Privacy policy

IKSight Inc. operates a software service for organisations and their staff.

The service is sold to organisations. If you use it through your employer, your employer decides which data is connected and who may see it, and IKSight Inc. processes that data on its instructions. Requests about your own information are usually best directed to your employer first.

Contact for privacy questions: islamkaddoumi@iksight.com. Postal address: 2542 Silent Shore Ct, Richmond, TX 77406-1814, United States. Governing law and jurisdiction: the laws of the State of Texas, United States.

Four kinds of information, and nothing beyond what the service needs to run.

Customer data is used to operate the service for the organisation that provided it, and for nothing else. It is not used to train models offered to other customers, and it is not sold.

Account information is used to sign you in, place you in the right organisation, and apply the permissions your role carries. Activity information is used to deliver the service's features and to give your organisation's administrators visibility of what happened inside it.

Aggregated, non-identifying operational metrics are used to keep the service running and to plan capacity.

Where the [GDPR or an equivalent law] applies, IKSight Inc. acts as a processor for customer data and for activity generated inside an organisation, and the organisation is the controller. For our own account records and service operation we rely on the performance of our contract with the organisation and on our legitimate interest in running a secure service.

The specific bases and any additional regional rights are set out in the data processing agreement signed with each customer.

IKsight staff who operate the service can see your activity, because they run the platform. Your organisation can obtain that same reporting and may give its administrators access to it.

Outside your organisation: no other customer, ever. We use a small number of subprocessors to operate the service, each under contract and each limited to what it needs. Apple and Google are not processors where a mobile version of the service applies — they distribute it under their own privacy policies, which we do not control.

Customer data is kept for as long as the organisation's agreement runs, and is deleted when the agreement ends.

Account information is kept while the account is active. Activity records are kept for [retention period to be confirmed] and can be deleted earlier at an administrator's request.

Backups are retained for [backup window to be confirmed] and then expire.

Each customer organisation's data is kept logically separate from other organisations'. Access is scoped by role, and administrative actions are logged.

Data is encrypted in transit and at rest. Files are reached only through short-lived, signed links.

No system is beyond compromise. If a breach affects your information we will notify the affected organisation without undue delay and, where the law requires it, the relevant supervisory authority.

Depending on where you live, you may have the right to ask for a copy of your information, to correct it, to have it deleted, to restrict or object to its processing, and to receive it in a portable form. You also have the right to complain to a data protection authority.

Because most information sits inside your organisation's own account, ask your employer's IKsight administrator first — they can act immediately. If you contact us directly at islamkaddoumi@iksight.com we will pass the request to the relevant organisation and support them in answering it, normally within 30 days.

We do not sell personal information and we do not use it for automated decisions that have a legal effect on you.

The service is sold to organisations for use by their staff. It is not directed at children and we do not knowingly collect information from anyone under 16.

Data is stored in Amazon Web Services in the United States (the us-east-2 region). If that ever changes, or information otherwise leaves the region it was collected in, the transfer will be covered by standard contractual clauses or another mechanism the law recognises, set out in the customer's data processing agreement.

If we change how the service handles information we will update this page and change the date at the top. Material changes are announced to administrators before they take effect.