Legal
Privacy Policy
Remote Login is a business tool. Most of what it handles is not our data — it belongs to the IT provider or company using it, and we hold it on their behalf. We do not sell personal information, we do not use session content for advertising, and we do not train models on it. The portal records remote-access requests in an audit trail. Consent prompts follow the organization’s enforced policy; unattended access requires prior authorization.
1Who we are
Remote Login is operated by Houston IT Developers LLC, a Texas limited liability company based in Houston, Texas, United States ("we", "us"). This policy explains how we handle personal information in connection with the Remote Login platform — the web application, technician console, device agents and installers, mobile applications, session relay and APIs (the "Service") — and this website.
This policy sits alongside our Terms of Service and Acceptable Use Policy.
2Controller and processor — which one we are matters
Remote Login is sold to businesses. There are two different relationships in play, and your rights run differently in each:
| Situation | Our role | Who to ask about your data |
|---|---|---|
| You are a customer — an MSP or IT team with an account | Controller of your account and billing data | Us, directly |
| Your device is supported by a provider using Remote Login | Processor acting for that provider | That provider, in the first instance |
| You visit this marketing website | Controller | Us, directly |
Where we act as a processor, we handle Customer Data only on the customer's documented instructions, and we will forward any request we receive to them rather than acting on it unilaterally. We will always help; we will not go around the account owner.
3What we collect
Account and contact data
Name, business email, phone number where given, company name, role, password hashes and multi-factor enrollment data, and the support correspondence you send us.
Billing data
Plan, seat counts, payment-provider customer and subscription references, and subscription status. When billing is enabled, our payment processor handles card details. Remote Login does not store full card numbers, security codes, card brand, last-four digits or expiry dates in its application database.
Device and session metadata
Data the agent reports about administered devices includes hostname, operating system and version, hardware inventory, network addresses, agent version and connection state. The portal records the user, organization, device, connection type, and issuance, expiry and revocation of access links. These records do not establish the complete duration of every remote connection.
Technician activity and audit logs
Audited sign-in and administrative actions, connection requests, applicable consent policy, access-link changes, and credential-vault operations. The activity history does not provide a complete record of every screen action, file transfer or consent response on the remote device.
Credential vault
Authorized administrators may store machine and service credentials in the credential vault. Stored secrets are encrypted. Revealing a secret requires an authorized account and a fresh authenticator-code submission, and the reveal is audited. The vault is not intended to hold end users’ personal passwords.
Technical logs
IP address, user agent, request paths, timestamps and error traces from the web application and relay, retained for security, abuse prevention and debugging.
Website data
Standard server logs and Google Analytics 4 measurements of page views and successful access requests. We do not send the name, email address, company or message you enter in the contact form to analytics. This site does not carry advertising trackers.
4What a remote session captures — and what it does not
This is the part people actually want answered, so we will be specific.
During a remote session, screen contents, keyboard and mouse input and transferred files may pass through our relay so the technician can work on the device. Whatever is visible on that screen may be visible to the technician. Session traffic is encrypted in transit. The portal activity history is not a video recording. The standard portal does not offer a managed video-recording or recording-retention workflow; discuss any separate recording requirement with the operator before relying on one.
Consent follows the organization’s enforced policy. The default asks for approval when someone is signed in. Unattended access requires prior authority from the account owner. Prompt and notification behavior depends on the platform, installed agent and permissions, and should be checked on the actual devices during onboarding. Remote Login must not be used for covert monitoring. Our Acceptable Use Policy prohibits unauthorized access and stalkerware.
5Why we use it
- To provide the Service — authenticate users, route sessions, deploy agents, show device inventory.
- To secure it — detect intrusion, credential stuffing, abuse and fraud, and to investigate incidents.
- To support you — answer tickets, reproduce faults, and tell you when something is broken.
- To bill you — invoicing, seat reconciliation, tax and accounting records.
- To improve it — aggregate, de-identified usage measurement showing which features are used and where the product fails. This never uses session content.
- To meet legal obligations — tax records, lawful requests, and enforcing our agreements.
6Legal bases (EEA and UK)
Where the GDPR or UK GDPR applies and we act as controller, we rely on: contract (providing the Service you signed up for); legitimate interests (security, abuse prevention, product measurement, direct B2B communication about the Service) balanced against your rights; legal obligation (tax, accounting, lawful requests); and consent where we ask for it, which you may withdraw at any time without affecting prior processing.
