Privacy Policy

Effective: 2 November 2026

Last updated: 2 November 2026

Version: 1.1

1. Introduction and scope

Sysplore LLC ("Sysplore", "we", "us" or "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, transfer and retain personal data when you visit our website, contact us, or use the Products and Sysplore Cloud, and it states your rights in relation to that data and how to exercise them.

This Privacy Policy is to be read together with our Terms of Service, our Acceptable Use Policy and our Cookie Policy. Where we process personal data on your behalf as a processor, the terms of the Data Processing Agreement that applies between us prevail over this Privacy Policy to the extent of any conflict.

2. Definitions

In this Privacy Policy:

• "Products" means Sysplore Mail and Sysplore Workspace.
• "Sysplore Cloud" means the hosting platform operated at sysplore.cloud.
• "Services" means, collectively, the Products and Sysplore Cloud.
• "Professional Services" means Managed Hosting, Infrastructure Management, Security and Compliance, Digital Transformation, AI Engineering and Consultation, supplied under a signed contract or statement of work.
• "personal data" means information relating to an identified or identifiable natural person.
• "processing" has the meaning given to it in the General Data Protection Regulation (EU) 2016/679 (the "GDPR"), and "controller", "processor" and "supervisory authority" are to be read accordingly.

3. Our role

We are a limited liability company registered in the State of Wyoming, United States. When you sign up for a Product or buy one, you choose the region where your data is stored: the European Union or the United States. Your Content and the account data associated with it are stored and processed in the region you choose. We apply the safeguards described in section 9 where personal data reaches us from outside that region.

Where the GDPR or the United Kingdom GDPR applies, we act as a controller in respect of the personal data described in section 4, and as a processor in respect of the content you store in the Products, as described in section 6. Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the "CCPA"), applies, we act as a business in respect of that same data. We process personal data in accordance with the GDPR and the CCPA where they apply to you. We enter into a Business Associate Agreement before we receive any Protected Health Information, as the Health Insurance Portability and Accountability Act ("HIPAA") requires.

4. Personal data we collect and the legal bases

We collect as little personal data as possible. We do not sell personal data, we do not share it for the marketing of any third party, and we do not track you across websites.

4.1 Data you provide to us

When you submit a form on our website, request a consultation, or correspond with us, we collect your name, email address, telephone number, company name and the content of your message. We process this data to respond to your enquiry and, where a contract follows, to perform it. The legal basis is your consent and, where relevant, the performance of a contract.

4.2 Data we receive from a third party identity provider

You may create or access an account using a third party identity provider, such as Google, Microsoft, Apple, GitHub or Facebook, or, for a business account, your own identity provider using the OpenID Connect protocol. When you do, we receive from that provider only the information we need to create and identify the account, which is typically a provider account identifier, the email address and the display name. We process this data to create and secure your account and to authenticate you. The legal basis is the performance of a contract and our legitimate interest in operating account access securely.

4.3 Data we collect automatically

When you visit our website, our servers record the technical information needed to answer your request and to keep the site available and secure. Our web server records the requested page, the time of the request, the browser and device type, and the originating IP address. We store the IP address only as a keyed cryptographic hash, so that we can apply rate limits and detect abuse without retaining the raw address. The legal basis is our legitimate interest in operating the website and protecting it from abuse.

4.4 Payment and billing data

How payment data is held depends on which entity is the seller for a purchase.

Where a Merchant of Record is the seller, the transaction data for that purchase is held by that entity as the controller. It collects and remits the applicable tax and administers refunds and payment disputes under its own privacy policy.

Where we are the seller, we and our Payment Service Provider hold the data needed to take payment, to invoice you and to keep billing records. Our Payment Service Provider processes the payment instrument as our processor.

In neither case do we store full payment card details. Card data is provided directly to the payment provider and is not stored on our systems.

4.5 Fraud prevention, disputes and abuse

We process account, transaction, connection and log data to prevent fraud, to handle a chargeback or a payment dispute, to recover an unpaid amount, and to detect, investigate and prevent abuse, spam, malware and any breach of the Acceptable Use Policy. The legal basis is our legitimate interest in preventing fraud and abuse and in protecting the Services and their users, and our legal obligation where the law requires us to keep a record.

