1. Introduction
This Privacy Policy explains how SSO System ("we", "us") collects, uses, and protects your information when you use our identity and access management service.
2. Information We Collect
- Account information: name, email address, and optionally a phone/WhatsApp number, provided when you register or update your profile.
- Company/organization information: the company you create or request to join, and your role within it.
- Authentication data: your password (stored using one-way hashing), two-factor authentication settings, and temporary access codes.
- Session and device information: IP address, browser/device type, login timestamps, and active session records, used for account security.
- Third-party sign-in data: if you sign in via Google or Microsoft, we receive your name, email address, and profile identifier from that provider.
3. How We Use Your Information
- To create and secure your account, and authenticate you across connected subsystems;
- To operate features such as login, password reset, two-factor authentication, and session management;
- To communicate important account and security notices, such as verification codes and login alerts;
- To administer company/organization membership and access approvals;
- To maintain the security, integrity, and reliability of the Service.
4. Cookies
We use cookies and similar technologies that are necessary for authentication and to keep you signed in. See our Cookie Policy for details.
5. Sharing of Information
We do not sell your personal information. We may share information with:
- Your organization's administrators, for account and access management purposes;
- Connected subsystems you choose to access, to the extent necessary for single sign-on;
- Service providers who help us operate the Service (e.g. email/SMS delivery), under confidentiality obligations;
- Authorities, where required to comply with applicable law.
6. Data Security
We apply reasonable technical and organizational measures to protect your information, including password hashing, encrypted transport (HTTPS), and session/device monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
7. Data Retention
We retain account information for as long as your account remains active, and for a reasonable period afterward as needed to comply with legal obligations, resolve disputes, and enforce our agreements.
8. Your Rights
You may access and update most of your account information from your profile page at any time. You may also request deletion of your account by contacting your system administrator, subject to any retention obligations we may have.
9. Children's Privacy
The Service is not directed to individuals under the age of 16, and we do not knowingly collect personal information from children.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.
11. Contact
If you have questions about this Privacy Policy, please contact your system administrator.