BITLYNC PRIVACY POLICY
Version 1.1 · Effective on the date of first publication on the Websites
This Privacy Policy is issued by Bitlync, Inc., a Delaware registered corporation with offices located at c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713 ("Bitlync", "we", "us" or "our"). It describes how we collect, use, disclose and protect personal information when you visit our websites, use the public sandbox, use the Bitlync MSP Portal or ISV console, or otherwise interact with us. Please read it carefully. If you do not agree with this Privacy Policy, you should not use the Service.
Interpretation:
1. The definitions and rules of interpretation in this paragraph apply in this Privacy Policy.
Applicable Laws: means all applicable laws, statutes and regulations from time to time in force, including Data Protection Laws.
Audit Log: means the append-only record maintained by Bitlync of API calls touching a Connection, writes, logins, acceptances and Grant changes.
Connected System: means a professional services automation, remote monitoring and management, documentation, distribution or other business system which an MSP connects to the Service.
Connection: means the link established between a Connected System and the Service by means of a Credential.
Credential: means any API key, username, password, token, client identifier, client secret or similar secret which an MSP enters into the Service for the purpose of establishing a Connection.
Data Protection Laws: means all Applicable Laws relating to the processing of personal information, including (to the extent applicable) the California Consumer Privacy Act as amended by the California Privacy Rights Act, other United States state privacy laws, the EU General Data Protection Regulation 2016/679 ("GDPR") and the UK General Data Protection Regulation ("UK GDPR").
DPA: means the Bitlync Data Processing Addendum for MSPs published at https://www.bitlync.com/legal/dpa.
Grant: means the scoped, revocable entitlement approved by an MSP which permits a named ISV to access specified categories of MSP Data through a Connection.
ISV: means an independent software vendor which has entered into the ISV Platform Terms with Bitlync.
MSP: means a managed service provider or other organization which has accepted the MSP Connect Terms and connected a Connected System to the Service.
MSP Data: means all data retrieved from a Connected System through a Connection, all data entered into the Service by an MSP, and all data written to a Connected System through the Service, but excluding Credentials and Usage Data.
Personal Information: means any information relating to an identified or identifiable natural person, and includes "personal data" and "personal information" as defined in Data Protection Laws.
Service: means the Bitlync platform, the MSP Portal, the ISV console, the public sandbox and the Websites.
Usage Data: means logs, metrics, telemetry and audit records generated by the operation of the Service, including the Audit Log.
Websites: means www.bitlync.com, docs.bitlync.com and any other website operated by Bitlync which links to this Privacy Policy.
1.2 Paragraph headings shall not affect the interpretation of this Privacy Policy. Words in the singular shall include the plural and vice versa. Any phrase introduced by the words including, includes, in particular, or, for example, or any similar phrase, shall be construed as illustrative and shall not limit the generality of the related general words.
2. OUR TWO ROLES
2.1 Bitlync operates a platform which sits between MSPs and ISVs. MSPs connect their business systems to the Service, and ISVs approved by the MSP receive scoped access to the MSP's data. In consequence, Bitlync processes Personal Information in two distinct capacities, and this Privacy Policy is organized accordingly:
(a) As a business and controller. In respect of Personal Information relating to the personnel of our customers, visitors to the Websites, prospective customers and sandbox users, Bitlync determines the purposes and means of processing and is a "business" or "controller" under Data Protection Laws. Paragraphs 3 to 12 apply to such processing.
(b) As a service provider and processor. In respect of Personal Information contained in MSP Data, Bitlync processes such information on behalf of and on the documented instructions of the MSP, and is a "service provider" or "processor" under Data Protection Laws. Paragraph 4 applies to such processing.
2.2 This Privacy Policy does not apply to the products and services of ISVs or of the vendors of Connected Systems, each of which is governed by that organization's own privacy policy.
3. PERSONAL INFORMATION WE COLLECT AS A BUSINESS
3.1 Information you provide to us. We collect: (a) account and contact details, including name, business e-mail address, job title, organization name and address, and telephone number, when you create an MSP Portal or ISV console account, sign in by verified e-mail link, submit the Contact us form, request early access or a demo, or otherwise contact us; (b) billing details of ISVs, including billing contact, invoicing address, tax identifiers and payment method (we do not take card details on the Websites; where an ISV pays by card, the card is entered on a page hosted by our payment processor and we do not store full card numbers); (c) the content of e-mails, support requests, feedback and survey responses; and (d) in the case of ISVs, integration configuration including requested permissions, webhook endpoints and company mappings.
