Privacy Notice

Version 2026-10-13

Draft. This text is awaiting legal review and is not yet in effect; details in square brackets are still to be completed.

This notice explains what personal data SDCS Global collects when you use your SDCS account and our products, why we collect it, who else handles it, how long we keep it, and what you can do about it. A product may have a notice of its own that adds to this one for that product.

1. Who we are and what this covers

[full legal name of the company, for example SDCS Global LLC], [registered address] (“SDCS Global”, “we”, “us”) runs the SDCS account system — one account for every SDCS Global product — and is the controller of, and responsible for, the personal data described here. Questions and requests: [email protected].

This notice covers the account system, the account site at id.sdcsglobal.com, and SDCS Global websites and products that link to it. It does not cover what an organization you belong to does with information about you, or apps and services made by others that you sign in to with your SDCS account; those are governed by their own policies.

2. What we collect

What you give us:

Your account: your name, your email address, and a recovery email address if you add one.
How you sign in: your password, kept only as a salted hash that we cannot read; your passkeys' public keys and the names you give them; your authenticator app's secret, encrypted; your recovery codes, hashed. A passkey's fingerprint, face or PIN check happens on your own device and never reaches us.
Organizations: the ones you create or belong to, your role in each, the people you invite (their email addresses), and its billing email address.
Purchases: what you or your organization bought, its price, status and renewal date, who holds its seats, and license keys. Your card details go straight to Stripe; we receive confirmation of payment and reference numbers, never your full card number.
Your agreement to our terms: which version you agreed to, and when.
What you write to us: support requests, security reports, legal notices.
What you put in a product: described in that product's own notice.

What is recorded as you use the account system:

Where you are signed in: for each device, its IP address, its browser and operating system, and when it was last used.
What happens on your account: a record of sign-ins and failed sign-in attempts, of every change to your account, of what you do in an organization, and of anything our support staff or an organization's admins do to your account — each with the time and the IP address and browser it came from.
Security signals: counts of failed attempts, whether a sign-in came from a device that is new for your account, and the result of the bot check where we use one.
Connected apps: which SDCS products and other apps you have allowed to use your account, what you allowed each to see, and when each last asked whether you may use it.

What we get from others:

From an organization's owners and admins: your email address when they invite you.
From Stripe: whether a payment succeeded, and the status of a subscription.
From our password check: when you choose a password, we ask the Have I Been Pwned service whether it has appeared in a known breach. Only the first five characters of a one-way hash of the password are sent — never the password, and nothing that identifies you.

What we do not do: we do not buy data about you, we do not track you across other sites, we do not build advertising profiles, and we do not ask for special categories of data such as health, beliefs or biometrics.

3. Why we use it, and on what legal basis

To create your account, sign you in, and keep the account yours — including recording sign-ins, devices and changes, and emailing you codes and security alerts. Basis: performing our contract with you, and our legitimate interest in keeping accounts secure.
To give you the products you or your organization have bought, to bill for them, and to answer a product's question about whether you may use it. Basis: performing our contract.
To run organizations: showing owners and admins who their members are and what happens in the organization. Basis: performing our contract with the organization, and its and our legitimate interest in managing access.
To detect, investigate and stop fraud, abuse and attacks: repeated failed sign-ins, automated sign-ups, sign-ins from new devices. Basis: our legitimate interest in protecting you, other users and the Services.
To answer you when you write to us. Basis: our legitimate interest in supporting our users, or performing our contract.
To keep the Services working and to fix and improve them, using logs and aggregate figures. Basis: our legitimate interest in running a reliable service.
To meet legal obligations — tax and accounting records, lawful requests from authorities — and to establish, exercise or defend legal claims. Basis: legal obligation, and our legitimate interest in protecting our rights.
To send you news about our products, only if you have asked for it. Basis: your consent, which you can withdraw at any time with the unsubscribe link in each message.

Where the basis is our legitimate interest, you may object (see “Your rights and choices”). Where we need data to perform our contract with you and you do not give it, we may be unable to provide the account or the product.

4. Cookies

The account site uses only the cookies it needs in order to work and to remember a choice you made:

a session cookie that keeps you signed in;
a device cookie that remembers that this browser has completed a full sign-in to your account, so that it is not asked for an emailed code every time;
short-lived cookies that carry a sign-in from an app to the account site and back;
a cookie that remembers the color theme you chose, if you chose one;
where the bot check is on, whatever Cloudflare's check stores in your browser to tell a person from a script.

If you leave “Keep me signed in” ticked, your browser also keeps your name and email address in its own storage, so that the sign-in page can offer your account next time. It stays in that browser, is not sent to us, and is removed when you choose “Forget” on the sign-in page.

There are no analytics or advertising cookies, and nothing on the account site follows you to other sites. You can block or delete cookies in your browser, but signing in will not work without them. Because we do not track you, the account site behaves the same whether or not your browser sends a “Do Not Track” or Global Privacy Control signal.

