This Privacy Policy explains how Remoqa handles personal data in connection with https://remoqa.com, our desktop and mobile applications, the account cabinet, browser access tools, remote connections and paid services (together, the Services). It covers visitors, account holders, guests, session participants, organisation members and people who contact us.
This policy applies to the Remoqa services that are available to you. Optional features process information only when they are offered and used. The Google user data section explains Sign in with Google, including the information we receive, the purposes and recipients, storage, retention, revocation and deletion.
01Who is responsible for your data
Remoqa is operated by LIFTSOFT LLC, referred to as Remoqa, we, us or our. We act as the controller or equivalent responsible organisation for processing whose purposes and means we determine, such as account administration, our billing and service security.
Our General Director is responsible for data protection and is our privacy contact at [email protected]. Company details are available at remoqa.com/pt/terms/#operator.
An organisation using Remoqa may be responsible for personal data about its members and people whose devices or sessions it manages. For account administration, billing and service security, we determine our own processing purposes. Where we process information solely on a Customer's instructions, we act as its processor or equivalent service provider. Our Data Processing Agreement at remoqa.com/pt/dpa/ sets out terms for that processing, including security, subprocessors, assistance and deletion. The relevant parties must complete and accept it as described there before the covered processing begins; this notice is not itself an agreement. The organisation's notice explains its own purposes and lawful basis. Contact [email protected] if you need help identifying who is responsible for a particular activity.
02Accounts organisations and sign in
When you create or manage an account, we process your name, email address, password hash, verification status, account identifiers and settings. We also process authentication sessions, recovery and verification information, security events and relevant request information such as IP address and browser details. Passwords used for account authentication are stored as hashes.
For organisation features, we process organisation and department names, membership and invitation information, roles, device assignments, administrative changes and authorised activity records. Information can be supplied by you, an organisation administrator or a person inviting you to join.
You can choose Sign in with Google to create or access a Remoqa account, or connect Google from an existing account. The Google user data section below explains this optional integration. Google also handles your interaction with its own service under its privacy notice.
03Google user data and Sign in with Google
Sign in with Google is optional. Remoqa requests only the openid, email and profile permissions. Google sends a basic profile response containing your Google account identifier, name, email address and email-verification status. The response may also include a profile picture URL, given and family names, language and an organisation domain. Remoqa uses the organisation domain, when supplied, to assess email verification; it does not save your Google profile picture or these additional profile fields. We do not receive your Google password or request access to Gmail messages, Google Drive files, Calendar events or Google contacts.
We use the Google account identifier to link Google to your Remoqa account and recognise you on subsequent sign-ins. For registration, we use your name and email address to prefill the account form, which you can review and edit. We use the email-verification information to determine whether separate email verification is necessary. Connecting Google to an existing Remoqa account does not replace its name or email address. The resulting account details are used for the account, requested service features and necessary account or security messages described in this policy.
The Google sign-in flow exchanges a temporary authorisation code for an access token on our server, then uses that token to retrieve the profile over HTTPS. We do not persist Google access tokens or ID tokens, request offline access, or retain Google refresh tokens. The linking record stores the Google account identifier, the associated Remoqa account identifier and timestamps. Your confirmed registration name, email and verification status become part of the Remoqa account. A pending registration profile is valid for ten minutes; it is cleared when registration is completed or an invalid or expired flow is handled, and is otherwise subject to the server-session lifetime. A new sign-in flow replaces pending registration data.
Google account data is stored with our account records on DigitalOcean infrastructure in Singapore, including backups there. Access is limited by account and administrative permissions; persons authorised by Remoqa may access account data for support, administration and security. Remote access locations are described in section 11. The connection to Google and the cabinet uses HTTPS. Account records are separate from the end-to-end encrypted remote-session content. Google sign-in data is not included in remote-session video or audio merely because you sign in.
Recipients of Google-derived account information are limited to those needed to provide the functions described here: our hosting and backup provider DigitalOcean; Plunk Cloud for necessary service emails, which can include your account email and name; persons authorised by Remoqa; and, when you use organisation features, authorised organisation administrators who can see the account or audit information within their permissions. Your account details may also accompany a payment you request as explained in the billing section. We may disclose relevant data where required by applicable law or necessary for a specific security investigation or legal claim. Google receives the sign-in requests and handles them under its own privacy policy. We do not sell Google user data, use it for targeted advertising, send it to website analytics as Google sign-in profile data, or use it to train general-purpose AI or machine-learning models.
