Element

"You have rights in relation to the personal data we hold about you. Some of these only apply in certain circumstances. Some of these rights are explored in more detail elsewhere in this document. For completeness, your rights under GDPR are: The right to erasure."

"For more information about these rights, please see the guidance provided by the ICO. If you have any questions or are unsure how to exercise your rights, please contact us at dpo@element.io."

"In exceptional circumstances, we may share information about you with a third party if we believe that sharing is reasonably necessary to (b) protect the security or integrity of our products and services (e.g. for a security audit)"

"Our analytics are powered by the Free and Open Source analytics platform Matomo, hosted entirely within our network. The servers which host this data are located in the EEA, specifically in London, United Kingdom. We don't share any analytics data with third parties."

"Paying for hosted homeserver services via EMS is handled entirely by our payment processor, Stripe. The processor stores your credit card information as well as your billing contact information in order to process your monthly or annual automatic renewals, or to allow you to upgrade or downgrade your subscription without re-entering a credit card number."

"The data we collect in our transaction database, including Personal Data, is not shared with third parties, except for the purposes of determining the validity of a payment. We use a third-party, Quaderno, to help us with tax automation within our billing system."

"In the event that we sell or buy any business or assets, we may disclose your personal data to the prospective seller or buyer of such business or assets. If we or substantially all of our assets are acquired by a third party, personal data held by us about our users will be one of the transferred assets."

"In exceptional circumstances, we may share information about you with a third party if we believe that sharing is reasonably necessary to (a) comply with any applicable law, regulation, legal process or governmental request, (c) protect Element and our users from harm or illegal activities, or (d) respond to an emergency which we believe in good faith requires us to disclose information to assist in preventing the serious bodily harm of any person."

"We never store password data in plain text; instead they are stored hashed (with at least 12 rounds of bcrypt, including both a salt and a server-side pepper secret). Passwords sent to the server are encrypted using SSL."

"Data stored in Element is accessible by the Customer's account and by Element engineers (employees and contractors) under the conditions outlined below."

"We restrict who at Element (employees and contractors) can access Element data to roles which require access in order to maintain the health of the Element apps and services. We never share what we see with other users or the general public."

"We host the Element Matrix Services on Amazon Web Services (AWS), specifically: Our admin server is hosted in an AWS data centre in Amsterdam; Our deployment server is hosted in an AWS data centre in London; Customer deployments have the option to select the geographical location which is the most convenient for them; We also host the Gitter.im app on AWS, in a datacenter based in the East of the US. Amazon employees may have access to this data. Here's Amazon's privacy policy. Amazon controls physical access to their locations. We use Cloudflare to mitigate the risk of DDoS attacks. Here's CloudFlare's privacy policy. Physical access to our offices and locations use typical physical access restrictions. We use secure private keys when accessing servers via SSH, and protect our AWS console passwords locally with a password management tool."

"We make the invoice links purposefully long and hard to guess for added security, and we prevent search engines from indexing them."

"All of the Element user data resides within the same dedicated cluster. We use software best practices to guarantee that only the Customer can access it. In other words, we segment User data via software. We do our best and are very confident we're doing a good job at it, but, like every other service that hosts User data on the same database, we cannot guarantee that it is immune to a sophisticated attack."

"Over time we may make changes to this document. If we make a material change we will provide the Customer with reasonable notice prior to the change. We will set forth the date upon which the changes will become effective; any use of Element by the Customer, or any use of a hosted homeserver from EMS by a User will constitute the Customer's acceptance of these changes. Your access and use of Element is always subject to the most current version of this document."

"We might collect information about you through adverts placed in third-party platforms such as LinkedIn, Twitter or Google. Whenever you click an advert on these platforms you may be asked to provide details such as: Email address, Organisation of employment, Job title. Within each of these adverts you will be notified of the legal basis under which your data will be processed. This information will be stored on our marketing automation platform Force24 and our CRM system Pipedrive, and will be processed in accordance with this policy.

"The information we collect is for the purpose of supporting your management of hosted homeservers through Element Matrix Services, or to support operational maintenance of the Element Matrix client. We do not profile homeserver Users or their data, but we might profile metadata pertaining to the configuration and management of hosted homeservers so that we can improve our products and services."

"The information we collect is for the purpose of supporting your management of hosted homeservers through Element Matrix Services, or to support operational maintenance of the Element Matrix client. We do not profile homeserver Users or their data, but we might profile metadata pertaining to the configuration and management of hosted homeservers so that we can improve our products and services."

"We collect information about you when you input it to the Element or Element Matrix Services apps or otherwise provide it directly to us."

"We collect information when you register for an account. This information is kept to a minimum on purpose, and is restricted to: Email address, Authentication Identifier; one of: Email address and password, Twitter id, Google id. Your authentication identifier is used to authenticate your access to Element Matrix Services at https://ems.host and to uniquely identify you."

"Paying for hosted homeserver services via EMS is handled entirely by our payment processor, Stripe. The processor stores your credit card information as well as your billing contact information in order to process your monthly or annual automatic renewals, or to allow you to upgrade or downgrade your subscription without re-entering a credit card number. We never have access to, nor store your full credit card information."

"The payment processor code we use also sets a cookie in your browser, to remember your info for future purchases. You can delete or block that cookie if you wish; our website will continue to work."

"We require you to enter your billing information. This data, as well as the last four digits of your credit card which is sent to us by our payment processor, is stored in our transaction database in order to maintain our financial records. This information appears on your invoice, which can be accessed by anyone who has been sent the url link to your invoice. We make the invoice links purposefully long and hard to guess for added security, and we prevent search engines from indexing them. The history of changes to the billing contact information on the invoice made by you or our team are logged and stored in our transaction database."

"The data we collect in our transaction database, including Personal Data, is not shared with third parties, except for the purposes of determining the validity of a payment. In this case we may share the name and email address associated with the purchase with the credit card holder, your company's accounting department, or with our payment processor when responding to a chargeback. We use a third-party, Quaderno, to help us with tax automation within our billing system."