Privacy notice

1. Who we are

This notice covers the website at https://dev.accesswitness.com and the vendor platform that receives its forms. The legal entity acting as data controller is [Legal review required: entity name, registered address, jurisdiction]. Contact: CONFIRM-EMAIL@example.com.

2. What this website collects

The website sets no cookies other than the customer portal’s sign-in cookie (see the cookie notice) and loads no third-party analytics, fonts, scripts or embedded content. Server logs record the request path, timestamp, response status and the requesting IP address for security and capacity purposes [Legal review required: log retention period].

When you ask to sign in to the customer portal we receive the email address you type. We email a sign-in link only if the address has an account, and to limit repeated requests we keep, for each request, a keyed one-way code made from the address (not the address itself), the time and a one-way code of your network address. These records are deleted after 7 days, and the log of portal sign-ins and sign-outs after 90 days. [Legal review required: confirm the retention periods for sign-in records]

When you submit the demo or contact form we receive exactly what you type: name, email address, company, role, tenant size, interests, topic and message, plus the anti-spam verification result. The demo form asks for a business email address.

3. Why we process it and on what basis

Form submissions are used only to respond to your request. The lawful basis is [Legal review required: legitimate interest or consent, per jurisdiction]. We do not add form submitters to marketing lists, and there is no newsletter integration yet; when one exists it will use separate, explicit opt-in.

4. Where the data goes

Submissions are stored in our own systems [Legal review required: hosting region and provider]. We do not sell or share personal data with advertisers. Sub-processors: [Legal review required: list; it must include Microsoft (Azure, which hosts the service, and Microsoft 365, where requests are also recorded)].

5. What the product never sends to us

Access Witness Private Edition runs in your infrastructure. Our licensing service receives only license and update metadata: the installation’s random instance id, the tenant id, component versions, the license key or license token, and the number of licensed users in the tenant (a single number, never a list of people). The license is validated once a day, and updates are checked once a week when automatic updates are on. It never receives SharePoint permission data, user lists, group memberships, site URLs, file metadata or audit events. See the private deployment page for the full list.

6. Retention

Form submissions are retained for [Legal review required: period] after the request is closed, then deleted. Server logs are retained for [Legal review required: period].

7. Your rights

Depending on where you live you may have the right to access, correct, delete or restrict processing of your personal data, and to complain to a supervisory authority. To exercise these rights contact CONFIRM-EMAIL@example.com. [Legal review required: jurisdiction-specific rights language, including GDPR, UK GDPR and CCPA disclosures as applicable]

8. Changes to this notice

We will update this page when our practices change and record the date of the change here. [Legal review required: effective date]