We use information received through Google APIs in accordance with the Google API Services User Data Policy, including its Limited Use requirements. Access, use and disclosure are limited to the purposes described in this policy. If those purposes or the requested Google permissions change, we will update this policy, provide notice of material changes and obtain any additional authorisation required before accessing or using the additional data.
Google API Services User Data Policy
The Google account link and Google-derived account details are retained while needed for your Remoqa account. Closing an account from the profile deactivates it and ends its active login sessions; it does not immediately erase its profile or Google link. The current account-restoration defaults retain a user-closed profile for five years and an automatically closed, unverified profile for one year, followed by scheduled permanent deletion. Permanent deletion of the profile also deletes its Google linking record. You can request earlier erasure of the Google link or other account data at [email protected]; we will verify the request, apply the rights available under the applicable law and explain any specific information that must be retained. Independent financial, security or legal records and backup copies follow the retention limits described elsewhere in this policy.
You can review or revoke Remoqa access in your Google Account connections settings. Revocation prevents further access under the revoked authorisation; choosing Google sign-in again may ask you to authorise a new connection. Revocation does not automatically delete the data already stored by Remoqa, close your Remoqa account or end an existing Remoqa login session. Sign out of Remoqa to end that session and contact [email protected] to request unlinking or erasure. If you registered with Google and have no Remoqa password, use password recovery before relying on password sign-in or the password-protected account-deletion control.
04Devices and preferences
To register, identify and connect devices, the Services process device identifiers including the Remoqa ID, device name or hostname, platform, application version, public identity keys, account association, online or last-seen status, IP address and connection settings. Features such as unattended access use authentication information and configuration; device access passwords handled by our backend are hashed.
We derive an approximate location from a device's public IP address for device display, administration and security. This can include country, region, city and estimated coordinates. The current default uses a locally held DB-IP database, so that lookup does not send each device IP address to DB-IP. It does not request GPS permission. Approximate locations may be shown to authorised administrators; they are estimates, not a reliable way to identify an individual's precise whereabouts.
If Wake on LAN is available and enabled, hardware network addresses and related configuration are processed to carry out that feature. Browser settings can include language, timezone and cryptographic device identity information. This policy also applies to our available desktop and mobile applications. Before an application processes additional categories of personal data or uses data for additional purposes, we will explain that processing in this policy or a supplementary notice available with the relevant feature. Application permissions, local logging and diagnostic controls will be explained before the relevant processing starts. Where separate consent is required, we will obtain it before that processing begins.
05Connection records and diagnostics
When you open the website, cabinet or a service endpoint, the infrastructure handling your request receives your IP address, requested URL, request time and browser information. Access and security records can include response status, referring page and errors. We use these records to deliver requests, investigate failures and protect the Services. These records are separate from the content of a remote session.
Creating or attempting a connection produces operational records such as the participating device and account identifiers, request and start or end times, status, duration, connection mode, relay selection, traffic volumes and termination or failure reasons. Network and signalling services also handle addresses and connection negotiation information necessary to establish and route the session.
When a client sends a diagnostic report, we receive the device and session identifiers, client version, collection time, connection role, protocol steps, status and error details, elapsed times and performance measurements. Reports can also contain contextual fields supplied by the client. They are associated with the relevant device and session, are available to authorised service administrators, and are not anonymous. Client-specific submission behaviour and controls are covered by the application information in section 4. Diagnostic reports are separate from the encrypted live session-content channel.
Where Extended audit is enabled, organisation records can identify the actor by name and email and record device details, connection events and membership changes. The current file-transfer audit records the reported byte count, reporting device and connection mode alongside the session details; that audit event does not contain the transferred file's name, path or contents. Authorised users can view or export records within their permissions and plan. An export saved on their own device is under their control.
06Remote session content
A remote session can carry screen images and, where supported and enabled, audio, control input, clipboard information or transferred files. This material may contain personal or confidential information belonging to you or other people. The person controlling a device and the participants determine what is exposed through the features they use.
Remoqa encrypts remote session content end to end between the connected devices, including screen images and, where supported and enabled, audio, control input, clipboard information and transferred files. This protection also applies when a relay server forwards the content. Relay servers forward encrypted traffic rather than needing its decrypted content. This does not make account information, connection metadata, billing records or separately submitted diagnostics invisible to the services that process them.
We do not record live remote session content on our servers. Screenshots, recordings or files that you deliberately send to support are handled as support material, outside the live session-content channel.