3.2 Information collected automatically. We collect: (a) Usage Data, including records of API calls, writes, logins, Grant approvals, narrowings and revocations, connection health events and console activity, together with the user identity, IP address, timestamp and user agent associated with each event, which Bitlync retains in the Audit Log as a core feature of the Service; (b) ordinary web server logs when you load the Websites, which are hosted on GitHub Pages, including IP address, browser type, operating system, referring page, pages requested and timestamps; and (c) requests made to the public sandbox, including sandbox API keys issued. We do not use advertising pixels. Cookies are described in our Cookie Policy.
3.3 Information from other sources. We collect: (a) from ISVs, the organization name of an MSP and the business e-mail address of the MSP user who will complete a Connection, when the ISV initiates a co-branded Connect flow; and (b) from business partners, events and public professional profiles, the business contact details of prospective customers.
4. MSP DATA: BITLYNC AS SERVICE PROVIDER AND PROCESSOR
4.1 When an MSP establishes a Connection, Bitlync synchronizes data from the Connected System into a per-tenant sync store and serves it to the ISVs which the MSP has approved. MSP Data commonly comprises tickets, companies, contacts, devices, agreements, time entries and installed applications, and accordingly contains Personal Information relating to the MSP's personnel and to the personnel of the MSP's own clients, including names, business contact details, ticket contents and device assignments.
4.2 In respect of MSP Data, the MSP is the business or controller and Bitlync is its service provider or processor. Bitlync processes MSP Data only: (a) to synchronize it from the Connected System and serve it to ISVs within the scope of the Grants approved by the MSP; (b) to deliver writes requested by an ISV within its Grant back to the Connected System; (c) to operate the AI assistant, where enabled, which is read-only and confined to the MSP's tenant; (d) to maintain the Audit Log, connection health and the security of the Service; (e) as otherwise instructed by the MSP or required by Applicable Laws; and (f) to provide ISV Analytics as defined in the MSP Connect Terms.
4.3 Bitlync shall not: (a) sell MSP Data; (b) share MSP Data for cross-context behavioral advertising; (c) use MSP Data to train any generally available machine learning model; (d) aggregate MSP Data across MSPs for publication or sale; (e) share MSP names with vendors or ISVs for the purpose of building a marketplace; (f) create customers in an MSP's professional services automation system; or (g) synchronize documentation passwords or credential objects held in a Connected System. The terms on which Bitlync processes MSP Data are set out in the MSP Connect Terms and the DPA.
4.4 Credentials entered by an MSP are stored in Bitlync's vault, encrypted at rest using AES-256-GCM with per-tenant keys, are used solely to authenticate to the Connected System on the MSP's behalf, and are never disclosed to any ISV.
4.5 If you are a client of an MSP and have a question about your Personal Information, you should contact that MSP, which controls the data. Bitlync will refer any request it receives directly to the relevant MSP and will assist the MSP in responding.
5. HOW WE USE PERSONAL INFORMATION AS A BUSINESS
5.1 We use the Personal Information described in paragraph 3 for the following purposes: (a) to provide, operate and secure the Service, including authenticating users, enforcing tenant isolation and rate limits, and maintaining the Audit Log; (b) to show MSP users the permissions each ISV requests when they connect their systems, and to record their acceptances, approvals, narrowings and revocations; (c) to calculate fees, invoice and collect payment from ISVs; (d) to provide support, respond to enquiries and communicate service, security and legal notices; (e) to improve and develop the Service, including through analysis of aggregated or de-identified Usage Data; (f) to send marketing communications about Bitlync products and events, subject to your right to opt out; (g) to detect, investigate and prevent fraud, abuse, security incidents and breaches of our terms; (h) to comply with legal obligations and to establish, exercise or defend legal claims; and (i) for any other purpose disclosed to you at the time of collection or with your consent.
