Privacy Policy

1. Overview

Your privacy is important to Sclera. This privacy statement applies to data collected through websites owned and operated by Sclera. This statement describes the information practices for Sclera’s websites and applications, including app.sclera.com and Sclera’s applications within Microsoft Teams (such as the Reactive Services application). This privacy statement describes the information practices for Sclera websites, including what types of information are collected, how Sclera uses this information and for what purposes; with whom information is shared; and how Sclera protects information. It also describes your choices regarding use, access, correction and deletion of your information, among other topics. In addition, this statement addresses personal information collection and use by Sclera in certain offline contexts, such as marketing and customer service and support.

2. What Information Do We Collect?

Sclera collects data to enable us to make our products available to you, and to provide you with the best experience on our website and with our products. You provide some of this data to us directly, such as when you register to create an account on our website, subscribe to a newsletter, respond to a survey, contact us for support, or contact us as a prospective customer, vendor, supplier, or consultant. We also obtain and process data in the context of making the products available to you.

You have choices about the data we collect. When you are asked to provide personal data, you may decline. But if you choose not to provide data that is necessary to enable us to make the Sclera products available to you, you may not be able to use all or part of those products.

The data we collect depends on the context of your interactions with Sclera, the choices you make (including your privacy settings), and the products you use. The data we collect can include the following:

2.1 Name and contact information - We may collect your first and last name, email address, password, postal address, phone number, company information, and other similar contact data.

2.2 Device and usage information - We may collect data about your device and how you and your device interact with our product.

2.3 Use data - We may collect data about the features you use, the products you purchase, and the web pages you visit. This also includes your interactions on our website, and your interactions with us via email.

2.4 Device, connectivity and configuration data - We may collect data about your device and the network you use to connect to our website or with which you use our products. This may include data about the operating system and other software installed on your device, including product keys. It may also include IP address, browser type, operating system, and referring URLs.

2.5 Data Quality Assurance - To ensure personal information is accurate, complete, up-to-date, and relevant for its intended purposes, Sclera may implement procedures such as validation checks during collection (e.g., required fields, format verification), periodic reviews of stored data, and automated updates where feasible, wherever needed. We also encourage users to review and update their information via the user dashboard. If inaccuracies are identified, we correct them promptly in accordance with documented internal processes.

2A. Data Collected via Microsoft Teams Applications

When you use Sclera's applications within Microsoft Teams (including the Reactive Services application), Sclera processes personal information on behalf of your organization in addition to the information described in Section 2. In this context, your organization determines the purposes and means of processing this information, and Sclera acts as a service provider, processing personal information only on the documented instructions of your organization and pursuant to a written agreement.

Sclera may collect or process the following categories of personal information through these applications:

2A.1 Authentication data - Identity assertions, session tokens, and OAuth tokens passed through your organization's identity provider to verify access and authenticate sessions. These tokens may be stored and logged on Sclera's (or its authorized service providers') systems to the extent necessary to operate, secure, and support the application. Sclera does not receive or store user passwords or other login credentials.

2A.2 Workplace location identifiers - Identifiers such as facility, floor, or asset codes derived from QR codes scanned within your organization's premises during use of the application.

2A.3 Submitted data - Information you provide when using the application, including text descriptions, form inputs, and file uploads (including photographs).

2A.4 Microsoft Teams identity data - Basic user profile information passed through the Microsoft Teams platform necessary to operate the integration.

2A.5 Activity data - Records of actions taken within the application, including request submissions, status updates, and workflow interactions.

Submitted data described in 2A.3, including file uploads and request content, is stored and processed on infrastructure managed by Sclera (or its authorized service providers) as necessary to provide application functionality and to process and manage workflows. Sclera processes and retains such data solely in its capacity as a service provider, only on the documented instructions of your organization and in accordance with the terms of our agreement with your organization. Access by Sclera personnel to submitted data is limited to that reasonably necessary to operate, support, diagnose, and maintain the application, and to activities carried out at your organization's request or with its consent.

The other categories described above (authentication data, workplace location identifiers, Microsoft Teams identity data, and activity data) may also be processed and logged on Sclera or its authorized service providers' systems to the extent necessary to operate, secure, and support the application. All processing described in this Section 2A is carried out in Sclera's capacity as a service provider, in accordance with applicable data protection requirements and the terms of our agreement with your organization. Personal information may be shared with authorized third-party service providers only as necessary to provide the service and subject to appropriate contractual safeguards.

2A.6 Exercising your rights - Sclera processes the personal information described in this Section 2A on behalf of, and on the documented instructions of, your organization, which acts as the controller of that information. If you wish to access, correct, or delete personal information processed through the application, you should direct your request to your organization, which controls that data. Sclera will assist your organization in responding to such requests as required under the applicable customer agreement. For any categories of personal information for which Sclera acts as a controller, you may exercise the rights described in Section 7 of this Policy.