The other participant receives the information you share and may be able to save or record it on their device. Direct connections can reveal network addresses to the other endpoint. We cannot control a participant's independent use of received information. Share only what is necessary and obtain the permissions required for your use of the Services.
07Billing purchases and messages
For paid services, Remoqa processes the selected subscription or add-on, billing period, amount and currency, account and payment references, payment and delivery status, balance and ledger records, refunds and renewal choices needed to provide access and handle support. PayMeGate payments credit the account balance; a plan purchase then deducts the stated plan price, leaving any remainder on the balance. Available payment methods and their charges are shown before you pay.
Purchases are linked to the Remoqa account used to start them. When creating a PayMeGate payment, Remoqa sends an order reference, the quoted amount and currency, the selected payment method and the account owner's email address. The reference connects the payment to the account and selected purchase. The email address is separate from that reference. Payment credentials are entered with the selected payment provider, not in Remoqa.
LIFTSOFT LLC sells the Remoqa service and remains responsible for account, entitlement, balance and product-support processing. PayMeGate supplies the checkout software and payment-status notifications; independent third-party providers process payments and may collect billing or identity-verification information under their own notices. Payment references, amounts, currencies and status are exchanged to reconcile payments and deliver access. Relevant delivery and support evidence may be shared to resolve a payment complaint or refund. Remoqa does not send remote-session content, passwords or device-access credentials as part of a purchase.
Remoqa does not store the full card credentials or identity documents you submit to a payment provider. PayMeGate and the selected provider describe their own processing, recipients and any international transfers in their notices. Review those notices before using the method, especially if it requires identity verification. Before introducing additional sharing, we will update the applicable disclosures and meet any required legal conditions. Do not send full card credentials, passwords or keys in support requests.
When you contact us at [email protected], we process your contact details, correspondence and any diagnostic information included in your message. If we receive attachments through a supported channel, we process them to handle your enquiry. We use this information to answer enquiries, investigate issues and maintain appropriate records. Plunk Cloud processes incoming support emails on our behalf, including sender and recipient details, the subject, message content and technical information needed to receive and handle the message. Access to this information is limited to persons authorised to manage and respond to your enquiry.
We use your email address and relevant account or transaction information to send service messages, including email verification, account recovery, security notices, payment and subscription notices, account-closure notices and material service updates. Plunk Cloud, the hosted service at useplunk.com, delivers these emails on our behalf and processes the recipient email address, name where included, sender and reply-to details, subject, message content and information needed for delivery. We do not enable tracking of email opens or link clicks in these messages. Delivery and failure records may still be processed to operate the email service. We do not currently send promotional emails.
08Purposes and legal bases
We use personal data for the purposes below. Where the GDPR or a law using comparable legal bases applies, the basis depends on our relationship with you and the particular activity. We do not treat acceptance of the Terms of Service or this policy as consent to every use of your information.
- Accounts, authentication, device registration, requested connections and related service messages: performance of our contract with you or steps you request before entering it. For people who are not parties to that contract, our legitimate interests are enabling authorised access and operating the service requested by the account holder, subject to their rights.
- Purchases, subscriptions and refunds: performance of the purchase contract. Required financial records, legally required disclosures and responses to valid official requests: compliance with an applicable legal obligation.
- Security, abuse prevention, service reliability and necessary diagnostics: our legitimate interests in preventing unauthorised access, investigating failures and protecting users and infrastructure, where those interests are not overridden by individuals' rights.
- Organisation features: the organisation establishes the basis for processing it instructs us to carry out. Our own access administration and security processing serves the legitimate interests described above.
- Language and timezone preferences: performance of our contract when needed to provide your requested service, or our legitimate interest in remembering a visitor's requested settings. Support correspondence: performance of our contract or steps requested before it, or our legitimate interest in answering other enquiries. Relevant records may also be needed to establish, exercise or defend legal claims.
- Optional analytics and any other processing for which consent is required: your separate consent. The current website's analytics behaviour and available controls are explained in section 9 and the Cookie Policy; the current site has no on-site analytics-consent control.
Legitimate interests are not permission to disregard your privacy: the processing must be necessary and proportionate, and you may object as described in section 13. If another applicable law requires consent or a different legal condition, that condition must be met before the activity takes place. Information needed to authenticate an account, establish a requested connection or complete a purchase is necessary for that function; without it we may be unable to provide that function.
Where the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) applies, the lawful basis must meet its requirements for the relevant activity. Sensitive personal information and privileged information require a condition permitted by Section 13 of that Act; a contract or legitimate interest alone is not sufficient. The purposes and ordinary-data bases described above do not dispense with those additional requirements.
