Privacy policy

Last updated 1 October 2026

This policy explains what personal data Remotler processes when you use our website, dashboard and remote-access software, why we process it, how long we keep it, who helps us process it, and what rights you have under the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).

1. Our two roles: controller and processor

We are the controller for the data we need to run the service ourselves: your account, sign-in security, billing, and the logs of our website and servers.

We are a processor for your organisation. When an organisation (for example an IT company, or your employer) uses Remotler to manage its computers, that organisation decides which computers are enrolled, who may connect to them and what is recorded. For data about those computers, and about the people who use them, the organisation is the controller and we process the data on its behalf and on its instructions only. If you are a user of such a computer, contact that organisation first. Organisations that need a data processing agreement (Article 28 GDPR) can request one at the address above.

2. What we collect

Your account

• Email address, name, a password stored only as a bcrypt hash, your role, and your organisation and group memberships.
• Invitations you send or receive: the invited email address and who sent the invite.
• Group details your organisation chooses to enter, such as a contact email, phone number or address.
• Organisation branding you upload (name, colour, logo, icon).

Enrolled computers

For each computer enrolled in an organisation, the Remotler agent sends our server:

• the computer's name, a random device identifier, its Remotler ID, app version, the MAC address of its main network adapter (used for Wake-on-LAN) and when it was last online;
• its public IP address while connected (held in server memory, not stored);
• CPU, memory and disk usage every few seconds. Only the latest reading is stored, and a reading of 95% or more creates an alert in the activity log.

When an administrator of the organisation opens the relevant dashboard view, or runs the corresponding tool, the agent also sends on demand:

• installed programs (name, version, publisher, install date) and the operating system version;
• security status: firewall, antivirus and Defender, BitLocker, UAC, Remote Desktop settings, Secure Boot, Windows Update, and the names of local administrator accounts;
• performance details, running processes, Windows Event Log entries, and file and folder listings for folders the organisation monitors;
• the tail of Remotler's own diagnostic log, when support needs it.

On-demand data passes through our server to the administrator's screen and is not kept, with two exceptions: the folders an organisation chooses to monitor, and the results of automated health checks (pass/fail plus a short summary).

Sessions, remote commands and the activity log

• Session records: who connected to which computer, in which mode, and when the session started and ended.
• Activity log: security-relevant events with time, the acting user's email, the target and a short detail. This covers sign-ins (including failed attempts and the email address tried), changes to users, groups and settings, device enrolment and removal, recordings, billing changes, and remote actions.
• Remote shell and commands: when someone opens a remote command line or runs a command on a computer, the log records the shell type, the Windows account it ran as and the first 200 characters of each command. Command output is not stored. Results of background commands are kept in server memory for up to 24 hours so they can be collected.

AI assistants and API access

A signed-in user can connect an AI assistant (for example Claude) or another tool to their organisation through our OAuth sign-in. The assistant can then list computers, view processes and run commands as that user. We store which user approved which application, its permissions and when it was last used. Access tokens are kept only as hashes. Every action the assistant takes is recorded in the activity log under the approving user's name, exactly like an action taken in the dashboard. The AI provider processes what you send it under its own privacy terms. You can revoke the connection at any time from the dashboard.

Session recordings (only if your organisation turns them on)

An operator may record a session in their viewer, and the recording is saved on their own computer. Only if an organisation's administrator turns on cloud recordings is a copy of each finished recording uploaded to our server, so the organisation can play it from its dashboard. We store the video together with who recorded it, which computer, and when. The person at the recorded computer is told on screen that the session is being recorded and stored by that organisation. Recordings are visible only to that organisation's administrators and auditors and to the person who made them.

Payments

For paid plans, payment is handled by Stripe. We receive and store a customer and subscription reference, the subscription status and its renewal date. We never see or store your card details.

Website and servers

Our servers keep ordinary technical logs (IP address, time, request, error messages) for security and troubleshooting.

3. What we do not collect

We do not see or store the contents of a remote session. Screen images, keyboard and mouse input, chat, clipboard contents and transferred files travel directly between the two computers, encrypted with WebRTC (DTLS-SRTP). When a direct connection is not possible, our relay (TURN) server forwards the encrypted packets without being able to read them. The only session content we ever store is a cloud recording that an organisation has explicitly turned on.

We do not sell personal data, do not use it for advertising, do not build marketing profiles, and do not make automated decisions about you that have legal or similarly significant effects. Remotler does not send crash reports or usage analytics anywhere: its diagnostic logs stay on the computer unless an administrator retrieves them.

4. Why we process data, and on what legal basis

• Providing the service (account, devices, connections, dashboard, billing): to perform our contract with you, Article 6(1)(b) GDPR.
• Security (activity log, sign-in protection, server logs, abuse prevention): our legitimate interest, and our customers', in a safe service and in being able to show who accessed which computer, Article 6(1)(f).
• Accounting and tax records for paid plans: our legal obligation, Article 6(1)(c).
• Establishing or defending legal claims, and answering lawful requests from public authorities: Article 6(1)(f) and (c).
• Data about an organisation's computers and users: processed on that organisation's instructions. The organisation, as controller, is responsible for its own legal basis, for example its contract with its client or its legitimate interest in managing its IT.

We do not send marketing email. We email account holders only about the service itself, for example about significant changes to these terms.

5. How long we keep it

• Account, organisation and device records: for as long as the account or device is active. They are deleted when an organisation removes a user or a device, or when the account is closed.
• Activity log and session records: kept in a log of limited size. The oldest entries are removed automatically as new ones arrive, and all of an organisation's entries are deleted when the account is closed.
• Cloud recordings: for the number of days the organisation chose (1 to 365, 30 by default), or less if deleted earlier in the dashboard.
• Sign-in and access tokens: dashboard sessions 30 days; AI-assistant access 1 hour, renewable for up to 30 days until revoked; enrolment tokens 90 days; API tokens 1 year.
• Billing and invoice records: for the period Polish tax law requires, generally 5 years from the end of the tax year.
• Server technical logs: rotated automatically and kept only as long as they are useful for security and troubleshooting.

6. Who else is involved

We use these service providers. Each processes data only on our behalf or for the narrow purpose described here:

• DigitalOcean: hosts our servers and stores the data above, Amsterdam region (EU).
• Stripe: payment processing for paid plans. It receives your organisation reference, plan and billing email.
• Google: our website loads fonts from Google Fonts, and the software uses Google's public STUN service to discover each computer's public network address when a connection starts. Both mean Google receives the IP address of the browser or computer concerned. No session content is sent to Google.
• GitHub: hosts our source code and release information. Your personal data is not sent there.

We do not share personal data with anyone else, except when the law requires it, or with an organisation about its own computers and users. Organisation data is visible only to that organisation's members, according to the roles and groups it has set up.

7. Transfers outside the European Economic Area

We store data in the European Union. Stripe and Google are based in, or may process data in, the United States. Those transfers rely on the EU–US Data Privacy Framework, under which both companies are certified, and on the European Commission's standard contractual clauses.

8. How we protect it

• All traffic to our servers uses HTTPS/TLS. Remote sessions are encrypted end to end with WebRTC.
• Passwords are stored as bcrypt hashes, and API and access tokens as hashes only.
• The database is readable only by the service account, on a server only we administer.
• Access to an organisation's computers depends on that organisation's roles and groups, and the remote actions that matter are written to its activity log.
• On enrolled computers, the agent runs as a Windows service. Connecting requires the organisation's authorisation or the computer's session password, and anyone at the computer is shown when a session is active or being recorded.

9. Your rights

Under the GDPR you have the right to:

• access your data and receive a copy (Article 15);
• correct inaccurate data (Article 16);
• have it erased, the "right to be forgotten" (Article 17);
• restrict its processing (Article 18);
• receive it in a portable format (Article 20);
• object to processing based on our legitimate interest (Article 21); we will stop unless we have compelling legitimate grounds, or need the data for a legal claim;
• withdraw consent at any time, where we rely on it, without affecting earlier processing.

Write to kontakt@senditnow.online. We may ask you to confirm your identity, and we will reply within one month. If your request concerns data an organisation controls (a computer it manages, or a recording it made), we will pass it to that organisation and help it respond.

You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl, or with the authority in the EU country where you live or work.

10. Cookies and local storage

We set one cookie, ftd_session, which keeps you signed in. It is strictly necessary, HttpOnly, secure, limited to our site, and expires after 30 days or when you sign out. The dashboard also saves two preferences in your browser's local storage (light or dark theme, and the video codec choice in the browser viewer). We use no analytics or advertising cookies, so we do not need a cookie consent banner.

11. Children

Remotler is a tool for businesses and IT administrators and is not meant for children. You must be at least 16 to create an account. If you believe a child has given us personal data, contact us and we will delete it.

12. Other websites

This policy covers remotler.com and the Remotler software. Websites we link to, and AI assistants or other tools you connect, have their own privacy policies.

13. Changes

If we change this policy we will update the date at the top. For significant changes we will also tell account holders by email before they take effect.

See also our Terms of service and the End-user licence agreement.