5. Who else sees it

The SDCS products and other apps you sign in to receive your permanent account id, and your name and email address when you allow it. You can see and remove each one under Connected apps. An app made by someone other than SDCS Global handles what it receives under its own privacy policy.
The owners and admins of an organization you belong to see your name, email address and role, and what you do in that organization. The organization is responsible for what it does with that information.
SDCS Global support staff can look up an account to help its owner or to deal with abuse. Every look and every action is recorded, and you see it in your own activity.
Companies that process data for us, on our instructions and under contract: Microsoft (Azure hosting and database, and delivery of our emails), Stripe (payments), Cloudflare (domain name service, network protection and the bot check) and Have I Been Pwned (the breached-password check described above).
Our professional advisers — lawyers, accountants, auditors, insurers — where they need it to advise us, under duties of confidentiality.
Authorities, courts and other parties, where the law requires it, or where we believe in good faith that it is necessary to protect the rights, property or safety of our users, the public or us, or to enforce our terms.
A buyer or successor, if all or part of our business is merged, sold, reorganized or wound up. Your data would remain subject to this notice unless you are told otherwise.
Anyone else, when you ask us to or agree to it.

We do not sell personal data, and we do not share it for cross-context behavioral advertising. We have not done either in the past twelve months.

6. How long we keep it

Your account details and sign-in methods: for as long as you have the account.
Ended sessions and records of sign-in attempts: 30 days.
Unfinished sign-ups, and links and codes that have expired: one day after they expire.
The activity record: [how long activity records are kept].
A deleted account: closed at once, erased after 30 days. What remains is a record with no name, email address or sign-in methods, kept so that an organization's history and financial records still add up.
Purchase and billing records: as long as tax and accounting law requires.
What you write to us: for as long as it takes to deal with it, and afterwards for as long as a claim about it could be brought.
Backups: overwritten within 35 days.

We may keep data for longer where the law requires it or where we need it to establish, exercise or defend a legal claim.

7. How we protect it

Connections are encrypted. Passwords and recovery codes are stored only as hashes; secrets such as authenticator keys are encrypted. Each organization's data is separated from every other's in the database itself. Every change is recorded, and unusual activity raises an alert. Access by our own staff is limited and logged.

No system is perfectly secure, and we cannot guarantee that ours will never be breached. You protect your account too: use a passkey or an authenticator app, keep your recovery codes safe, and tell us at once if something looks wrong. If a breach affects your personal data, we will tell you and the authorities as the law requires.

8. Where it is processed

We store and process personal data in the United States, and the companies that process data for us may do so in other countries as well. Those countries may not protect personal data in the same way as the country where you live. When we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we rely on a mechanism the law recognizes, such as the European Commission's standard contractual clauses. You can ask us for a copy of the safeguards we use.

9. Your rights and choices

On the account site you can, at any time:

see and correct your details under Your info, and your sign-in methods under Security;
see every device signed in to your account and sign any of them out;
see what has happened on your account;
download everything we hold about you from the account page;
remove an app's access under Connected apps;
delete your account from the account page.

Depending on where you live, the law may give you further rights:

In the European Economic Area, the United Kingdom and Switzerland: to get a copy of your data, to have it corrected or erased, to have its use restricted, to receive it in a portable form, to object to our use of it where we rely on a legitimate interest, and to withdraw a consent you gave. You may also complain to the data protection authority where you live or work.
In California and other United States states with privacy laws: to know what personal information we collect, use and disclose; to get a copy of it; to have it corrected or deleted; and not to be treated differently for using these rights. Those laws also give a right to opt out of the sale of personal information, of its sharing for targeted advertising, and of certain profiling; we do none of these. We use sign-in credentials, which some of these laws treat as sensitive, only to sign you in and protect your account.

For those United States laws, the categories of personal information we collect are: identifiers (name, email address, account id, IP address); customer records and commercial information (what was bought, and when); internet and network activity (sign-ins, devices, actions on the account); and account sign-in credentials. The sources, the purposes and the parties we disclose them to are set out in the sections above.

To use a right that the account site does not already give you, write to [email protected] from the email address on your account. We may ask you to sign in or to confirm that address so that we know the request is yours. Someone you have authorized may make a request for you if they show us that authority. We answer within the time the law sets. If we turn a request down, you may ask us to look again by replying to our answer, and you may complain to your regulator.

10. Automated checks

To protect accounts we use automated checks: sign-in attempts are slowed after repeated failures; a bot check may be shown on sign-up and on sign-ins that keep failing; and a sign-in from a device that is new for the account sends an email to its owner. None of these decides anything with legal or similarly significant effect on you.

11. Children

The Services are not directed to anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, write to [email protected] and we will delete it.

12. Changes to this notice

When this notice changes, we post the new version here with its date, and the account site asks you to read it before you carry on. The date at the top of this page is the version in force.

13. Contact and complaints

Write to [email protected], or by post to [full legal name of the company, for example SDCS Global LLC], [registered address]. If you are not satisfied with our answer, you may complain to the data protection authority or the consumer protection regulator where you live.