Privacy Policy

1. Two roles, and which one applies

There are two different relationships in this product and they are governed differently.

For your own account with us — the person who signs up, the people invited into a workspace, what we bill — we decide why the data is held, so we are the controller.

For everything your company puts into its workspace — your guests, your employees, your customers, your contacts — your company decides why it is held, and we hold it on your instructions. There we are the processor and you are the controller. That distinction matters when one of your customers asks you to erase them: the request is yours to answer, and the product gives you the means to answer it.

2. Who we are

SISC Suite is provided by the legal entity that provides the service, at registered address. Privacy questions and requests go to the privacy contact address, and a data protection officer if one is appointed.

3. What we hold about you as a user of the product

For each person with a sign-in, the product stores:

• Name and display name, email address, and optionally a phone number, job title, department, time zone and profile picture.
• A password, stored only as an Argon2id hash — we cannot read it and cannot tell you what it is.
• If you turn on two-factor authentication, the secret that makes it work and your recovery codes.
• A sign-in log: when a sign-in was attempted, whether it succeeded, the address it came from and the browser it came from. This is a security measure and it is one of the few things that will show us an account is being attacked.
• What you did, in an audit log — who changed what, and when.

4. What your company puts into its workspace

The product holds records about people your business deals with. Which of these exist depends on the apps you use:

• Hotel guests: name, contact details, nationality, date of birth, identity document type, number, issuing country and expiry, a photograph of that document where one is captured, stay preferences, and free-text notes staff have written.
• Employees, in the hotel and in HR: name, employer-issued number and work address, and payroll records.
• Customers and CRM contacts: name, contact details, addresses and the documents raised against them.
• Renters, travellers and address-book contacts, each with the name and contact details the app needs. A traveller’s name is stored exactly as it appears in their travel document, because ticketing will not accept anything else.

5. Where it is kept, and how it is protected

Each customer gets a database of their own. Which database a request reaches is decided by the address you signed in on, not by a column naming who owns each row — the most common way one customer sees another’s data is a query that forgot to filter, and there is no such query to forget here.

Identity document numbers are encrypted with AES-256-GCM before they are stored. A photograph of an identity document is sealed on disk and is never served from the same origin as the application.

Passwords are hashed with Argon2id. Access tokens live in the browser’s memory only and are never written to a cookie or to storage. The refresh token is stored on the workspace’s own origin, which no other workspace and no other subdomain can read.

The service is hosted at the hosting provider and the countries data is stored in.

6. Why we hold it

To provide the service you asked for, to bill for it, to keep it secure, and to meet obligations the law puts on us and on you — accounting records in particular, which several countries require to be kept for years and make an offence to destroy.

The formal mapping of each purpose to a lawful basis is the lawful-basis table, to be confirmed with counsel.

We do not make automated decisions that produce legal effects about anybody. The product suggests and refuses; it does not decide.

7. Who else sees it

This website is entirely self-contained. It sets no cookies, runs no script, loads no font, no analytics, no tag manager and no third-party code of any kind. Every byte of this page comes from this domain, which means nobody but us knows you read it. View the source and count the hosts.

The service itself uses the list of sub-processors — hosting, mail delivery, payments — and what each one receives. We will tell you before that list changes.

Where the product sends mail on your behalf, it sends it through the mail settings your company configured.

If personal data has to move between countries, the mechanism relied on is the international transfer mechanism.

8. How long it stays

While your subscription is live, your data stays until you delete it.

If you cancel, you keep full read and export access for 90 days, and your database is deleted 365 days after cancellation. We warn you 30 days, 7 days and 1 day before deletion.

Records the law requires to be kept are kept for as long as the law requires, which is longer than the two windows above. Those periods are the statutory retention periods that apply per country.

9. Your rights

You can ask for a copy of the personal data held about you, ask for it to be corrected, ask for it to be erased, object to how it is used, and complain to a regulator.

A full export of a workspace is a feature of the product, in JSON, CSV or SQL. Authentication secrets are never included in one: an export that carried password hashes and two-factor seeds would hand whoever ended up with the file the ability to impersonate every person in the company.

If your company holds your data in its workspace, send the request to that company. If it is about your account with us, send it to us at the address in section 2.

Complaints can be made to the supervisory authority a complaint may be made to.

10. What erasure actually does

Erasure in this product is not "delete every row that mentions the person", and a policy that promised that would be promising something no accounting system can do. Every column of every record a person touches is assigned, deliberately, to one of three outcomes:

• Cleared — personal data with no independent reason to keep it. It is overwritten in place, not marked deleted. A row flagged as deleted still has the name sitting in the column, readable by the next backup and by anyone with database access, which is not an erasure.
• Pseudonymised — personal data sitting on a record that has to be kept. A hotel folio is an accounting record; it keeps a payer, and the payer becomes a reference that identifies the erasure rather than the person.
• Retained — amounts, dates, currencies, transaction codes, tax withheld, filing references, and the internal identifiers that hold the retained records together. Also the audit log, which is the record that the erasure itself happened and has to survive to prove it.

11. Files are erased too, and first

A photograph of a passport is not a column. Clearing the row that points at it would leave the image on disk — still readable, and now impossible to find from the record that used to name it, which would make the erasure the very thing that made the leak permanent.

So the bytes are destroyed before the pointers are cleared, and the erasure report says which files were found and destroyed.

12. Changes to this policy

We will tell you before this policy changes in a way that affects you, and the date at the top of this page changes with it.