4.6 Data we do not collect

We do not use advertising or tracking cookies. We do not use fingerprinting, session recording or heatmapping. We do not collect personal data about the visitors to any website you operate. We do not sell or rent personal data. We do not track visitors across third-party websites, so a Do Not Track signal makes no difference to our practices: there is no cross-site tracking for it to stop.

5. Purposes, legal bases and retention at a glance

The table below states, for each purpose for which we process personal data in connection with the Services, the legal basis on which we rely and the period for which we retain the data. The sections that follow give the detail.

Purpose	Legal basis	Retention
Providing a Product or Sysplore Cloud, including storing, transmitting, processing and displaying your Content	Performance of a contract; your documented instructions where we act as processor	While the account is open, and for 30 days after a cancellation or a refund
Creating and securing your account, including sign in through a third party identity provider	Performance of a contract; legitimate interest in secure access	While the account is open
Measuring usage and billing for it	Performance of a contract; legitimate interest in operating the Services	Billing, tax and dispute records kept for the period tax law requires
Detecting, investigating and preventing abuse, spam, malware and breach of the Acceptable Use Policy	Legitimate interest in protecting the Services and their users	Operational security records kept only as long as needed for that purpose
Operating the spam and phishing filter, including the statistical classifier and the AI review	Performance of a contract; legitimate interest in protecting the Services and their users	Message data is processed at delivery; classifier training data is kept only while the filter needs it
Protecting the Service and its users	Legitimate interest in keeping the Services available and secure	Operational security records kept only as long as needed for that purpose
Preventing fraud and handling a dispute or a chargeback	Legitimate interest in preventing fraud and recovering debt; legal obligation	Dispute evidence kept for the length of the dispute plus the period the card network rules require
Taking payment, issuing receipts and keeping billing records	Performance of a contract; legal obligation to keep tax records	Billing and tax records kept for the period tax law requires
Complying with law	Legal obligation	The period the applicable law requires
Responding to an enquiry sent through a form	Consent; performance of a contract	Two years from receipt, or until you request deletion

6. Content you store in the Products

When you use a Product, the mail, files, calendar entries and other content you store there remain yours. We process that content only to provide the service: to transmit, deliver and store your mail, to synchronize your files, to operate the features you choose to use, including the spam and phishing filter, and to keep the service secure. In respect of that content you act as the controller and we act as the processor, and we process it on your documented instructions. Where a Data Processing Agreement is required, we enter into one before the relevant processing begins.

We process Content to operate the spam and phishing filter. The filter scores each message at delivery using a statistical classifier that learns from spam and ham marks, public blocklists, the result of DMARC, SPF, DKIM and ARC checks, phishing heuristics and sender reputation. A message that remains inconclusive may be sent to an AI classifier. An account that turns on encryption at rest can opt out of classifier training, and the filter then scores its messages without using their text. We do not use Content for advertising, for profiling, or to train a general-purpose model, and we do not disclose it except as set out in section 7 or on your instructions.

7. Disclosure of personal data

We disclose personal data only in the following circumstances:

• to the subprocessors listed on the Subprocessors page, and to no others without first updating this Privacy Policy;
• to a professional adviser, auditor or insurer where necessary and under an obligation of confidentiality;
• where required by law, regulation, court order or a lawful request from a competent authority;
• to protect the rights, property or safety of Sysplore, our customers or the public;
• in connection with a merger, acquisition or sale of substantially all of our assets, on the basis of this Privacy Policy.

Where we are permitted to do so, we notify you before disclosing personal data in response to a legal request.

8. Subprocessors

We engage a limited number of subprocessors to deliver the Services. Each subprocessor is bound by a written data processing agreement, processes personal data only on our documented instructions, and does not use it for its own purposes. The subprocessors we engage, together with the purpose of each, the categories of personal data processed and the location of processing, are listed on the Subprocessors page. That page forms part of this Privacy Policy and is updated before a new subprocessor begins processing personal data.

