IT Asset Management Privacy Notice

Other JagaSec services have separate notices. Network Live Monitor and the public website do not handle data in the same way as this cloud product.

1. Who is responsible

JagaSec Technologies operates a multi-tenant IT asset management platform. The customer organization decides why and how information entered into its workspace is used. For that customer content, JagaSec processes data on the organization's behalf. JagaSec is responsible for account, security and direct communication data used for our own operations.

2. Information the application handles

• Account and organization data: name, work email, organization name, assigned role, account status and a securely hashed password. We do not store passwords in readable form.
• Workspace content: employee records, hardware and software assets, assignments and returns, vendors, services and AMC records, procurement records, costs, company profile and notes entered by authorized users.
• Documents: invoice or bill images and PDF files an authorized user chooses to upload.
• Security and activity data: session identifiers, IP address, browser or user-agent information, login events and records of important workspace actions.
• Support data: information an administrator or user chooses to include when asking for help.

Google and Microsoft sign-in controls are marked as coming soon. Until an integration is enabled, those controls do not send sign-in information to Google or Microsoft.

3. Why we use it

• Create and operate the organization workspace.
• Authenticate users, enforce roles and protect accounts.
• Provide asset, employee, vendor, procurement, document, audit and export functions.
• Send essential verification, password-reset and service messages.
• Diagnose faults, prevent abuse, provide support and meet legal obligations.

Where applicable law requires a legal basis, it may include performance of a contract, legitimate interests in operating and securing the service, compliance with legal obligations, or consent where specifically requested.

4. Cookies and browser storage

The application uses strictly necessary session and CSRF-protection cookies to keep a user signed in and protect account actions. Browser storage may remember interface preferences such as theme. Blocking necessary storage can prevent sign-in or application features from working. We do not use third-party advertising cookies.

5. Service providers and transfers

The application currently uses Cloudflare for web delivery and protection, Render for API hosting, Neon for managed PostgreSQL storage, and Resend for transactional email. These providers process relevant information to perform their services under their own terms and privacy commitments. Their current notices are available from Cloudflare, Render, Neon, and Resend.

Data may be processed in countries other than the user's own. Where applicable law requires transfer safeguards, we use the safeguards available through our contracts and providers.

6. Disclosure

We do not sell or rent workspace data, and we do not share one customer's workspace with another customer. Information may be disclosed to the service providers above, when required by law, to protect people or the service, or during a business transaction subject to appropriate confidentiality protections.

7. Retention and deletion

Account and workspace content is retained while the organization is active and as needed to deliver the service. Administrators can export organization data and can request account or organization deletion. After deletion, limited information may remain temporarily in backups, security records, dispute records or information we must retain by law before it is removed or anonymized.

8. Your controls and rights

Authorized users can correct workspace information, and administrators can export organization data. Subject to applicable law, a person may also ask to access, correct, export or delete personal information, or object to or restrict certain processing. If an employer or another customer supplied the information, contact that organization first; we will support it in responding.

9. Security

Controls include TLS in transit, server-enforced role access, logical organization isolation, protected credentials and tokens, validated document uploads and tamper-evident activity records. No online service can guarantee absolute security. Report a suspected issue to [email protected] and read the Security page.

10. Changes

We may update this notice when the application or legal requirements change. The date above will identify the current version, and we will provide additional notice where required for a material change.

11. Contact

Email [email protected] for privacy requests. For product help, visit the Support Center.