7Who we share it with
We share personal information only with the following, and only as needed:
| Category | Purpose |
|---|---|
| Hosting and infrastructure | Running the application, database and session relay in our hosting provider's European and US data centers |
| Network and security | DNS, TLS, DDoS protection and WAF in front of our services |
| Payment processing | Taking payment and issuing invoices |
| Email and support tooling | Transactional mail, sign-in codes and support correspondence |
| Error and uptime monitoring | Diagnosing failures and detecting outages |
| Professional advisers | Accountants and lawyers, under duty of confidence |
Each is bound by a written agreement limiting them to our instructions. We will also disclose information where legally compelled — and where we are permitted to tell you, we will. If we are ever party to a merger, acquisition or asset sale, information may transfer to the successor under this policy; we will give notice before it becomes subject to a materially different one. A current list of subprocessors is available from [email protected] on request.
8What we never do
We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under US state privacy law. We do not use Customer Data or session content to train machine-learning models. We do not read customer sessions except where an account owner asks us to investigate a specific incident, or where we are legally compelled — and such access is itself logged.
9How long we keep it
| Data | Retention |
|---|---|
| Account and profile | For the life of the account, then deleted or anonymized within 90 days of closure |
| Session and audit logs | Per the account's configured retention; 12 months by default |
| Separately agreed session recordings | Any existing agreed retention and account-deletion commitments continue to apply; the standard portal does not provide managed recordings |
| Technical and security logs | Up to 12 months |
| Billing and tax records | As required by law, generally 7 years |
| Support correspondence | Up to 3 years after the ticket closes |
The Remote Login off-site backup job keeps encrypted archives for up to 90 days. Deleted data may remain in those archives until they expire. A deletion request must also be accounted for if an older backup is restored. Existing agreed retention and deletion commitments continue to apply.
10Security
Connections use TLS. Credential-vault secrets use envelope encryption with Cloud KMS, and the Remote Login off-site backup job encrypts its archives. Other account and operational data rely on host and access controls; we do not claim application-level encryption for every database field. Two-factor authentication is available for account sign-in and required to reveal stored credentials. Technician access to devices requires account-level authorization, and connection requests are audited. Production access is restricted to authorized operators.
No system is perfectly secure, and we will not claim otherwise. If we become aware of a breach affecting your personal information, we will notify the affected account owner without undue delay and, where required, the relevant supervisory authority.
11International transfers
We are based in the United States and operate infrastructure in the United States and the European Union. Using the Service may involve transferring personal information across borders. Where we transfer personal data out of the EEA or UK, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable) together with supplementary technical measures, including encryption in transit and at rest.
12Your rights
Subject to local law, you may request access to your personal information, correction of it, deletion of it, a portable copy, restriction of or objection to processing, and withdrawal of consent. You may also lodge a complaint with your supervisory authority — in the UK, the Information Commissioner's Office.
Email [email protected]. We respond within 30 days, and we may need to verify your identity first. If your data sits inside a customer's account, see section 2 — we will route your request to that customer and support them in answering it.
13US state privacy rights
Residents of Texas, California, Colorado, Connecticut, Virginia and other states with comprehensive privacy laws have rights to know, access, correct, delete and obtain a portable copy of their personal data, and to appeal a refused request. We do not sell personal data or use it for targeted advertising, so there is nothing to opt out of on that front, but you may still exercise the other rights above at the same address. We will not discriminate against you for exercising them. If we deny a request, you may appeal by replying to our decision; we will respond to the appeal within 45 days.
14Cookies and this website
The application uses strictly necessary cookies for sign-in, session security and CSRF protection. You can block them, but you will not be able to sign in. The marketing website uses Google Analytics 4, which may set first-party analytics cookies. Google Signals and advertising personalization are disabled. We do not load analytics when the browser sends a Global Privacy Control signal. Fonts on this site are served from the Remote Login website.
15Children
The Service is a business product and is not directed to children under 16. We do not knowingly collect their personal information. If you believe a child's information has reached us, write to us and we will delete it.
16Changes
We may update this policy. Material changes take effect 30 days after we post the revised version or notify account owners, whichever is earlier. The effective date at the top of this page always reflects the current version.
17Contact
Houston IT Developers LLC
Houston, Texas, United States
[email protected]
See Pricing for current plan prices, or Contact with a question about this policy.
Request access