We give account holders at least 30 days notice before we add or replace a subprocessor that handles their personal data. An account holder may object on reasonable data protection grounds as described in the Data Processing Agreement.

We do not retain full payment card details. Card data is provided directly to the payment provider and is not stored on our systems.

9. International transfers

You choose the region where your data is stored when you sign up: the European Union or the United States. Data in the European Union region is stored and processed in the European Union, and data in the United States region is stored and processed in the United States, as described in section 3.

Sysplore is established in the United States. Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to the United States region, or where our support or a subprocessor accesses data in the European Union region from outside it, we rely on the Standard Contractual Clauses approved by the European Commission, together with the transfer safeguards described in section 8, to protect that data. You may request a copy of the relevant safeguards at [email protected].

10. Your rights

Subject to the conditions and exceptions in applicable law, you have the right to:

• be informed about the processing of your personal data;
• access the personal data we hold about you;
• have inaccurate personal data rectified;
• have personal data erased;
• restrict or object to the processing of your personal data;
• receive your personal data in a structured, commonly used, machine readable format, and to have it transmitted to another controller;
• withdraw consent at any time where the processing is based on consent;
• lodge a complaint with your local supervisory authority.

California residents also have the right to know the categories of personal data collected, to request deletion, and to exercise the rights above without discriminatory treatment. We do not sell or share personal data as those terms are defined by the CCPA.

To exercise any of these rights, contact us at [email protected]. We respond to requests within 30 days, or within 45 days where the CCPA applies. We may need to verify your identity before we act on a request.

11. Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, or as required by law. In particular:

• Enquiries and form submissions. Retained for two years from the date of receipt, or until you request deletion.
• Website records. The hashed IP address and related request data are retained for a limited operational period for security and rate limiting, and are not retained longer than necessary for that purpose.
• Content stored in a Product. Retained while your account is open, and for 30 days after a cancellation or a refund, during which the account can be read and exported, after which it is deleted.
• Deleted mail. Mail you delete yourself is recoverable for 30 days and is then deleted.
• A closed Sysplore Cloud account. All content and configuration on the account is deleted immediately on closure, and access to the account ends.
• Billing and tax records. Retained for the period required by applicable tax law.
• Dispute evidence. Records kept to respond to a chargeback or a payment dispute are retained for the length of the dispute and for the additional period required by the card network rules.

Where a signed contract provides otherwise, the retention terms of that contract apply to the Professional Services concerned.

12. Security

We implement appropriate technical and organizational measures to protect personal data. In transit, we use TLS, and for mail between servers we use DANE, MTA-STS and TLS reporting. At rest, each mail account can turn on encryption with an OpenPGP key or an S/MIME certificate that the account holder registers. The private key stays with the account holder and is never held on our systems, so we cannot read the messages it protects. Encryption at rest covers the message body and attachments. The message headers stay readable so a mail client can list and sort mail, and search on an encrypted account covers the headers, not the body or attachments. Spam filtering and Sieve rules run before a message is encrypted.

We also apply access controls and authentication, automatic banning of brute-force and probing sources, network filtering, logging, regular security review and an incident response procedure. Backups are encrypted at rest and stored in the region you choose. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a personal data breach that affects you, we notify you and any competent authority where the law requires it.

13. Cookies

We set one cookie of our own, and our support chat keeps a session of its own. The Cookie Policy lists every cookie we set, what each is for, and how to control cookies in your browser.

14. Children

The Products, Sysplore Cloud and our website are intended for persons aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected such data, we delete it.

15. Changes to this Privacy Policy

We may amend this Privacy Policy. We publish the amended version on this page with a revised "Last updated" date and a new version identifier, and where a change is material we give customers of the Products at least 30 days notice by email before it takes effect. The version in force at the time you use the Services governs that use.

16. Contact

For privacy requests, questions about this Privacy Policy, or to exercise any of the rights in section 10:

Email: [email protected]

Post: Sysplore LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States

For legal notices, including notices under the Acceptable Use Policy: [email protected].