Privacy Policy

1. Who this policy applies to

• Website visitors — people who browse our marketing site or submit a demo or early-access request.
• Authorized users — employees and contractors of a customer organization who sign in to a Tenant workspace (admin, manager, or employee portal).
• Discovery participants — individuals who respond to asset verification campaigns via secure links without a full account.

When a customer organization uses the Service, that organization is generally the controller of employee and asset data processed in its Tenant. We process that data as a service provider on the customer's instructions.

2. Information we collect

Information you provide

• Contact details (name, work email, company name, phone) from forms and support requests;
• Account credentials and profile information for authorized users;
• Customer Data your organization enters or uploads (assets, licenses, employees, files, etc.);
• Communications with us (email, support tickets, feedback).

Information collected automatically

• Device and browser type, IP address, general location derived from IP;
• Log data (pages viewed, timestamps, referring URL, errors);
• Session and authentication tokens necessary to operate the Service;
• Usage events within the product to maintain security and improve features.

Information from integrations

If your administrator connects directory, identity, or device sources (e.g., Microsoft Entra ID, Google Workspace, Intune), we receive data those APIs expose according to the permissions granted, such as names, email addresses, group membership, and device identifiers.

3. How we use information

We use information to:

• Provide, secure, and maintain the Service;
• Authenticate users and enforce tenant isolation and role-based access;
• Process demo and early-access requests and communicate with prospects;
• Operate optional AI features you enable (e.g., copilot, analytics, invoice analysis);
• Send service-related notices, security alerts, and administrative messages;
• Comply with law, respond to lawful requests, and protect rights and safety;
• Analyze aggregated or de-identified usage to improve reliability and product design.

We do not sell personal information.

4. Legal bases (EEA/UK visitors)

Where GDPR or UK GDPR applies, we rely on: performance of a contract (providing the Service); legitimate interests (security, product improvement, B2B marketing to business contacts); consent where required (e.g., certain cookies or marketing); and legal obligation where applicable.

5. How we share information

We may share information with:

• Infrastructure and subprocessors — hosting, database, authentication, email delivery, and monitoring providers that process data on our behalf under contractual safeguards;
• Integration partners — when your administrator connects third-party services;
• AI providers — when optional AI features are enabled for your Tenant, subject to configuration and data minimization practices;
• Professional advisors — lawyers, accountants, or auditors under confidentiality;
• Business transfers — in connection with a merger, acquisition, or asset sale, with notice where required;
• Authorities — when required by law or to protect the Service and users.

A current list of subprocessors may be provided on request to customers under a data processing agreement.

6. International transfers

We may process information in the United States and other countries where we or our subprocessors operate. Where required, we use appropriate safeguards such as Standard Contractual Clauses for transfers from the EEA/UK.

7. Retention

We retain information for as long as needed to provide the Service, meet legal obligations, resolve disputes, and enforce agreements. Customer Data is retained according to your organization's subscription and deletion requests. Backup copies may persist for a limited period after deletion.

8. Security

We use encryption in transit, access controls, tenant-scoped data access, and industry-standard cloud security practices. No system is perfectly secure; please report suspected incidents to contact@360.technology.

9. Your rights and choices

Depending on your location, you may have rights to access, correct, delete, restrict, or port personal information, and to object to certain processing. Authorized users should contact their organization's administrator for Tenant data requests. Website visitors and prospects may contact us at contact@360.technology.

California residents may have additional rights under the CCPA/CPRA. We do not sell personal information and do not use sensitive personal information for purposes requiring an opt-out under CPRA.

10. Cookies and similar technologies

We use essential cookies and local storage for authentication and session management. We may use analytics cookies to understand how the marketing site is used. You can control non-essential cookies through your browser settings where applicable.

11. Children

The Service is intended for business use and is not directed to children under 16. We do not knowingly collect personal information from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the "Last updated" date. Material changes may be communicated by email or in-app notice where appropriate.

13. Contact

Privacy questions or requests: contact@360.technology.

See also our Terms of Service.