10Who receives information
DigitalOcean provides hosting infrastructure and processes information needed to store, deliver and protect the Services. The informational landing uses DigitalOcean's standard content delivery network (CDN), which uses Cloudflare for delivery and security. That network receives website request information such as IP addresses, requested resources and browser information, and uses a security cookie described in the Cookie Policy. CDN delivery is used for the informational landing only. Infrastructure providers and their authorised subprocessors may handle hosting, network delivery, backup and security operations. Processing locations are described in section 11.
Plunk Cloud processes incoming support emails and delivers outgoing service emails as described in section 7. Other recipients include the payment providers and banks used for a purchase, and Google for landing analytics and optional sign-in. The default administrator map uses OpenStreetMap tiles: its tile server receives the administrator's browser requests and requested map areas; device markers are rendered within the cabinet. The default DB-IP location lookup is local as described in section 4.
Other connection participants receive the content you share and the information needed to connect. Organisation owners and authorised administrators can receive member, device, history, audit and billing information within their permissions. If a customer operates a Private relay, the customer and its hosting provider handle the connection information and encrypted traffic routed through that infrastructure and are responsible for its operation and their own processing.
Access to personal data and operational records is limited to authorised persons who need it for support, administration and security. Remote access locations are described in section 11. The cabinet includes an administrator sign-in-as-user function, which allows a service administrator to access the account interface without asking for your password. This function provides access to the account interface; it is separate from the encrypted live session-content channel. We may disclose relevant information to professional advisers, competent authorities or other recipients when necessary and lawful for an obligation, investigation or legal claim.
11Where information is processed
We use DigitalOcean to host the primary application and database in Singapore. Our backups are also stored in Singapore. Persons authorised by Remoqa may access personal data remotely for support, administration and security from countries where they work, including Russia. Such access is subject to applicable data-protection requirements, access controls and any agreed restrictions on processing locations.
Remoqa relay servers currently operate in Singapore and the Netherlands. They forward encrypted session traffic and process the connection information needed to route it. When a relay is needed, the service automatically selects an available node with the aim of providing a low-latency, reliable connection for both participants, using network measurements, location and availability. It does not guarantee use of a particular country or the geographically closest server.
We may add, replace or retire relay locations as demand and service needs change. The current locations describe the network in operation and do not limit its future geographical coverage. We will keep the processing-location information in this policy up to date and provide any notices and safeguards required by applicable law before changes take effect. The other participant in a remote session may also be in another country.
The informational landing is delivered through DigitalOcean's CDN using Cloudflare's global network. Website request and security information can therefore be processed at network locations outside Singapore or your country. This CDN is not used for the cabinet, Core API or remote-session relay services.
We use Plunk Cloud for incoming support emails and outgoing service emails. Plunk states that contact and email data are stored in Germany and that email delivery through Amazon SES may involve transit outside the European Economic Area. Its published data-processing terms identify subprocessors and transfer safeguards.
Different countries can provide different levels of data protection. Where an international transfer is subject to legal restrictions, an applicable legal mechanism and safeguards are required. Contact [email protected] for information about a specific transfer, its destinations and safeguards, and a copy where the law gives you that right. Your use of the service or acceptance of this policy does not by itself provide consent to a restricted transfer.
For processing covered by the Philippine Data Privacy Act, where we act as the personal information controller we remain accountable for personal information transferred to third parties for processing, including outside the Philippines. We must use contractual or other reasonable means to provide a comparable level of protection while it is processed by a third party. Where we process information on behalf of an organisation, the Data Processing Agreement and its lawful instructions govern that processing.
12Retention and account deletion
We retain personal data only for as long as needed for the stated purpose and applicable legal requirements. Different categories have different retention periods depending on their purpose and the obligations that apply. The retention periods are:
- Active account, organisation and device records are retained while needed to provide and administer those accounts, memberships and registered devices. Closing an account starts the restoration process below; removing a member or unlinking a device does not necessarily erase independent session, audit or financial records.
- Closed account profiles: the current application default is five years from a closure you request, or one year from automatic closure for an unverified email address. Eligible profiles are permanently deleted by a daily cleanup task after the deadline. These periods support restoration and do not establish a legal requirement to keep every data category or override applicable rights to earlier erasure.
