Privacy Notice
This notice explains what personal information Sysera Inc. ("SYS3RA", "we", "us") collects, why, who sees it, how long we keep it, and the choices and rights you have. It is written for Canada and the United States, where we currently offer the Service.
1. Which part of this applies to you
SYS3RA is a platform that organizations and households use to manage their own devices. That gives us two different roles.
| If you are... | Our role | What governs |
|---|---|---|
| A visitor to our website, or someone who contacts us | We decide why and how your information is used (the organization responsible, or "business"). | This notice |
| The person who registers an account, or an administrator or user we invite | We decide why and how your account information is used. | This notice |
| A person whose information is in an organization's SYS3RA account, such as an employee whose laptop is managed | We act for that organization as its service provider (processor). The organization decides what is collected and why. | The organization's own notice to you, and our Terms of Service, Schedule A |
| A child in a household account, or the parent of one | We run the SYS3RA4kids service for the household. | The Children's Privacy Notice |
If you are in the third row and want to see, correct or delete your information, ask your organization first. We will help them answer you, and we will direct you to them if you write to us.
2. Who to contact
Our Privacy Officer is responsible for our compliance with privacy law. Write to privacy@sysera.ca with "Privacy" in the subject. We answer within 30 days (section 11 explains the limited case where we need longer). If you cannot use email, tell us how else to reach you through contact@sysera.ca.
3. What we collect for ourselves
| What | Examples | Where from | Why |
|---|---|---|---|
| Account and identity | Your name and email address as your sign-in provider (Google or Apple) gives them to us, that provider's identifier for you, the roles you hold, your organization or household name, a contact phone number, the country and region you tell us you are in, and the type of account | You, and your sign-in provider | To create and run the account, decide which rules apply, reach you about it |
| Household verification | A reference and status from our payment processor, and the times; never your card number | Stripe, if household verification is switched on | To confirm an adult is opening a household account |
| Billing | The plan you bought, its status and period, the processor's customer and subscription references, and invoices the processor holds; never your card number | Stripe, when you subscribe | To sell and renew your plan, and to give or end the plan on your account |
| Account activity | Sign-ins, the network address and time an access token was last used, and the record of the terms you accepted (which documents, which versions, when) | Created by your use of the Service | To keep the Service secure, show you what is using your account, and prove what you agreed to |
| Messages to us | Your name, work email, company and message from the website form; emails and support requests | You | To answer you and follow up |
| Website visits | The network address and the page requested, the time and standard request data, recorded in the web server's logs | Your browser | To deliver and secure the site |
| Service logs | Request records (path, status, time, network address, browser type), error and rate-limit records | Created by your use of the Service | To run, secure and fix the Service |
We do not collect anything about you from data brokers, and we do not buy lists.
Sensitive information. For ourselves we collect no sensitive information beyond what a sign-in account needs. The Service can process precise location and children's information, but only for a customer and on its instruction (rows 3 and 4 of the table in section 1).
4. What organizations put in the Service
When an organization uses the Service it decides what the Service collects from its devices and people. Depending on how it is configured, this can include: the list of its devices and software; security events and logs; the names, emails and roles of its administrators and users; tickets and cases; approvals; privileged-access sessions and their recordings; the location of devices it chooses to locate; and records of remote actions. The organization must tell the people concerned. We use this information only to provide the Service to that organization, and our staff look at it only as the Terms allow (support the organization asked for, security, and legal duty). The retention windows an organization can choose are in the console; the defaults are in section 9.
5. How we use information
We use the information we collect for ourselves to:
- create, approve and run accounts, and authenticate people;
- provide, secure, maintain and fix the Service, and detect and stop abuse and attacks;
- give you support and answer your messages;
- send you notices about the Service and your account (we do not send marketing email without your agreement);
- measure how the Service performs, in a way that does not identify any person;
- keep records the law requires and to establish or defend legal claims; and
- meet our legal obligations.
We do not use personal information for advertising, do not build profiles of people to market to them, do not use customer data to train artificial-intelligence models, and do not use automated decision-making that has legal or similarly significant effects on a person.
6. Who we share it with
- Our service providers, who process information for us under contract and may not use it for their own purposes: hosting, email delivery, sign-in, push notification, payment verification and, only if a customer turns it on, AI summaries. Schedule B of the Terms lists them.
- At your direction. When you connect an integration (for example Slack, Teams, Jira, a webhook), we send it what you configure.
- For legal reasons. We disclose information when the law requires, to enforce our Terms, or to protect people from serious harm. For a customer's data we tell the customer first when the law allows.
- In a business change. If we merge with, sell part of the business to, or are financed by another company, information may transfer to it, and the promises in this notice continue to apply, with notice to you.
- Aggregated information that cannot identify a person.
We do not sell personal information, and we do not share it for cross-context behavioural advertising, and we have no actual knowledge of selling or sharing the personal information of anyone under 16.
7. Cookies, local storage and similar technology
- Website. Our website sets no cookies, runs no analytics and no advertising or social-media trackers, and loads its fonts from our own server. Your browser sends us a network address and standard request details when it asks for a page; we keep them in server logs.
- Console and Portal. After you sign in, the console stores your session and display preferences (for example whether the menu is collapsed) in your browser's local storage. This is needed for the Service to work, and it is not used for advertising or tracking.
- Do Not Track and Global Privacy Control. Because we do not track you across sites and do not sell or share personal information, there is nothing for those signals to switch off. We treat a Global Privacy Control signal as a request not to sell or share.
8. Where information goes
Our systems are hosted in the United States, and our service providers process information in the United States. If you are in Canada, your personal information is therefore transferred to and kept in the United States, where it is subject to American law and can be accessed by courts, law-enforcement and national-security authorities there. If you are in Quebec, this means your personal information is communicated outside Quebec. Quebec law requires an assessment of the privacy risks of that before it happens; we make that assessment, and give a customer the information it needs for its own. We use contracts, security controls and the limits in Schedule A of the Terms to protect information wherever it is.
9. How long we keep it
We keep personal information only as long as we need it for the purposes above or as the law requires, then delete or de-identify it.
| What | How long |
|---|---|
| Account and identity information | While the account is open, then up to 90 days to finish closing it, subject to the next row |
| Records of terms accepted, payment-verification references, and records the law makes us keep | Up to 7 years |
| Messages to us and support requests | Up to 24 months after the last message |
| Website and Service logs | Normally up to 90 days |
| Backups | Rolling, and removed as they expire |
| Customer data an organization keeps in the Service | As the organization chooses. Defaults an administrator can change in the console: security events 365 days; reports 730 days; notification history 180 days; privileged-session recordings 365 days; live-response transcripts 90 days. The audit log is kept as long as the account exists because it is evidence and cannot be edited. |
Retention windows for children's information are in the Children's Privacy Notice.
10. How we protect it
We use measures that match the sensitivity of the information. They include separating each customer's data inside the database, encrypting information in transit and encrypting secrets before they are stored, tokens that expire and can be revoked, multi-factor sign-in through the customer's identity provider, a tamper-evident audit log, signed instructions to devices, testing and scanning of our code, and limiting staff access. No method is perfectly secure. If a breach of security safeguards creates a real risk of significant harm to you, we will notify you and, where the law requires, the regulator, and we keep a record of every breach for at least 24 months. If you find a weakness, please report it under our security policy.
11. Your rights
What you can ask us for. About personal information we hold as the organization responsible (section 3), you can ask to see it and get a copy, to have it corrected, to have it deleted, to move it in a usable format, to withdraw a consent you gave, and to object to a use. Write to privacy@sysera.ca. We confirm your identity first, in proportion to the request, and may ask you to answer from the email address on the account. We reply within 30 days. If a request is complex and we need longer, we tell you before the 30 days end, with the reason and the new date, which will be no more than 60 days after you asked. We charge nothing for a reasonable request. We can refuse part of a request where the law allows, for example where it would reveal another person's information, and we will say why. You may use an authorized agent; we will ask for proof that they act for you. We will not treat you differently for using a right.
Canada. Under the Personal Information Protection and Electronic Documents Act and the provincial laws that apply, you can challenge our compliance with this notice by writing to our Privacy Officer. If you are not satisfied you may complain to the Office of the Privacy Commissioner of Canada, or to the privacy regulator of your province (in Quebec, the Commission d'accès à l'information du Québec; in Alberta and British Columbia, the province's Information and Privacy Commissioner).
Quebec. In addition, you can ask that we stop disseminating your information or de-index a link to it where the law allows, and ask for your information in a structured, commonly used technological format. We do not use technology to identify, locate or profile you for ourselves; the functions that locate devices are used by customers for their own devices, and the customer must tell the people concerned. We make no decision about you using only automated processing.
California and other US states. Residents of California, and of other states with privacy laws such as Colorado, Connecticut, Oregon, Texas, Utah and Virginia, have rights to know and access, correct, delete, and receive a copy of their personal information, and to opt out of its sale, of targeted advertising and of profiling. We do none of those three, so there is nothing to opt out of. If we refuse a request you may appeal by writing to privacy@sysera.ca with "Appeal" in the subject; we reply within 45 days, and if you are still not satisfied you can contact your state attorney general. The table lists the categories of personal information we collected about residents of California in the past 12 months and why. We did not sell or share any of them, and we disclosed them for a business purpose to the service providers in section 6.
| California category | Collected? | Source |
|---|---|---|
| Identifiers (name, email, network address, account identifiers) | Yes | You; your sign-in provider; your browser |
| Customer records (phone number, organization name) | Yes | You |
| Commercial information (plan, verification-payment reference) | Yes | You; our payment processor |
| Internet or network activity (use of the Service, logs) | Yes | Your use of the Service |
| Geolocation data | Only on a customer's instruction, as its service provider | The customer's devices |
| Sensitive personal information | Only on a customer's instruction, as its service provider; for ourselves, a sign-in account credential | The customer's devices; you |
| Inferences, biometric data, professional information, education information, audio or visual data | No |
We use sensitive personal information only to provide the Service and not to infer characteristics about anyone, so the right to limit its use does not apply. California's "Shine the Light" law lets you ask who receives personal information for their own direct marketing; we share none.
If your information is in an organization's account, your rights run against that organization.
12. Children
Our website and the registration of an account are for adults. We do not knowingly collect personal information from a child through them. If you believe a child has registered, write to privacy@sysera.ca and we will delete the account. SYS3RA4kids, the parental-control part of the Service, handles children's information on behalf of their parents or guardians as the Children's Privacy Notice explains.
13. Links to other sites
The Service and our website link to or work with services we do not control, such as sign-in providers and maps. Their privacy practices are their own.
14. Changes
We may update this notice. For a change that matters we tell account holders by email or in the console at least 30 days before it applies; we always show the date and version at the top, and we will give you earlier versions if you ask.
15. Where this notice does not reach
This notice does not address the laws of the European Economic Area or the United Kingdom, because we do not currently offer the Service there. We will publish a regional addendum before we do.