AUTRADY EOOD is the controller for account, billing, partner-program, security, and service-administration data. When a customer uses Telmetra to monitor its computers or conduct remote sessions, the customer is normally the controller and Telmetra processes customer content on that customer’s instructions.
Remote-session recording is a customer organization-controlled feature; it is not represented as always active. When an organization enables it, Telmetra may retain screen recordings and the selected input and audit data associated with the session for support, security, and accountability purposes.
Customers must give notices, obtain authorizations or consent where required, and configure recording and monitoring lawfully. Recording and related session data are retained for 30 days after the session, subject to documented exceptions such as a legal hold or customer-retention requirement.
Independently of recording, Telmetra keeps an audit record of each remote session: who connected, when, from which IP address and browser, and the actions taken (file transfers with path, file name and size, scripts run, reboots). Session content, clipboard text, and files are relayed through Telmetra servers over TLS; they are not end-to-end encrypted, and a recording, when enabled, is made on the server. A computer can be set to ask the person at it before a session starts (prompted mode) or to allow unattended access, which shows no request, so customers need to give their own notices in either case.
Depending on the activity, the legal basis may be performance of a contract, legitimate interests, compliance with a legal obligation, or consent where required.
Telmetra applies retention periods appropriate to the data category. The currently enforced operational periods include:
Retention may be extended for documented legal holds, security investigations, customer instructions, or other lawful exceptions. Account, billing, and partner-program records are retained under the applicable retention schedule and legal obligations; this notice does not promise automated deletion of those records. The same applies, at present, to the website funnel records described in section 9, blog checklist answers, push-notification subscriptions, the audit records of remote sessions and of consent changes, and the list of blocked addresses. Computer inventory and history records (hardware, network, drive health, Windows updates, backups, VPN diagnostics) have no age-based deletion either: they are deleted with the computer record, which is removed 30 days after a computer is deactivated.
Telmetra applies the following technical and organisational measures to sensitive data, including Google user data obtained through OAuth:
When a customer connects Google Drive as a backup destination, Telmetra requests https://www.googleapis.com/auth/drive.file so the Windows host can create a Telmetra Backups folder in that customer’s Drive, upload backup files into it, overwrite or rotate previous backups according to the job’s retention setting, and resume interrupted uploads. Backups run unattended as a Windows service after that one-time connect. Telmetra does not request access to the rest of the customer’s Drive. The Windows host also requests the openid and email scopes so that the connected account’s e-mail address can be shown in the backup settings.
Google user data obtained through this integration is used only to provide the requested backup feature. Telmetra does not sell Google user data, does not use it for advertising, and does not transfer it to third parties except Google (as the Drive provider) and as required by law. Use of Google user data complies with the Google API Services User Data Policy, including Limited Use requirements.
Sign-in to the Telmetra website with Google, where enabled, uses only identity scopes (openid, email, profile) to create or link an account. That flow does not access Drive files.
We do not sell personal data. We use service providers and may disclose data when necessary for the Service, to meet legal obligations, or with authorization. Our current high-level vendor register is published at Sub-processors and Service Providers.
Payment processing may be provided through Stripe and billing may also be handled through Telmetra-issued bank invoices. The data involved depends on the chosen payment method and may include contact, billing, transaction, and invoice information.
Alert and notification e-mails and push notifications can carry the alert text, the computer name, and the client name; for an event-log alert they carry the first part of the event text.
The AI-assisted features that use OpenAI are described in section 12.
Telmetra is established in Bulgaria. Hosting of the Service and related customer data uses Vultr (The Constant Company, LLC), with an instance in Frankfurt, Germany; the provider is established in the United States and processing is under a written data processing agreement, including Standard Contractual Clauses where required. Other providers, including the AI provider described in section 12, and customer-selected integrations may process data in locations relevant to their services. We do not state that processing is EU-only. See the vendor register or contact us for current information.
We use essential technologies for authentication, security, session operation, and requested services. Non-essential analytics, session-replay, support, and marketing tools load only after the applicable choice in Telmetra’s own cookie panel. A session-replay tool can record what a page shows and what you do on it, which in the console can include data about monitored computers; for a signed-in user it is also told who they are (name, e-mail address, role, account dates, and the organization’s name, plan, identifier, country, and city). The session-replay tool is not loaded on the pages that show a remote session or take a Quick Support code. Some measurement happens before you choose: two first-party cookies (a random visitor identifier and the campaign parameters of the first link, both kept for 400 days) feed records of how visitors become customers (the identifier, the campaign parameters, the referring page, the sign-up steps and, once you have an account, your user and organization identifiers); fonts, icon and script libraries and Google sign-in are loaded from other providers; and error reports and server diagnostics are sent to our error-reporting and diagnostics providers. See the Cookie Policy for current categories and choices.
For the optional Partner Referral Program, we process partner organization and contact details, referral codes, registration-time attribution information, commission ledger and payout records, and bank details necessary for payout administration. Partner visibility is limited to organization-level referral and commission information needed for the program; it does not include referred customers’ endpoint telemetry.
Referral attribution uses a referral link or code during registration, and may be corrected by authorized staff. It does not rely on non-essential cross-session referral cookies. Partner records are retained for the commercial relationship and any applicable accounting, tax, fraud-prevention, or dispute-resolution obligations; their final retention periods remain subject to the retention schedule and counsel review.
Telmetra Insights is an optional analysis feature for the technicians of a customer organization. It is off for an organization until an administrator of that organization turns it on in Profile. The choice is recorded with who made it and when, and in an audit entry. While it is off, no computer of the organization is analysed and no findings are created or shown. When it is on and a technician asks for an analysis of a monitored computer (or when a scheduled analysis has been switched on by the service operator), Telmetra asks that computer to count and group its recent Windows Event Log entries and combines the result with monitoring data Telmetra already holds, such as backup, update, antivirus, and drive-health status. Fixed rules turn the result into findings, for example repeated failed sign-ins, failing backups, or disk errors. Telmetra Insights does not use an AI model.
Findings are automatic observations about logged events. They are not a security audit and not a statement about any person, and the customer is responsible for reviewing them before acting on them or sharing them.
Telmetra uses an AI model provided by OpenAI in two features.
You may have rights to request access, correction, erasure, restriction, objection, or portability, subject to applicable law and the role in which Telmetra processes the data. For customer-managed endpoint data, Telmetra will assist the customer controller as appropriate.
Send privacy requests to [email protected] with the subject “Privacy Request.” Data-protection requests are assessed under applicable law.
Data Protection Officer: The Article 37 DPO assessment is ongoing and periodically reviewed. Until an appointment is published, use the privacy contact above.
We may update this policy to reflect changes in our processing or legal obligations. The current version and effective date are posted here, and account holders may be asked to accept a new version when they next sign in.