Privacy Policy

Effective date: 24 June 2026 This Privacy Policy explains how AZTCO RDP MFA processes personal data and security data when providing the administration portal, authenticator PWA, email approval, device enrollment, connector, AD/local sync, audit, support, documentation, and related services. 1. Data we process The platform may process tenant details, administrator and user names, email addresses, roles, tenant slugs, RDP or Windows usernames, language preference, subscription and billing metadata, server names, connector type and version, health reports, policy sync status, device names, device enrollment status, PWA client version, push subscription metadata, trusted device identifiers, login/session metadata, IP or subnet policy values, audit events, email delivery events, support tickets, attachments, documentation content, SMTP/log-forwarding configuration, service key prefixes, activation token metadata, and operational diagnostics. 2. Authentication and MFA data For MFA, the platform processes enrollment tokens, challenge identifiers, approval/denial status, fallback code attempts, email approval links, push notification metadata, device public keys, signature verification data, expiry times, lockout counters, and audit records. Passwords and secrets should be stored only as protected hashes or encrypted values where applicable. The platform should never display full service API keys after creation. 3. Connector and local directory data The NPS extension, Credential Provider connector, and AD/local sync agent may send usernames, server identity, connector health, policy sync status, AD/local user attributes selected for synchronization, and authentication challenge information. Customers control what directory users are synchronized and must ensure they have a lawful basis and authority to process that data. 4. Why we process data We process data to authenticate users, deliver MFA approvals, enroll and revoke devices, enforce tenant/server/user policy, manage subscriptions, provide support, send operational emails, detect abuse, audit administrative actions, synchronize connectors, forward logs when configured, maintain security, troubleshoot incidents, and comply with legal obligations. 5. Legal basis and customer responsibility Customers are responsible for providing notices, obtaining consents where required, defining retention, responding to employee/user requests, and ensuring that use of MFA, logging, AD/local sync, and monitoring is lawful in their jurisdiction. AZTCO processes customer tenant data to provide and secure the service and to follow authorized customer instructions, except where law or security requires otherwise. 6. Sharing and subprocessors Data may be processed by hosting providers, email providers, push notification providers, payment providers, malware scanning tools, support tools, logging/monitoring providers, and infrastructure security services where needed to operate the platform. Customers may also configure their own SMTP server, syslog collector, SNMPv3 collector, AD/local sync source, or connector host, in which case that customer controls those destinations. 7. International transfers Data may be processed in countries where AZTCO, its infrastructure providers, or customer-configured services operate. Customers must ensure their configuration is suitable for their regulatory requirements. 8. Retention Data is retained for as long as needed to provide the service, maintain security, support auditability, resolve disputes, meet billing and legal obligations, and honor configured retention or deletion workflows. Some data may remain in backups or security logs for a limited period after deletion. 9. Security The platform uses controls such as tenant scoping, role-based access, MFA workflows, audit logging, tokenized enrollment, service keys, connector activation, policy controls, encrypted secret storage where supported, and secure transport. Customers must protect administrator accounts, endpoints, phones, email inboxes, connector hosts, service keys, SMTP credentials, certificates, and log-forwarding destinations. 10. User choices and rights Depending on role and configuration, users may change language, password, trusted device status, MFA delivery preference where allowed, and enrolled device state through tenant workflows. Requests for access, correction, export, deletion, or restriction should be sent to the tenant administrator or [email protected]. AZTCO may need to verify identity and authority before acting. 11. Children and prohibited data The service is intended for business authentication and is not intended for children. Do not submit unnecessary sensitive personal data, payment card data outside approved payment flows, health records, government secrets, or unrelated personal files. 12. Incident handling If we identify a security incident affecting customer data, we will take reasonable steps to investigate, contain, remediate, and notify affected customers as required by law or contract. Customers must also monitor their own connector hosts, Windows servers, endpoints, and administrator activity. 13. Updates We may update this Privacy Policy as the platform changes. The latest version is available in the platform legal pages. 14. Contact Privacy, security, or data protection questions should be sent to [email protected] or the support channel provided in the platform.