This document explains how we process personal data we collect your IP address when you request access to the Element client from our web server.  For completeness, your rights under GDPR are:   The right to be informed The right of access  The right to rectification  The right to erasure The right to restrict processing  What Information Do You Collect About Me and Why? The information we collect is for the purpose of supporting your management of hosted homeservers through Element Matrix Services, or to support operational maintenance of the Element Matrix client.  Paying for hosted homeserver service via EMS is handled entirely by our payment processor, Stripe.   We might collect information about you through adverts placed in third-party platforms such as LinkedIn, Twitter or Google.  Our logs are kept for:   30 days, for EMS Customer IP addresses; 180 days, for Element chat app IP addresses We track usage data for Element hosting services. When you are signed in to your account we may track your usage of the site and associate that information with your account details. This data helps us understand how our users are using the application so that we can make improvements to the Service.   Our analytics are powered by the Free and Open Source analytics platform Matomo, hosted entirely within our network.   If you are using the Element chat app, you will be asked to opt-in to this anonymised data collection. Your use of the Service does not rely on your opt-in to this.  When using any of the Element chat clients your visit to the service will be logged, alongside your device ID and agent.  ‍In exceptional circumstances, we may share information about you with a third party if we believe that sharing is reasonably necessary to (a) comply with any applicable law, regulation, legal process or governmental request, (b) protect the security or integrity of our products and services (e.g. for a security audit), (c) protect Element and our users from harm or illegal activities, or (d) respond to an emergency which we believe in good faith requires us to disclose information to assist in preventing the serious bodily harm of any person.  We never store password data in plain text. instead they are stored hashed (with at least 12 rounds of bcrypt, including both a salt and a server-side pepper secret). Passwords sent to the server are encrypted using SSL.‍ It is your sole responsibility to keep your user name, password and other sensitive information confidential. Actions taken using your credentials shall be deemed to be actions taken by you, with all consequences including service termination, civil and criminal penalties.  If you become aware of any unauthorized use of your account or any other breach of security, you must notify Element immediately by sending an email to dpo@element.io.  You can download a copy of all your data as per section 2.1.3. Who Else Has Access to My Data? We host the Element Matrix Services on Amazon Web Services (AWS), specifically:   Our admin server is hosted in an AWS data centre in Amsterdam; Our deployment server is hosted in an AWS data centre in London; Customer deployments have the option to select the geographical location which is the most convenient for them;  We also host the Gitter.im app on AWS, in a datacenter based in the East of the US.  Amazon employees have access to this data. Here's Amazon's privacy policy. In the event that we sell or buy any business or assets, we may disclose your personal data to the prospective seller or buyer of such business or assets. If we or substantially all of our assets are acquired by a third party, personal data held by us about our users will be one of the transferred assets.  We try to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention at dpo@element.io if they think that our collection or use of information is unfair, misleading or inappropriate.  Document history  2018, March 28: Policy document for public homeserver exposed at https://matrix.org was created. 2018, August 2: This document was derived from the above. 2020, August 14: Updates to section 2.2.2 and 2.10 2020, October 2: Update to section 2 to include Gitter user data and section 2.2.2 to include Sentry error log collection 2020, October 27: update to section 2.2.1 to include marketing Information 

Summary:
The service provides information about how they intend to use your personal data. This service collects your IP address, which can be used to view your approximate location. You can request access and deletion of personal data. You can limit how your information is used by third-parties and the service. The service provides details about what kinds of personal information they collect. Your personal data is used for limited purposes. Third parties are involved in operating the service. This service gathers information about you through third parties. User logs are deleted after a finite period of time. Your personal data is aggregated into statistics. Third-party cookies are used for statistics. Tracking cookies refused will not limit your ability to use the service. The service may use device fingerprinting on users.. The service will only respond to government requests that are reasonable. The user is informed about security practices. You are responsible for maintaining the security of your account and for the activities on your account. You must report to the service any unauthorized use of your account or any breach of security. This service allows you to retrieve an archive of your data. This service gives your personal data to third parties involved in its operation. The service can sell or otherwise transfer your personal data as part of a bankruptcy proceeding or other type of financial transaction.. A complaint mechanism is provided for the handling of personal data. This service provides archives of their Terms of Service so that changes can be viewed over time.