Privacy Policy

Who we are

etherRemote AI is a product of ETHERNECO LTD, a company registered in England and Wales under company number 14648043. For the website at remote.etherneco.com and the hosted service we operate there, ETHERNECO LTD is the data controller.

We are not required to appoint a Data Protection Officer. Privacy questions go to the address above and are handled by the company directly.

What this policy covers

This policy applies to:

• the public website at remote.etherneco.com, including the contact form;
• accounts and remote sessions on the hosted service we run at that address;
• the host agent software when it connects to that hosted service;
• enquiries, support conversations and correspondence with us.

It does not cover deployments you host yourself. When you run your own gateway we are not in the data path at all — see Self-hosted deployments. It also does not cover third-party websites we link to, which have their own policies.

Personal data we process

Website visitors

• Technical request data — IP address, user agent, requested URL, timestamps and response codes, recorded in server logs and by our network provider.
• Contact form submissions — the name, email address, optional company name and message you type into the form on the home page.

The site carries no advertising, analytics or third-party tracking. It loads no external fonts, tag managers or scripts, so no profile of you is built as you read it.

Account holders on the hosted service

• Identity — email address, display name, and the role assigned to the account.
• Authentication — a salted password hash (never the password itself), a two-factor secret when you enable TOTP, and, if you sign in with a passkey, the identifier your identity provider gives us.
• Account activity — creation date, last sign-in time, whether the account is disabled, and the invite code used to register.

Machines and sessions

• Machine records — the name you give a machine, its enrolment key hash, when it was last seen online, and which accounts it is shared with.
• Screen thumbnails — a small, periodically refreshed still of a connected machine's screen, shown in your machine list so you can tell your hosts apart. It is stored on the server and visible to you and to accounts you have shared that machine with.
• Session records — who connected, to which machine, from which address, when the session started and ended, and which permissions were granted.
• In-session content — chat messages and any images sent in the session chat, plus metadata about transferred files (names, sizes, timestamps).

Enquiries and support

Whatever you choose to put in an email or a support request, plus the correspondence history. Please do not send us credentials or unnecessary personal data.

Purposes and legal bases

Under the UK GDPR we must have a lawful basis for every use of your data. Ours are:

We do not sell personal data, and we do not use it for automated decision-making that produces legal or similarly significant effects.

Remote sessions

A remote session is the most sensitive thing this product does, so it is worth being precise about it.

• The screen stream and input channel are encrypted between the endpoints — the viewer's browser and the host machine — using WebRTC's DTLS-SRTP. Where the two can reach each other directly, the media never touches our server at all.
• Where a direct path is not possible, media is relayed through a TURN server or the gateway's forwarding unit. Relayed traffic stays encrypted between the endpoints; the relay forwards packets it cannot read.
• We do not record sessions. No video of your screen is written to disk by the hosted service.
• What is stored is the session metadata and in-session content listed above: who connected to what and when, the periodic machine thumbnail, chat messages and file-transfer metadata.
• Whoever is at the host machine stays in control. View, control, clipboard, file transfer and elevation are separate permissions, and the person at the machine can revoke control or end the session at any time.
• A Quick Share link grants access to whoever holds it until it expires or you revoke it. Treat one like a password.

If you use the service to connect to someone else's computer — a colleague's, a customer's — then in respect of what you see and do on that machine you are the controller, and it is your responsibility to have a lawful basis and to tell that person what is happening.

Cookies and local storage

We use a very small number of strictly necessary cookies and browser storage entries, and no advertising or analytics cookies at all. Each one is listed, with its purpose and lifetime, in the Cookie Policy.

Who we share data with

We disclose personal data only where we have to, and only to the categories below. Each provider acts on our instructions under a written contract.

• Hosting and infrastructure — the servers on which the gateway, database and relay run.
• Network and security provider — our content-delivery and DDoS-protection provider sits in front of the site and therefore processes request metadata, including your IP address.
• Email delivery — the provider that carries a contact-form enquiry to our inbox and any messages we send you.
• Identity provider — if you sign in with a passkey through EtherLogin, the sign-in exchange happens with that provider.
• Professional advisers — accountants and, where needed, lawyers, under a duty of confidence.
• Authorities — where we are legally required to disclose, or to establish or defend legal claims.

If the business is ever sold or reorganised, personal data may transfer to the acquirer as part of that transaction; you would be told before it changed how your data is used.

International transfers

We aim to keep data in the United Kingdom or the European Economic Area. Where a provider processes data outside those areas, we rely on UK adequacy regulations or on the International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses), together with any additional safeguards the transfer needs. Write to us if you want details of the safeguards for a specific transfer.

How long we keep data

Where we cannot delete something immediately — because it sits in a backup, for example — we isolate it and delete it when that backup rotates out.

How we protect data

• TLS on every connection, with HSTS and forced HTTPS.
• Passwords stored only as salted hashes; optional TOTP two-factor authentication; passkey sign-in.
• Registration by invite only, and machines must be enrolled with a key and approved before they accept a session.
• Per-IP rate limiting across the API, tightened on sign-in and the contact form.
• An append-only audit record of who connected to what, from where and when.
• Dependencies tracked against published security advisories and updated deliberately.

No system is perfect, and we would rather say so than imply otherwise: parts of the security model — application-level payload encryption and long-term audit storage among them — are still being hardened. If you are assessing us, ask, and we will tell you exactly what is implemented and what is not. If a breach occurs that risks your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours and tell you directly where the risk to you is high.

Your rights

Under the UK GDPR you have the right to:

• be told how your data is used — this document;
• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have data erased where we no longer have grounds to keep it;
• restrict processing while a dispute is resolved;
• receive data you gave us in a portable, machine-readable form;
• object to processing based on our legitimate interests;
• withdraw consent at any time where we relied on consent — which does not affect processing carried out before you withdrew it.

Write to [email protected] and we will respond within one month. There is no charge unless a request is manifestly unfounded or excessive. We may ask you to confirm your identity first.

If you are unhappy with how we handled your data you can complain to the UK supervisory authority — the Information Commissioner's Office, ico.org.uk, helpline 0303 123 1113. We would rather you raised it with us first so we can put it right.

Self-hosted deployments

etherRemote AI is designed to run on your own infrastructure. When you do that:

• You are the controller of every account, machine, session record and thumbnail in your deployment. This policy does not govern it — yours does.
• We have no access to it. Your gateway does not report user data, session content or telemetry back to us.
• Where we help you — support, diagnostics, a screen share of your own console — we act as your processor for whatever you show us, and only on your instructions.
• The host agent checks for software updates against our update service. That request carries the current version and the platform, and reaches us with the requesting IP address; it does not carry user, machine or session data.

Children

The service is built for business use and is not directed at children. We do not knowingly create accounts for anyone under 16. If you believe a child's data has reached us, tell us and we will delete it.

Changes to this policy

We update this policy when the product or the law changes. The version and date at the top always reflect the current text. Where a change materially affects how we use your personal data, we will tell account holders by email or in the application before it takes effect.

How to contact us

For anything in this policy — a question, a rights request, or a security report — write to [email protected], or by post: