Privacy policy

1. Controller

POINT OF BUSINESS SOFTWARE S.R.L., a company registered in Romania, trade register number J28/832/2016, CUI 36849440, with its registered office at Str. Carol I nr. 19F, ap. 2, Slatina, Olt county, Romania, trading as Conexa, is the controller for the personal data described here, except where stated otherwise in section 4. Contact: security@conexa.software.

2. What we process and why

• Technician accounts: name, email address, password hash, role. Purpose: sign-in and attribution of sessions. Legal basis: performance of the contract with your organisation.
• Device records: a random device identifier generated by the Customer application, the operating system, the application version, and the time the device was last online. Purpose: resolving the 9-digit address and showing version compatibility. Legal basis: legitimate interest in operating the Service. The identifier is not linked to a named person by us.
• Session metadata: which Technician connected to which device identifier, start and end time, and whether the session was accepted, refused or timed out. Purpose: audit and security. Legal basis: legitimate interest of your organisation and its customers in accountable remote access.
• Connection logs: IP address and timestamp of connections to our signalling server, kept briefly for abuse prevention and rate limiting. Legal basis: legitimate interest in security.
• Contacts and groups: labels you assign to device addresses. Stored in your console. You control them.
• Emails you send us: processed to answer you.
• Your account on this website: your email address and when the account was created and last used, one-time sign-in codes (stored only as a one-way hash), the time and IP address of each code request, and a session record while you are signed in. Purpose: letting you sign in without a password and see your plan, payments, invoices and devices. Legal basis: performance of the contract (our terms, which you accept when you create the account).
• Activated devices: when you activate the app with a code sent to your email, we store the computer's name and platform, a device key (stored only as a one-way hash) and when it was last used. Purpose: confirming that the licence is used by devices you activated, and letting you remove them. Legal basis: performance of the contract.

3. What we do not process

Screen content, camera image and audio, keystrokes, mouse movements, transferred files, clipboard content and chat messages are exchanged directly between the two endpoints using end-to-end encrypted WebRTC channels. When a direct path is not available, the traffic passes through our TURN relay in encrypted form; the relay cannot read it and does not store it. We do not record sessions, and we never receive the camera image or the chat. Turning the camera on is a decision taken in the session by the person whose camera it is; it can be reversed at any moment without ending the session. The client applications contain no third-party analytics or trackers. The website uses Google Analytics 4 (GA4) with IP anonymisation enabled to understand aggregate performance and interactions.

4. Your organisation as controller

When a Technician accesses a Customer's device, the Technician's organisation determines what is done with what they see. For that access, the organisation is the controller and we are not involved in the processing. For session metadata about that organisation's Technicians and their customers' devices, we act as processor on the organisation's instructions; a data processing agreement is available on request.

4a. Sales chat on this website

This website has a chat window where you can ask about Conexa Remote. The replies come from an AI assistant. We say so in the first message, before you type anything. A person from our team takes over when you ask for one, or when your question goes beyond what the assistant may answer.

What we process: the messages you type, the language and the site you write from, the time of each message, and a random conversation identifier. The chat sets no cookies. Your IP address is used only momentarily, to limit abuse, and is not stored. We do not keep your browser type or device details.

Where: on our own servers in Romania, not with a third-party chat provider.

How long: 12 months from the last message in the conversation, then deleted automatically. If a colleague takes over and the conversation becomes a sales enquiry, the details you give us (name, company, contact details) are kept as described for email correspondence in section 5.

Legal basis: our legitimate interest in answering a question you put to us (Art. 6(1)(f) GDPR). We ask for your consent before contacting you by email or phone, and we send no unsolicited commercial messages based on what you wrote.

Deletion: write to security@conexa.software with the approximate date of the conversation. We delete it and confirm by email within the period the GDPR allows (at most one month).

Not the chat inside a session: the chat between a Technician and a Customer during a remote support session is exchanged directly between the two endpoints and is never stored on our servers (section 3). The rules above apply only to the sales chat window on this website.