6. HOW WE DISCLOSE PERSONAL INFORMATION
6.1 We disclose Personal Information to the following categories of recipient: (a) service providers (sub-processors) which process information on our behalf under written contract, such as hosting, error monitoring, e-mail delivery, AI processing and form delivery providers, as listed at https://www.bitlync.com/legal/subprocessors; (b) ISVs and MSPs; we disclose MSP Data to ISVs at the MSP's direction within a Grant; we disclose to an ISV the name and business e-mail address of the MSP user who completed a Connection and connection health and Audit Log information relating to that ISV's Grant; and we disclose to an MSP the identity of each ISV holding a Grant and the Audit Log of that ISV's access; (c) vendors of Connected Systems, to which Credentials are presented in the ordinary course of authenticating to the Connected System; (d) legal and regulatory authorities, where required to comply with Applicable Laws, legal process or governmental request, to enforce our terms, or to protect the rights, property or safety of Bitlync, our customers or others; (e) professional advisers and prospective acquirers, including counsel, accountants and any purchaser of the business, under a duty of confidentiality, in connection with a merger, financing, acquisition, reorganization or sale of assets; and (f) any other recipient with your consent or at your direction.
6.2 We do not sell Personal Information and we do not share Personal Information for cross-context behavioral advertising, as those terms are defined in Data Protection Laws, and we have not done so in the twelve (12) months preceding the effective date of this Privacy Policy.
7. COOKIES
7.1 We use cookies and similar technologies on the Websites, the MSP Portal and the ISV console, including a strictly necessary session cookie for signed-in sessions. Our Cookie Policy describes the cookies we use and how you may manage them. The machine API does not use cookies.
8. SECURITY
8.1 We implement and maintain administrative, technical and physical safeguards designed to protect Personal Information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, including encryption in transit and at rest, per-tenant encryption of Credentials, structural tenant isolation at the point of authorization, role-based access controls, read-only support access, the Audit Log and vulnerability management. Our SOC 2 examination is in progress; we do not claim a completed SOC 2 report or any other certification.
8.2 No method of transmission or storage is completely secure. If you believe that your account has been compromised, please contact us immediately at the address in paragraph 16.
8.3 If we confirm a breach of security affecting Personal Information we hold, we will notify the affected MSP or ISV without undue delay and, where Applicable Laws so require, the affected individuals and regulators, within the periods prescribed by Applicable Laws and the DPA.
9. RETENTION
9.1 We retain Personal Information for so long as is necessary for the purposes described in this Privacy Policy, unless a longer period is required by Applicable Laws. Our standard retention periods are as follows:
| Category | Retention period |
|---|---|
| Account and contact details | The life of the account and twenty-four (24) months thereafter |
| MSP Data in the sync store | The life of the Connection; deleted within ninety (90) days after the Connection or the MSP's account is terminated |
| Customer Content (data an ISV sends through the Service, such as writes, webhook payloads, mappings and support requests) | Held only as long as needed to deliver it to the Connected System, and in any case for no longer than the life of the Connection or Grant through which it was sent; deleted within ninety (90) days after that Connection or Grant ends (or, if earlier, after the ISV's agreement ends). Encrypted backups are overwritten in the ordinary course of backup rotation. The Audit Log record of each delivery is kept as stated for the Audit Log. |
| Credentials | The life of the Connection; securely deleted within ninety (90) days after deletion or termination, subject to backup rotation |
| Audit Log | Seven (7) years, as a security and accountability record for MSPs and ISVs; identifiers may be pseudonymized after the account is closed |
| Billing records | As required by tax and accounting law (generally seven (7) years) |
| Marketing contacts | Until you opt out or after twenty-four (24) months of inactivity |
| Encrypted backups | Overwritten in the ordinary course within thirty-five (35) days |
10. YOUR CHOICES
10.1 You may opt out of marketing e-mails by using the unsubscribe link in any such e-mail or by contacting us; we will continue to send service and legal notices. MSP and ISV users may review and update their account details in the MSP Portal or ISV console. We honor Global Privacy Control signals as an opt-out of sale or sharing to the extent required by Applicable Laws.
11. YOUR PRIVACY RIGHTS: UNITED STATES
11.1 Depending on your state of residence, you may have the following rights under United States state privacy laws: (a) to know or access the Personal Information we hold about you and to obtain a portable copy; (b) to correct inaccurate Personal Information; (c) to delete your Personal Information; (d) to opt out of sale, sharing, targeted advertising or certain profiling (in which we do not engage); (e) to limit the use of sensitive Personal Information (which we do not use for purposes requiring this right); and (f) not to be discriminated against for exercising your rights.
11.2 Many state privacy laws exempt Personal Information processed in an employment or business-to-business context; where an exemption applies, we will inform you. To exercise your rights, contact us at the address in paragraph 16. We will verify your identity using the e-mail address associated with your account or other reasonable means. You may appoint an authorized agent to make a request on your behalf, in which case we may require proof of the agent's authority. If we deny your request, you may appeal by replying to our response, and if your appeal is denied you may contact the attorney general of your state.
