Privacy policy

In plain English

• We collect what running your account needs: who you are, your workspace content, the keys of the providers you connect, and usage and security logs.

• For the contacts you message through Hermeticor, you decide and we process on your behalf.

• We never sell personal data or use customer data to train models.

• Provider keys are encrypted, card details stay with Stripe, and you can access, export or delete your data at any time.

The document

This policy explains how Hermeticor, provided by Shin Bet Solutions ("we"), handles personal data. For your own account we are the controller. For the contacts you put into Hermeticor and message through it, you are the controller and we act as your processor.

What we collect

• Account data: your name, email address, workspace memberships and roles. Your password, second factors and sign-in sessions are held by Atlas (below).

• Workspace data: contacts, consent records, suppressions, lists, segments, campaigns, journeys, templates, messages and their delivery events, forms, and the audit log. You or your integrations provide it.

• Provider credentials: keys and tokens for the providers you connect. They are encrypted at rest and never returned by the API, written to logs or put in audit entries.

• Tracking data: if you install the browser or mobile SDK or use tracked links, opens, clicks, page views and events from your contacts.

• Usage and security data: API request logs, sign-ins, IP addresses, browser details and security events.

• Billing data: plan, usage and invoices. Card details are handled by Stripe and never reach our servers.

Why we use it

To provide and secure the service, to send the messages you ask for through your providers, to enforce consent and suppression, to bill you, to support you, and to improve the product in aggregate. We do not sell personal data and do not use customer data to train models.

Sub-processors

We use these providers as processors, each only for the purpose listed. The table is kept current by Forumulate from the services connected to these pages plus the ones we list, and each change is announced at least 30 days before it takes effect.

Your sending providers

The sending providers you connect (for example Amazon SES, SendGrid, Twilio) receive what is needed to deliver your messages. They are your own providers under your own agreements with them, not our sub-processors.

Retention

Account data is kept while your account exists. Workspace data is kept until you delete it or the workspace; consent and suppression records are kept as long as the law needs them as proof. When a workspace is deleted, its data is erased after a grace period.

Your rights

Depending on where you live you may access, correct, export, restrict or delete your personal data, and object to processing. Use the "Your privacy rights" form linked in the app footer; it reaches every system we use. If you are a contact of a Hermeticor customer, ask that customer first; we will help them answer you.

Changes

We announce material changes at least 30 days in advance. Questions: ask in the community or use the support chat in the app.

Sub-processors