The purpose of this document is to provide you with additional, more detailed information in regards to how we collect, store and use your data. ‘Privacy Policy’ is the first document that you should get acquainted with.

If you have any questions, contact us at info@thinglink.com

Thinglink complies with NIST 800-63-3 Authenticator Assurance Level (AAL) 1. However, we do allow users to request that they are “remembered” for a longer period of time (a maximum of 30 days) without the need to log in. Reauthentication is required after 30 days. Session timeout is 30 minutes.

User secrets (passwords and salt) are stored in a database table, using SHA-512 with 100,000+ iterations and a per-user unique salt of 128 bits.

Users may attempt login 30 times within 24 hours before the account is locked for 1 hour. The minimum length of a password is 10 characters, and passwords must contain both letters and numbers. We check any new passwords against the public 100,000 “most used” passwords list, as well as some common, well-known patterns (e.g. “thinglink1”).

Security audit logs are collected to a separate Logstash instance and have a 6-year expiry period. These logs are used to track administrative access to production systems via SSH.

For any other collection containing personal data (e.g. CSV reporting files pulled out of the system for billing purposes, etc) the retention period is 90 days after which lists must be deleted.

All logs are stored in the EU.

This data can be accessed via command level (see below) or via the Thinglink Admin user interface by authorized personnel.

Identifiable data is stored within our main database in Ireland (EU). IP addresses and browser footprints are visible to web analytics services (Google Analytics and Mixpanel) located in the United States. Any identifiers that we use are pseudonymized before transfer and are unique per external service.

Customer sales data is stored in HubSpot (a U.S. service). No student account data is sent to HubSpot. Customer sales data includes, but is not limited to, name, email, phone number, other contact information, and communication logs with the customer. Deleting an account removes all relevant customer data from HubSpot. Some customer data may also be stored on employee’s computers, Google Docs and/or Dropbox. These are governed by our retention and encryption policies.

Customer support is done with ZenDesk (US service). ZenDesk stores user email addresses and email communication.

Outgoing email is handled through Mailgun (US), which does receive your email address whenever we send you an email.

Credit card and payment data are handled through Stripe (US), Quaderno (ES), Churnbuster (US) and Firstofficer (FI); the first of which is the only one which actually receives and stores your Credit Card data. Quaderno manages the VAT calculations and is required to store by EU legislation the required data for correct VAT calculation, including things like your country and IP address. Firstofficer is used to perform data analytics on payments and improve our service. Churnbuster sends you payment reminders. All these services receive your name and email address.

Invoicing is done through Ronin (US) and Netvisor (FI). They receive things like your address and payment information and any other information we require to bill you correctly and fulfill the requirements of accounting law.

Our US-based customers can also use PayPal (US) to pay, but this is not an option for our EU customers.

We also use a number of content hosting services, which do receive your IP address, browser imprint and any cookies. These are Fastly, Facebook, Twitter, Linkedin, Google, Microsoft, Wistia, Amazon and Cloudflare. All of these may store your data in the EU or in the US, depending on your locality.

Tags may contain embeds to different sites, and users are notified in advance prior to watching the image/video which sites will receive their IP address, cookies and browser footprints. User consent is requested before their data is sent to those sites by the browser. The data from these embeds may or may not be stored anywhere in the world, as it is not in our control.

Production system access is strictly via SSH - no passwords are used. Public keys for all administrators are stored in an Ansible configuration file, and that file is updated as people gain or lose access. All production servers use the same configuration file, and any local modifications are overwritten automatically.

We are logging facts of authentication and all commands/application which users ran on our prod servers. Logs are placed on a Elasticsearch server using Logstash. Access to those logs is available only to restricted personnel. Production access logs are stored for 6 years.

We have two in-house specialists that do tests and checks once in three months, one time per year we hire consultants to do pen testing and security checks. In addition, we have an open bug bounty program that supports white hackers which helps us identify vulnerabilities. Therefore, the complex of organizational and practical steps are being done on a regular basis.

The pen testing/security check reports shall be stored in Google Drive for auditing purposes.

When a ThingLink user deletes their account, we remove all user content and all user data from the database. There is a brief period between deletion and before it becomes unrecoverable, and this period depends on our database maintenance schedule. The maintenance (called compaction) is automatic and depends on system load but typically occurs several times per day.

Aggregate, anonymized user data (such as statistics, e.g. total view counts) will remain.

GA is used to track the website traffic and get aggregate data on traffic sources, devices and system load. We do not send any unique identifiers to GA.

Google Analytics data retention period is set to 26 months. Any event older than that is automatically removed.

MP is used to manage our A/B tests, track conversion and all vital statistics for SaaS performance. We do send a pseudonymized identifier to Mixpanel, which is different from any of our other identifiers and cannot be used to identify the user.

We do not use the Mixpanel People product that would track individual users.

When a user deletes their account on Thinglink, we clear any Mixpanel cookies and delete any associations between user data and Mixpanel. Only aggregated, anonymous data remains on Mixpanel.

Hubspot is used to track users who have signed up, agreeing to our Terms of Service. It functions as a customer database and contact point. We store user names, emails, company information, etc. to Hubspot.

If the user deletes their account on Thinglink, we remove any HS data as well.