Privacy policy

Who is responsible

SIMONIAN, trading as TrustyAccess, is responsible for your company's account, its billing and what you write to us.

The record of your company's own people and computers is your company's: your company decides how it's used, and we handle it on your company's behalf. Questions and requests go to the address at the end of this page.

What we keep

• Account details. Your name, username, email address, phone number, company name and time zone, and whether your email is confirmed.
• Computers. The name, system and addresses of each computer you add, when it was last seen, and its saved password, which is kept sealed under your company's own key.
• The record of use. Every connection (who connected to which computer, when, from which address and country, for how long, how it ended), every file transfer (the file names and sizes, never the files), every login to the web and the client with its address, and every change a manager makes.
• Login records. Wrong passwords, locks, blocked addresses and similar events, so attacks on your account and on the service are seen.
• Payment facts. Payments are taken by Paddle.com, our merchant of record. We never see your card details. We receive the order's status, the plan it is for and the email address it was placed with.
• Messages. What you write to us, so we can answer.

Why we keep it

• To run the service you signed up for: logins, access rules, connections and the logs your managers read. The legal basis is the agreement between us.
• To keep accounts and the service safe: locks after wrong passwords, blocked addresses, notifications. The legal basis is our legitimate interest in a safe service, which is also yours, and you can object to it (see Your rights).
• To send you the emails the service needs: confirmation links, notifications about your logins, the notifications your company turned on. You choose most of them on your Account and Settings pages.
• To meet legal obligations, such as keeping payment records.

We don't sell data, we don't advertise, and we don't track you across other sites.

Where it is and who else sees it

• Hetzner runs the servers, in Nuremberg, Germany; the data on them is ours to manage and sealed where it is sensitive.
• Paddle.com takes payments as our merchant of record under its own privacy policy, and sends receipts and invoices.
• Amazon Web Services sends the emails the service sends.
• DreamHost holds our mailboxes, where your messages to us arrive.
• The managers of your own company see the record of use of your company, which is the point of the service. No one at another company sees anything of yours.
• We disclose data to authorities only when the law obliges us to.

Some of them are outside the EU. Paddle.com is in the United Kingdom, which the EU recognizes as protecting personal data. Amazon Web Services and DreamHost are in the United States and handle data under their data processing terms; Amazon's include the EU's standard contractual clauses. We run the service from Lebanon. We'll update this list before we add anyone new.

How long we keep it

• Account and computer details: while the account exists. After a license ends without renewal they're kept for two years, so a renewal brings everything back; then they're deleted. Ask us and we delete them sooner. When a company is deleted, its data goes with it.
• The record of use: for the number of days your managers set on the Settings page, within the maximum of your plan, then it is removed.
• Login records: up to one year.
• Backups: kept for a limited time and then overwritten, so deleted data leaves the backups too.

Cookies

The web uses only its own cookies, and only the ones the service needs: one that keeps you logged in, one that protects forms, one that remembers a browser you've logged in from, and one that keeps your two factor trust when you ask for it. No advertising cookies, nothing that follows you elsewhere.

No page loads a script from anyone else.

Security

Everything travels over encrypted connections. Computer passwords are stored sealed under a key that only your company's logins can open. Logins are protected by rate limits, locks and optional two factor. The record of use is written as a chain, so a change to it would be noticed. Access to the servers is by key only.

Your rights

You can ask us at any time to show you the data we hold about you, to correct it, to export it or to delete it, to limit how we use it, or to object to how we use it, for example to the login records we keep to protect accounts. Most of it you can read and change yourself on your Account and Settings pages.

For the record of your company's own people, ask your company first: it decides about that record, and we help it answer. Write to the address below and we answer within 30 days. If you think we handle your data wrongly, you can also complain to the data protection authority where you live.

Changes to this policy

When this policy changes we post the new version here with the date it takes effect, and for a material change we email the managers of your company before it does.