- Guest browser-host devices: inactive devices with no open session are normally retired after 30 minutes of inactivity by a periodic cleanup. Their records become eligible for permanent deletion after one year from retirement, or from the last recorded activity for an unretired record. Retirement is logical deletion, not immediate erasure of every related record.
- Diagnostic reports are deleted once older than one calendar month by a daily cleanup. Extended audit events expire one year after recording and are removed by daily cleanup. These schedules do not apply to all connection history or traffic records. Other connection history and traffic records are retained according to their service, security, usage-accounting or dispute-resolution purpose. There is no single fixed deletion period stated here for all those records. You can request the period and deletion options for your records from our privacy contact.
- Authentication and request-security data: login sessions expire under the storage settings in section 9; account closure also ends its server-side login sessions and clears reset and remember-me tokens. Password-reset and verification links expire after 60 minutes by default. Expiry limits use of a token; it is not a promise that all related logs have been erased. Access, security and infrastructure logs follow the retention settings of the service handling them and the needs of any specific incident or legal obligation. You can request information about the logs relating to your account; token expiry does not erase those logs.
- Financial records and evidence of purchases or renewal authorisation are retained for the accounting, tax and claims periods applicable to the transaction. The applicable period depends on the type of record, the transaction and the legal obligation or claim involved. We will explain the relevant period and any limitation on deletion in response to a request about your transaction.
- Support correspondence is retained for twelve months after the enquiry is closed, then deleted. Attachments are deleted within thirty days after they are no longer needed to resolve or follow up the enquiry; they are not automatically retained for the full correspondence period. Material required by an applicable legal obligation or for a particular legal claim or investigation may be retained for that matter, with access limited to that purpose, and deleted when that need ends. Copies in backups follow the separate backup-retention rules below.
- Google Analytics is configured to retain event data for two months and user data for fourteen months; Google also applies the latter period to key-event data. New activity restarts the user-identifier retention period. Expired data is removed through Google's monthly deletion process; standard aggregated reports are not limited by these settings. Cookie lifetimes and further details are in the Cookie Policy. Reports you export to your own device remain under your control. The current landing has no early-access sign-up form; any retained historical submissions require a separate retention and deletion review.
- Service email content, contact and delivery/failure records remain with Remoqa and the email provider for delivery, troubleshooting, security and any applicable legal record-keeping purpose. Provider retention is separate from the support-correspondence period above. Disabling open and click tracking does not erase delivery records or message content. You can request deletion and information about the records retained for your account from [email protected].
- Deleting a record from active systems does not necessarily immediately remove a copy from a backup. Backup copies of deleted personal data are erased or irreversibly overwritten within 30 calendar days after deletion from active systems. Until then, those copies are isolated from ordinary use and restricted to necessary recovery under controlled access or legally required retention. If a backup is restored, applicable deletion instructions must be reapplied before the recovered data returns to ordinary use. Any legally required retention exception is limited as described below.
Closing an account does not immediately erase every record. Account closure deactivates the profile, ends its login sessions and unlinks its devices. Successfully signing in to an eligible closed account before its restoration deadline restores the profile; blocked accounts and accounts whose deadline has passed cannot be restored this way. Restoration does not automatically relink devices or restart a cancelled subscription. An individual profile closure does not necessarily erase records independently held by an organisation or another session participant. You may separately request erasure; the restoration period does not override applicable rights to earlier deletion.
Information needed for a specific legal obligation, fraud investigation or legal claim may be retained for the appropriate period with restricted access. After the relevant purpose ends, it should be deleted or anonymised. You can separately request erasure or other rights at [email protected]; we will explain any lawful reason for retaining particular information. For Customer Personal Data processed under an accepted Data Processing Agreement, its instructions and return/deletion terms take priority over these general retention descriptions. Profile restoration or ordinary support retention does not automatically permit keeping that data after the Customer's processing instructions end.
13Your rights and choices
Depending on the applicable law, you may have rights to receive information, access or correct your data, request erasure, restrict or object to processing, receive portable data, withdraw consent, or seek review of certain automated decisions. Consent withdrawal does not affect processing that was lawful before withdrawal. Mandatory rights do not depend on having a paid plan.
You can manage available profile, device, organisation and billing settings in the cabinet. For a privacy request, contact our General Director at [email protected]. We may ask for information reasonably necessary to identify the relevant records and verify your authority, without requesting unnecessary sensitive documents. We will respond within the period required by the law that applies and explain any lawful refusal or limitation.
