public.
We use PostHog, on its EU cloud (eu.i.posthog.com). It receives: the page or screen path you opened, your user id, your email address, your name, and your organisation id and name.
Autocapture is off, so we do not record every click and keystroke. Session replay is off, so there is no video of your screen. URL query strings are stripped before an event is sent, which means search terms, filter values, and anything else you typed into a URL are not captured.
If you turn on notifications, we store one push subscription per device: the Expo push token on iOS and Android, or the Web Push endpoint and its VAPID keys in a browser, plus the device name and user agent so you can tell your devices apart in settings, and the time we last saw it. A token is deleted when you unregister the device or when the push service tells us the token is dead.
We keep request logs for the MCP server and for outbound webhooks, so you can audit what an agent or an integration did. Our hosting provider keeps standard server logs, which include IP addresses.
The contact form on this site creates a ticket in our own Solar board. We keep what you wrote, your name, your email, and your company if you gave it, so we can reply.
Stated plainly, because the absence matters as much as the presence:
Under UK and EU data protection law we need a lawful basis for each thing we do. Ours:
Running your account and the product you asked for.
Account details, your content, session tokens, files.
Keeping the service secure, debugging it, and understanding which features get used.
Product analytics, request logs, server logs, audit trails.
Push notifications, and marketing email if you opt in.
Push token and device name. Withdraw it any time in settings.
Keeping records we are required to keep.
[RECORDS REQUIRED BY LAW]
These are the only companies that process data on our behalf. Each one gets the minimum it needs to do its job.
The PostgreSQL database. Everything you create in Solar lives here.
EU — eu-central-1.
Hosting for the web app and the API.
Request handling and server logs, including IP addresses. Region: [VERCEL REGION].
Storage for file attachments.
The files you upload and their metadata. Region: [BLOB REGION].
Product analytics — which screens get used.
EU cloud. Page path, user id, email, name, org id and name. No replay, no autocapture.
Sending transactional email — invites, resets, notifications.
Your email address and the contents of the email. Region: [SENDGRID REGION].
Delivering push notifications to iOS and Android, via Apple and Google.
Your device push token and the notification body.
Routing prompts to AI models, only when you use an AI feature.
The content you sent to that feature. Provider: [AI GATEWAY PROVIDER].
Optional. Only if you connect it.
Your GitHub username and id, and an OAuth token scoped to what you granted.
We do not add a processor to this list without updating this page. Our contracts with them are covered by [DATA PROCESSING AGREEMENT STATUS].
The mobile apps collect the same things as the web app, plus a push token. They contain no advertising or attribution SDKs.
The complete list of what the apps send:
None of it is used for advertising or tracking, none of it is linked to identifiers from other companies' apps, and it is not sold. Apple and Google handle the delivery of a push notification once Expo hands it to them; each has its own privacy terms for that leg.
The database is in the EU: Neon, region eu-central-1. Product analytics is on PostHog's EU cloud. Both stay in the EU.
Some of our other processors operate outside the EU or the UK — email delivery and push in particular. Those transfers rely on [TRANSFER MECHANISM — e.g. SCCs / UK IDTA / adequacy decision].
For as long as your account exists.
Deleted when you delete the account — see below.
For as long as the organisation that owns the project keeps it.
Deleting your account does not delete the issues and documents your team still relies on.
Deleted data persists in database backups until they roll off.
[BACKUP RETENTION WINDOW]
Held by PostHog on its EU cloud.
[POSTHOG RETENTION SETTING]
Security, debugging, and audit.
[LOG RETENTION WINDOW]
Until you unregister the device or the token stops working.
Then deleted immediately.
You can delete your Solar account and the personal data attached to it. You do not have to email anyone to start it, and we do not make you cancel a subscription first.
In the app or on the web: [IN-APP DELETION PATH — e.g. Settings → Account → Delete account]. Or email [PRIVACY CONTACT EMAIL] from the address on the account and ask us to delete it. Either route is fine; the email route takes [MANUAL DELETION SLA].
Issues, comments, documents and files inside an organisation's projects belong to that organisation, not to your login. If you delete your account, that work stays so your colleagues' projects do not fall apart — but it stops being attributed to a live user. If you want that content removed too, the organisation's owner has to ask, because it is their data.
Deleted records persist in database backups until those backups expire ([BACKUP RETENTION WINDOW]). We do not restore a deleted account from a backup.
Deleting the mobile app from your phone does not delete your account. Use the path above.
Depending on where you live you can ask us to: give you a copy of your data; correct it; delete it; export it in a portable format; restrict or object to what we do with it; and withdraw a consent you gave.
Email [PRIVACY CONTACT EMAIL]. We answer within [RESPONSE WINDOW — e.g. 30 days]. We do not charge for this, and we do not make the product worse for you because you asked.
If we get it wrong, you can complain to your data protection regulator — [SUPERVISORY AUTHORITY]. We would rather you told us first.
Solar ships an MCP server so an AI agent can do the same things you can do in the UI. It works on per-user tokens. An agent holding your token acts with your permissions — no more, and no less.
That means an agent can read exactly what you can read. We log MCP requests so you can see what it did. Revoke a token and the access stops immediately.
When you use an AI feature, the content you point it at is sent to a model through our AI gateway. We store a record of what was generated so you can trace it back. Do not point an AI feature at content you are not permitted to send to a third-party model.
Whether prompts are retained or used for training by the model providers is governed by their terms: [AI PROVIDER DATA RETENTION / TRAINING TERMS].
A client invited to a project sees only the issues explicitly marked client-facing for that project, plus whatever portal sections the project owner turned on. Internal issues, internal comments and unposted time notes are not visible to them.
To invite a client we store their email address and an invite token that expires. If you are a client reading this: the agency that invited you decides what you can see and what they keep. Ask them first; we will point you to them.
Solar is a tool for people at work. It is not for children. We do not knowingly collect data from anyone under [MINIMUM AGE]. If you believe a child has an account, email us and we will delete it.
When we change this page we change the date at the top. If a change actually affects you — a new processor, a new category of data, a new purpose — we email the account holders before it takes effect, at least [NOTICE PERIOD] in advance.
Privacy questions, data requests, and deletion requests: [PRIVACY CONTACT EMAIL]. Postal address: [REGISTERED ADDRESS].
Security issues go to our security page instead. The terms you agree to when you use Solar are on the terms page.