Legal
Privacy policy
This policy lists the personal data Phase uses, the reason for each use and the rights you have.
Last updated on 12 November 2026.
1. Scope and roles
Phase is a service of The Empire Holding B.V., Coolhaven 238A, Rotterdam, the Netherlands, Chamber of Commerce (KvK) number 76281310. In this text, "Phase" and "we" mean that company. This policy covers pfase.com, the Phase app and the Phase viewer.
Phase has two roles under the GDPR:
- Controller. Phase decides how it uses the data of account holders, of people who visit pfase.com and of people who write to us.
- Processor. A workspace that shares a link decides how the data of its readers is used. Phase handles that data for the workspace, under a data processing agreement.
If you are a reader, the workspace that sent you the link is your first contact. We pass each request we receive to that workspace.
2. Personal data of account holders
| Data | Source |
|---|---|
| Name, work email, company name and an optional photo | You enter them when you sign up or edit your profile. |
| Your role and your activity in a workspace: uploads, shares, changes to files and links | The app records them while you work. |
| Plan, number of seats, billing address, VAT number and invoices | You enter them when you subscribe. Stripe returns the invoices. |
| Messages you send us | You write to us by email. |
Stripe handles card and bank details. Phase does not receive or store them.
3. Personal data of readers
The viewer records a visit only after the reader accepts the tracking notice. A link with tracking off records nothing.
- The name and email address of the reader, when the link asks for them.
- The slides the reader opened and the active time on each slide.
- Zoom, full screen, downloads, clicks on hotspots and the position of the pointer on a slide.
- Questions the reader sends through the viewer.
- The type of device and the size of the browser window.
The viewer sets no cookies, writes nothing to the browser of the reader and does not fingerprint the reader.
4. Technical data
Our servers and Cloudflare use your IP address and browser type to deliver each page and to stop abuse. Phase does not store the IP address with a visit.
pfase.com sets no cookies and loads no analytics or advertising scripts. The app keeps your session and your plan choice in the storage of your browser. It needs this storage to keep you signed in.
5. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create your account, run your workspace and send sign-in and alert emails | Performance of our contract with you (Article 6(1)(b) GDPR) |
| Charge for a plan and send invoices | Performance of our contract with you |
| Keep invoices and tax records | A legal obligation (Article 6(1)(c) GDPR) |
| Keep the service secure, find faults and stop abuse | Our legitimate interest in a safe service (Article 6(1)(f) GDPR) |
| Answer your messages | Our legitimate interest in support for our users |
| Record reader activity for a workspace | The instructions of that workspace. The workspace selects the legal basis, and the viewer asks the reader to accept first. |
Phase does not sell personal data and does not use it for advertising. Phase makes no decision about you by automated means alone.
6. Processors
These companies process personal data for Phase. Each one has a contract with data protection terms.
| Company | Task | Location |
|---|---|---|
| Pushleft | Servers, database and file storage | EU |
| Cloudflare | Network, DNS and protection against attacks | EU and worldwide |
| Stripe | Payments, invoices and tax calculation | EU and United States |
| Messy, a service of our own company | Sign-in and alert emails | EU |
| Amazon Web Services | Email delivery | EU (Ireland) |
Write to [email protected] for the current list and for notice of a change.
7. Transfers outside the EEA
Phase stores files, the database and visit data in the EU. Cloudflare and Stripe can process data in the United States. These transfers use the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission.
8. Retention
| Data | Period |
|---|---|
| Account and workspace data | Until you close the workspace. Phase deletes the data 30 days after that date. |
| Files in the trash | 30 days. |
| Visit data of readers | The period the workspace sets. The default is 24 months. |
| Invoices and tax records | 7 years, as Dutch tax law requires. |
| Messages you send us | 2 years after the last message. |
9. Your rights
You can ask us to:
- give you a copy of your personal data;
- correct data that is wrong;
- delete your data;
- limit the use of your data, or stop a use that depends on our legitimate interest;
- give your data to you or to another service in a common format.
Write to [email protected]. We answer within one month and do not charge for a request.
You can also complain to the data protection authority of your country. In the Netherlands this is the Autoriteit Persoonsgegevens.
10. Security
The security page lists the measures that protect your files and the data of your readers. If a data breach puts your rights at risk, we tell you and the authority without delay.
11. Age limit
Phase is a service for companies. Do not use it if you are younger than 16.
12. Changes to this policy
We put each new version on this page with its date. If a change has an effect on your rights, we send an email to the owners of each workspace 30 days before the change starts.
13. Contact
Send questions about this policy or about your data to [email protected], or write to The Empire Holding B.V., Coolhaven 238A, Rotterdam, the Netherlands.