Privacy

Draft for review. This text describes how Smartech Cloud handles personal data today. It is a starting point written by the team, not legal advice, and the sections marked to be completed need a decision before this platform is used by customers outside a trial.

Who is responsible

Smartech (legal name, registered address and company number: to be completed) operates this platform and is the controller of the data described below. To ask about your data, or to have it corrected or deleted, write to the support address in the footer of this site.

What we hold, and why

• Your email address. It is how you are identified, how you sign in and how we tell you that your instance is ready or that your subscription needs attention. It is held while your account exists.
• Your name and company name, when the payment form asks for them: they appear on your invoices.
• The address of your instance (the subdomain you chose) and what you bought: the product, the plan, and the state of your subscription.
• Sign-in records kept by our identity provider: when you signed in, from which application, and whether it succeeded. They are what lets us answer "was that you?" and are kept for 90 days.
• Server logs. They carry IP addresses, request paths and error codes. They deliberately do not carry email addresses, instance names or anything you typed into a form.
• Whatever you put inside your instance. That is your data, not ours: we hold it so the software you bought can run, we do not read it, and we do not use it for anything else.

We do not hold card numbers. We never see them: the payment form is Stripe's own.

Who else processes it

• Stripe processes payments and holds your card details and your invoices. Their own privacy notice is at stripe.com/privacy.
• DigitalOcean hosts the servers and the databases this platform runs on.
• Amazon Web Services (Simple Email Service) delivers our emails.

Each of them acts on our instructions for these purposes and for nothing else. The list of sub-processors and the data protection agreements with them: to be completed.

Cookies

This site sets one cookie, and only after you sign in: the session cookie, which keeps you signed in between pages. It is strictly necessary for the site to work, it cannot be read by scripts, and it is not shared with anybody. A second cookie remembers the language you chose. There is no analytics cookie, no advertising cookie and no third-party tracker, which is why this site does not ask you to accept anything.

How long we keep it

• While your subscription is live, and for as long as the law requires us to keep invoices afterwards.
• If your subscription is cancelled or goes unpaid, your instance is suspended. We delete it 30 days later, and we write to you 7 days before that happens. Once it is deleted, its data is gone from our systems and cannot be recovered.
• A purchase you started and did not finish is kept for 7 days and then deleted.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, or to object to what we do with it. Write to the support address in the footer; we answer within 30 days. If you are in the European Union you can also complain to your national data protection authority.

Governing law, jurisdiction and the authority a complaint goes to: to be completed.

Changes

If this notice changes in a way that matters to you, we write to the address we have for you before the change takes effect.