5. Retention

• Technician accounts: until deleted by an administrator or on termination of the contract, plus 30 days.
• Device records: until the record is purged at your request or after 12 months without the device coming online.
• Session metadata: 90 days or 12 months according to plan; exportable at any time.
• Connection logs: 30 days.
• Email correspondence: as long as needed to handle the matter, then per legal retention obligations.
• Website sales chat: 12 months from the last message in the conversation.
• Your account: until you delete it from the account page, or ask us to. An account with an active subscription is closed together with the subscription; invoices are kept for the period the law requires.
• Account sign-in codes: they stop working after 10 minutes and are deleted after 30 days. Account sessions: 7 days, deleted 30 days after they expire, or immediately when you sign out.
• Activated devices: while the device stays in your account; deleted 30 days after you remove it.

6. Where data is stored

All infrastructure for the Service, including the database and the TURN relay, is hosted in Romania on servers operated on our behalf. Session data, account data and device records do not leave Romania. The only exception is card payment: it is handled by Stripe Payments Europe Ltd in Ireland, which may transfer billing data to its parent company in the United States under the standard contractual clauses approved by the European Commission. Self-hosted deployments store all data on the customer's own infrastructure.

7. Sub-processors

• ROMARG SRL (Romania): this website and our email. Processes what you send us by email and the connection logs of this site.
• EXIM HOST SRL, trading as SiteBunker (Romania): the servers that run the signalling service, the TURN relay and the database. Processes account data, device records and session metadata.
• Stripe Payments Europe Ltd (Ireland): card payments only. Receives the billing details you enter at checkout and the amount. We never see or store your card number.
• Google Ireland Limited (Ireland): website analytics (Google Analytics 4). Measures aggregated site visits and interactions with IP anonymisation enabled.

We use no advertising or behavioural profiling sub-processors. Self-hosted applications load no external scripts.

8. Security

Transport encryption (TLS 1.2+, DTLS-SRTP), bcrypt password hashing, short-lived tokens, rate limiting, strict origin checks and least-privilege access to production systems. See the security overview.

9. Your rights

Under the GDPR you may request access to, rectification or erasure of your personal data, restriction of or objection to processing, and portability, and you may lodge a complaint with the Romanian supervisory authority (ANSPDCP) or your local authority. Write to security@conexa.software. If your data is held because your employer uses the Service, we may refer your request to them as controller.

10. Cookies and local storage

This website uses Google Analytics cookies (_ga) for aggregate traffic measurement with IP anonymisation enabled. It writes four items to your browser's own storage:

• Partner code (conexa_partner_ref): written when you reach the order page through a partner link or QR code, or when you type a partner code there yourself. It holds that code, whether it arrived by link, by QR code or was typed, and the date it was stored. Its purpose is to credit the right partner if you place an order, and it is sent to our ordering system with that order. It is kept for 30 days from the date it was stored, then ignored and deleted. It is removed sooner if you clear the partner code field at checkout, or clear this site's data in your browser.
• Contact form draft (conexaremote_contact_draft): written to your browser's session storage while you type on the contact page, so that what you wrote survives a page refresh. It holds what you entered in the form: the subject, your name, email address, phone number, company, country, the technical details you add, and your message. It is not sent anywhere by this mechanism. It is deleted when your message is sent successfully, and in any case when you close the tab.
• Account sign-in (conexaRemoteAccount): written to your browser's local storage when you sign in to your account on this website. It holds a random session key, which is sent to our servers to show your account. It is removed when you press "Sign out"; the session also stops working after 7 days.
• Sales chat (cx_chat_fir, cx_chat_cursor, cx_chat_log): written when you send your first message in the chat window. They hold the conversation identifier, the position of the last reply you received, and a copy of the messages shown, so that the conversation survives a page reload. Only the identifier is sent to our chat service, with each message. They are removed when you press "Stop the conversation", or when you reopen the chat after the conversation has been deleted on our side; you can also clear them by clearing this site's data in your browser.

11. Changes

We will post updates to this page and, for material changes, notify account holders by email.