3. What Do We Use Your Information For?

We use the data we collect to operate our business, and to make products available to you. This includes using the data to improve our Sclera product, and to personalize your experiences. We may also use the data to communicate with you, and among other things, inform you about your account, provide security updates, and give you information about the products. We may also use the data to manage your email subscriptions, improve the relevance and security of our website, respond to user enquiries, send you periodic marketing communications about our products, and improve the relevance of our advertising. The uses described in this Section 3 apply to personal information for which Sclera acts as a controller. Personal information that Sclera processes as a service provider on behalf of your organization (as described in Section 2A) is used only on your organization’s documented instructions and is not used by Sclera for its own product improvement, advertising, marketing, or business-intelligence purposes.

3.1 Providing and improving our products - We use data to provide and improve the products we offer, and to perform essential business operations. This includes making the products available to you, maintaining and improving the performance of the products, developing new features, conducting research, and providing customer support. Examples of such uses include the following:

3.1.1  Providing the products - We use data to carry out your transactions with us and to make products available to you. In certain cases, we may use data to automatically tailor your experience based on the data we have about you.

3.1.2 Technical support - We use data to diagnose product problems, and to provide customer care and support services.

3.1.3 Improving the products - We use data to improve our website continually and our products, including system administration, system security, and adding new features or capabilities.

3.1.4 Business operations - We may use your data to help us develop aggregate analysis and business intelligence that enables us to operate, protect, make informed decisions, and report on the performance of our business.

3.1.5 Improving advertising campaigns - We may use your data to improve our advertising campaigns, primarily to prevent targeting of advertisements which are not relevant to you.

3.1.6 Sending periodic emails - We may use your data to send you periodic emails. Depending on the marketing preferences you select on your user dashboard, we may send you occasional marketing emails about our products and services, which you can unsubscribe from at any point of time using the link provided in the message.

3.1.7 Communications - We use data collected to communicate with you, and to personalize our communications with you. For example, we may contact you to inform you when a license is ending, to discuss your account, to let you know when updates are available, to remind you about features of the products that are available for your use, to update you about a support request, or to invite you to participate in a survey. Additionally, you can sign up for email subscriptions, and choose whether you want to receive marketing communications from us.

4. How Do We Protect Your Information?

We implement a variety of security measures to help maintain the safety of your information when you enter, submit, or access your information. We offer the use of a secure server. Sensitive information can only be accessed by those authorized with special access rights to such systems, and who are required to keep the information confidential.

5. How Do We Ensure That Our Processing Systems Remain Confidential, Resilient, and Available?

We implement a variety of measures to ensure that our processing systems remain confidential, resilient, and available. Specifically, we have implemented processes to help ensure high availability, business continuity, and prompt disaster recovery. We are committed to maintaining strong physical and logical access controls.

5.1. High availability - We utilize properly-provisioned, redundant servers in case of failure. We take servers out of operation as part of regular maintenance, without impacting availability.

5.2. Business continuity - We keep periodic encrypted backups of data. While never expected, in the case of production data loss (i.e., primary data stores loss), we will restore organizational data from these backups.

5.3. Disaster recovery - In the event of a region-wide outage, we will bring up a duplicate environment in a different region. Our operations team has extensive experience performing full region migrations.

5.4. Physical access controls - Sclera is hosted by one or more secure hosting providers. Our hosting providers' data centers feature layered security models, which may include extensive safeguards such as custom-designed electronic access cards, alarms, vehicle access barriers and biometrics. Unauthorized visitors are not permitted to access the data centers.

6. Do We Disclose any Information to Outside Parties?

We share your data with your consent, or as necessary to make our product available to you. We also share your data with vendors working on our behalf; when required by law, or to respond to legal process; to protect our customers; to protect lives; to maintain the security and integrity of our products; and to protect our rights or our property.

We may disclose your data as part of a corporate transaction such as a corporate sale, merger, reorganization, dissolution, or similar event.

Finally, we will access, transfer, disclose, and/or preserve personal data, when we have a good faith belief that doing so is necessary to:

6.1 Comply with applicable law or respond to valid legal process and judicial orders.

6.2 Respond to requests from public or governmental authorities, including for national security or law enforcement purposes.

6.3 Protect the vital interests of our users, customers, or other third parties.

6.4 Operate and/or maintain the security or integrity of our products, including to prevent or stop an attack on our computer systems or networks.

6.5 Protect the rights, interests or property of Sclera or third parties.

6.6 Prevent or investigate possible wrongdoing in connection with the products.

We may use and share aggregated non-personal information with third parties for marketing, advertising, and analytics purposes. We do not sell or trade your information to third parties.

7. How to Access and Control Your personal data?

You can view, access, edit, or request a copy of your data. You can also delete certain elements of your data, or move certain elements of your data to "inactive" status where the data will no longer be processed. You can also make choices about Sclera collection and use of your data. For personal information processed through Sclera’s Microsoft Teams applications, see Section 2A.6, which explains how to exercise your rights with respect to that data.