11.3 California notice at collection. The categories of Personal Information we collect are described in paragraph 3 and comprise identifiers, commercial information, internet or network activity, professional information and inferences drawn from the foregoing; the purposes of collection are described in paragraph 5; the retention periods are described in paragraph 9; and our disclosures for a business purpose in the preceding twelve (12) months are described in paragraph 6. We do not sell or share Personal Information. California residents may also request information regarding disclosures under California Civil Code section 1798.83. Residents of other states may have similar rights under applicable state privacy laws, and we will honor those rights where those laws apply.
12. CHILDREN AND HEALTH INFORMATION
12.1 The Service is intended for use by businesses and their adult personnel. We do not knowingly collect Personal Information from any person under eighteen (18) years of age, and if we become aware that we have done so we will delete it.
12.2 The Service is not designed or intended for protected health information subject to the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"). MSPs and ISVs must not send protected health information through the Service. Bitlync is not a business associate under HIPAA and does not enter into business associate agreements.
13. EUROPEAN ECONOMIC AREA, UNITED KINGDOM AND SWITZERLAND
13.1 This paragraph 13 applies in addition to the remainder of this Privacy Policy if you are located in the European Economic Area, the United Kingdom or Switzerland.
13.2 Controller and representative. Bitlync, Inc. is the controller of the Personal Information described in paragraph 3. Bitlync has no establishment in the European Union or the United Kingdom and, therefore, has not at the date of this Privacy Policy appointed a representative under Article 27 GDPR or Article 27 UK GDPR; Bitlync will do so if it begins to offer the Service to organizations in the European Economic Area or the United Kingdom. In respect of MSP Data, the MSP is the controller and Bitlync is its processor under the DPA.
13.3 Legal bases. We process Personal Information on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Providing the Service to our customers and their users, including authentication, consent screens and the Audit Log | Performance of a contract (Article 6(1)(b)), or our legitimate interest in providing the Service to the organization which has engaged us (Article 6(1)(f)) |
| Billing and accounting | Performance of a contract; compliance with a legal obligation (Article 6(1)(c)) |
| Security, fraud prevention, tenant isolation and audit | Legitimate interests in the security and integrity of the Service; compliance with a legal obligation |
| Service improvement and analytics | Legitimate interests; consent in respect of non-essential cookies |
| Direct marketing to business contacts | Legitimate interests, subject to your right to object, or consent where required by applicable e-privacy rules |
| Legal compliance and claims | Compliance with a legal obligation; legitimate interests |
13.4 International transfers. Bitlync is located in the United States and processes Personal Information there and in the locations of its sub-processors. Where we transfer Personal Information from the European Economic Area, the United Kingdom or Switzerland, we rely on the Standard Contractual Clauses adopted by the European Commission and the UK International Data Transfer Addendum, which are incorporated in the DPA, together with such supplementary measures as are appropriate. Bitlync is not at the date of this Privacy Policy certified under the EU-U.S. Data Privacy Framework. You may request a copy of the relevant safeguards by contacting us.
13.5 Your rights. You have the right to request access to, rectification or erasure of your Personal Information, to restrict or object to its processing, to data portability and, where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. You also have the right to lodge a complaint with your supervisory authority (in the United Kingdom, the Information Commissioner's Office). To exercise your rights, contact us at the address in paragraph 16; if your request concerns MSP Data we will refer it to the relevant MSP.
13.6 Automated decision-making. We do not make decisions producing legal or similarly significant effects on individuals based solely on automated processing. The AI assistant, where enabled, is read-only and does not make decisions about individuals.
14. OTHER JURISDICTIONS
14.1 If you are located in another jurisdiction with data protection laws (including Canada, Australia or Brazil), you may have similar rights of access, correction and deletion, and we will deal with your request in accordance with Applicable Laws.
15. CHANGES TO THIS PRIVACY POLICY
15.1 We may amend this Privacy Policy from time to time. We will post the amended version on the Websites with a new effective date and, in the case of a material amendment, will notify account holders by e-mail or through the MSP Portal or ISV console before the amendment takes effect.
16. CONTACT
16.1 Questions, requests and complaints concerning this Privacy Policy or our processing of Personal Information should be addressed to: Bitlync, Inc., c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, Attn: Privacy, e-mail ryan@bitlync.com (or such dedicated privacy mailbox as Bitlync publishes on the Websites from time to time).