Privacy Policy

Two roles, and the difference matters

Proteles is an identity provider that other companies build on. That means we hold data in two capacities, and your rights depend on which one applies to you.

If you signed up for Proteles yourself — you created a workspace, you administer it — we are the controller of your data and this policy governs it.

If you signed in to somebody else's application using Proteles, that company is the controller and we are their processor. We hold your account on their behalf and act on their instructions. Ask them to correct or delete it; if you ask us, we will tell you who to ask.

What we collect

• Account details — a username, an email address if one was given, and whether that address has been confirmed.
• Authentication material — a password hash (Argon2id; we never store the password), and any second factors you set up: a TOTP secret, registered passkeys, and recovery codes. Secrets are encrypted with a key belonging to your workspace alone.
• Session and token records — when you signed in, from what IP address, and what browser you told us you were using, so you can see where you are signed in and end a session you do not recognise.
• A security audit trail — sign-ins, failed sign-ins, changes to your factors, applications you connected or disconnected. Most entries hold an account identifier and an IP address. Some hold the username or email address the event was about, because the event makes no sense without it: a failed sign-in records the username that was tried, an invitation records the address it went to, and a change to who is in a workspace records who was added or removed.
• A phone number, only if you gave us one for text message alerts, and a record of when you agreed to receive them.
• A phone number for sign-in codes, only if the workspace you sign in to offers codes by text message and you enrolled a number yourself. We record that you consented, when, and the version of the wording you agreed to.
• Billing records, if a workspace is on a paid plan: which plan, the billing period, and the references Stripe gives the customer and the subscription. Card details are entered on Stripe's checkout and never reach us.

We do not use advertising trackers, and this site sets no analytics cookies. The only cookie it sets is a short-lived one that protects forms against cross-site submission.

Why

To sign you in, to keep the account secure, to let you and your workspace's administrators see what happened to it, and to bill for the service. The security audit trail is kept on the basis of legitimate interest in operating a secure service — it is the record that answers "was my account accessed", and it is the reason we can answer it.

How long

Account data is kept while the account exists. Expired sessions, spent links and dead tokens are removed automatically by a scheduled sweep.

The audit trail is kept for a window that depends on the workspace's plan: entries are visible for 3 days on Free, 14 days on Team and 60 days on Business. An entry that has left the window is kept, no longer visible, for 7 more days, and then deleted. The 7 days are there so that a downgrade can be undone: entries past the new plan's window disappear from view at once, and come back if the workspace upgrades again before they are deleted.

Audit records can outlive the account they describe. The trail is hash-chained so that it cannot be altered after the fact, including by us, which means entries cannot be removed one at a time without breaking it; they are removed by age, as above. That applies to the entries described above that hold a username or an email address. Where such an entry exists, deleting the account does not remove it any sooner, and we cannot remove it for you early without destroying the property that makes the trail worth keeping. The event recording the deletion itself names the account that was closed.

Deleting your account

You can close your account yourself, from /account when signed in. It removes your profile, your password, your second factors, your passkeys, your sessions and every application you connected, and releases your username. It cannot be undone. Audit entries about the account — including any that name the username or email address, and the record of the deletion itself — are kept until they age out of the workspace's window as described above, and are then deleted.

Who else sees it

We use a small number of service providers to run Proteles: cloud hosting, an email relay for account messages, Twilio as our text messaging provider, and Stripe for payments. They act on our instructions and only to deliver the service. We do not sell personal data, and we do not share it for anyone else's marketing. Of these, the only one we give your mobile number to is the text messaging provider, Twilio, and only to deliver the messages; see Text messages below.

Paid plans are sold through Stripe, with Link (by Stripe) as the merchant of record: Link sells the subscription, processes the payment and handles tax and receipts. Whoever pays for a workspace gives their billing details to Stripe and Link at checkout, and for the payment itself Link is a controller in its own right, under its own privacy policy. What we receive back is described under "Billing records" above.

If you signed in to another company's application, the data we hold about you is theirs and they can see it.

Your rights

Access, correction, deletion, portability and objection, exercised by writing to hello@proteles.com. If we hold your data on another company's behalf we will pass the request to them and tell you we have.

Text messages

If you gave us a number for alerts, it is used to send you those messages and for nothing else.

If you enrolled a number for sign-in codes, it is used to send you sign-in codes when you sign in, and for nothing else: not alerts, and never marketing. Codes go only to US and Canadian numbers. We keep a record that you consented, when, and the version of the wording you agreed to.

Your mobile number, and your opt-in and consent to receive text messages, are not shared with third parties or affiliates for marketing or promotional purposes, and are never sold, rented or exchanged. The only company we give your number to is the text messaging provider that delivers our messages, which acts on our instructions and only to deliver them. Apart from that, text message opt-in data and consent are not shared with any third party.

When you sign up we keep a record of the number, when you agreed, and the wording you agreed to, so that we can show you consented.

Reply STOP to any message to stop, or ask us. Reply HELP for help. See the SMS alerts page for what is sent and how often.

Changes

If this policy changes in a way that affects you, we will say so before it takes effect rather than after.