7.1 Data Access - You can access your personal data on your accounts user dashboard.

7.1.1 Discovery of Personal Information - Data subjects may request confirmation of whether Sclera maintains their personal information by submitting a written request via email to privacy@sclera.com. The request should include sufficient identification. Upon receipt, Sclera will verify the data subject's identity and respond within 30 days, providing access or confirmation as applicable, in accordance with documented procedures for handling such requests.

7.1.2 Denial of Access - If access is denied (e.g., due to legal, security, or operational reasons), data subjects will be informed in writing of the denial, the specific reason(s), and any available rights to challenge the denial, as permitted or required by applicable law or regulation.

7.2 Data Portability - You can request a copy of your data by sending an email to us.

7.3 Data Correction - You can modify your personal data on your accounts user dashboard.

7.3.1 Review and Correction Procedure - Data subjects may review, update, or correct their personal information by accessing their user dashboard or submitting a written request via email to privacy@sclera.com. Upon verification of identity, Sclera will process corrections within 30 days and communicate any amendments to relevant third parties where committed or required (e.g., service providers or legal obligations), in accordance with documented procedures.

7.3.2 Denial of Correction - If a request for correction is denied, data subjects will be informed in writing of the denial, the specific reason(s), and any available rights to challenge the denial, as permitted or required by applicable law or regulation.

7.4 Accounting of Personal Information and Disclosures - Upon request, data subjects may obtain an accounting of the personal information held about them, including types of personal and sensitive personal information (e.g., contact details, device data), related processes and systems for handling such information, and disclosures to third parties (e.g., vendors as described in Section 6). Requests should be submitted via email to privacy@sclera.com with sufficient identification. Sclera will verify identity and provide the accounting within 30 days, including details on relevant third-party systems and processes where applicable, in accordance with documented procedures. If a request is denied, data subjects will be informed of the reason(s) and any rights to challenge, consistent with Section 7.1.2.

8. Where Do We Store and Process Personal Data and Conduct International Transfers?

Personal data collected by Sclera can be stored and processed in the United States where Sclera or its affiliates, subsidiaries or service providers maintain facilities. The storage location is chosen to allow us to operate more efficiently, to improve performance, and to create redundancies to protect the data in the event of an outage or other problem. We take steps to ensure that the data we collect is processed according to the provisions of this Policy, and that we comply with the requirements of applicable law wherever the data is located.

8.1 Data Retention - We may retain your information for as long as you continue to use our product, have an account with us, or as necessary to fulfil the purposes outlined in this Policy.

8.1.1 Data submitted via Microsoft Teams Applications - Personal information submitted through Sclera's Microsoft Teams applications (as described in Section 2A.3) is stored and processed on infrastructure managed by Sclera (or its authorized service providers) for the purposes of providing application functionality and processing workflows. Sclera processes and retains such data in its capacity as a service provider, only for as long as necessary to provide the service, on the documented instructions of your organization, and in accordance with the terms of our agreement with your organization, or as otherwise required or permitted by law. Retention and deletion of such data are governed by your agreement with Sclera.

8.1.2 Other categories of personal information processed in connection with Microsoft Teams applications (as described in Sections 2A.1, 2A.2, 2A.4, and 2A.5) are retained by Sclera or its authorized service providers only for as long as necessary to operate, secure, and support the application, or as otherwise required or permitted by law.

You can ask to close your account by contacting us, and we will either delete your information or move it to "inactive" status where the data will no longer be processed. We may, however, retain personal information for an additional period as is permitted or required under applicable laws, for legal, tax, or regulatory reasons, or for any other legitimate and lawful business purpose.

8.2 Customer data deletion request: Customers may request the deletion of their data by submitting a written request to Sclera via email at privacy@sclera.com. The request should include sufficient identification and a clear reason for deletion. Upon receipt of the request, Sclera will verify the customer's identity and confirm the deletion request within 5 business days. Sclera will then proceed with the deletion of the customer's data within 30 days of confirmation, unless retention is required by law, regulation, or contract. A confirmation of the data deletion will be provided to the customer once the process is complete.

8.3 Changes to our Privacy Policy: We will update this Policy when necessary to reflect customer feedback, as well as to reflect periodic changes in the Sclera website or our product. When we post changes to this Policy, we will revise the "last updated" date at the top of the Policy. If there are material changes to the Policy or in how Sclera uses your data, we will notify you either by prominently posting a notice of such changes before they take effect or by directly sending you a notification. We encourage you to review this Policy periodically to learn how Sclera is protecting your information.

9. How to Contact Us?

If you have a technical or support question, please send us an email at support@sclera.com.

If you have any complaints or grievances, please send us an email at grievance@sclera.com.

For any privacy concern, complaint, or a question for the Data Protection Team of Sclera, please contact us by sending us an email at security@sclera.com.  We will respond to any queries or concerns within 7 days.