Where GDPR rights apply, you may request access, correction, erasure, restriction and, where its conditions are met, portability. You may object to processing based on legitimate interests and withdraw consent to consent-based processing. You may complain to a supervisory authority, including in the country where you live or work or where the alleged infringement occurred. Other applicable privacy laws may provide comparable or additional rights. If an organisation controls the relevant activity, contact its privacy contact; we will assist as required by our role. We do not impose conditions on complaints beyond the procedures required by applicable law.
Where the Philippine Data Privacy Act applies, your rights include being informed, access, objection, correction, erasure or blocking, data portability and seeking damages, subject to the conditions and exceptions in that law. You may raise a privacy concern with us at [email protected] and complain to the National Privacy Commission (NPC). The NPC generally requires a prior written complaint to the entity concerned and an opportunity for appropriate action, subject to exceptions and waiver under its rules. Its official complaint procedure explains those requirements. The consumer-complaint procedure in our Terms does not replace the NPC privacy-complaint procedure.
We currently send service notifications only. Necessary account, transaction, security and material service messages may continue while they are needed to provide the Services or meet legal obligations. Contact [email protected] with questions about a notification or your communication preferences.
14Security
We use password hashing, authenticated device identities, account and role-based access checks, request throttling and encrypted remote-session channels. Browser device identity keys are stored separately in the browser's identity storage. These measures protect different parts of the service; end-to-end encryption of session content does not mean that all account or billing data is end-to-end encrypted. We limit access according to the function being performed and maintain measures appropriate to the information and risks involved.
No internet service or endpoint can guarantee absolute security. Protect your credentials and devices and authorise only trusted participants. Report a suspected personal-data incident to [email protected]. We will make notifications to affected people or authorities where required by applicable law.
15Children and sensitive information
A short privacy guide for younger users
Remoqa lets people connect to devices. Ask a parent or guardian to help you understand it and choose safe settings. Here is what happens to your information:
- When you make an account, we keep details such as your name and email. We also use device and connection details, including an approximate location from your internet address, to run the service and protect accounts.
- A person you let connect may see or control what you share on your device. Only allow someone you trust. We forward encrypted live-session content and do not keep server recordings of it. Messages or pictures you send to support are separate and can be read to help you.
- You can contact Remoqa with your privacy questions. Companies that host the service and deliver messages also process information. Some information is stored or accessed in other countries, including Singapore; section 11 explains the locations.
- We use information to provide the service and keep it safe, and sometimes to meet legal duties. Some uses need your permission or a parent's permission under the law. Reading this notice does not give that permission.
- The website currently starts Google Analytics when a page opens and has no button to accept or refuse it. Analytics collects information about your visit. The Cookie Policy explains the browser controls available to you.
- Closing your account does not immediately erase its profile. The usual restoration period after you close it is five years. You can ask us to delete it sooner. Some records may need to be kept for legal or security reasons; we will explain what applies.
- You or a parent or guardian can ask to see, correct or delete your information, object to its use, or withdraw permission by emailing [email protected]. We will explain how we handle your request. Section 13 explains your rights and how to complain to a privacy authority.
- We update this notice when needed and tell you about important changes as described in section 17. Contact [email protected] if anything is unclear.
The following information gives parents and guardians more detail about permission and sensitive information.
Minors may use Remoqa with permission from a parent or legal guardian where local law permits, subject to the requirements in our Terms of Service. Parents or guardians are responsible for permitting and supervising that use. Remoqa does not provide a dedicated in-product process for collecting or verifying parental permission to use the Services. This family permission is separate from the lawful basis or consent required for processing a child's personal data. Where applicable law requires Remoqa to obtain or verify parental consent for a particular processing activity, that activity may take place only after the requirement is met. Acceptance of the Terms does not itself constitute consent to optional analytics or other processing requiring a separate choice.
Where GDPR rules on consent for online services offered directly to children apply, the age below which parental authorisation is required is set by the relevant country between 13 and 16. That rule concerns consent-based processing; it is not a universal account-age rule or proof of capacity to purchase. Other countries may impose different requirements. A parent or guardian can contact [email protected] about a child's use or data. We will assess requests concerning missing required consent or unlawful processing and restrict the relevant processing or erase data where required.
Remote content and support attachments may contain health, financial, biometric or other sensitive information even when we do not request it. Share only what is necessary and lawfully authorised. Do not include passwords, full card credentials or unrelated sensitive information in a support request. An organisation processing sensitive data through Remoqa must identify the additional legal condition and safeguards applicable to its activity; ordinary contract acceptance does not remove those requirements.
16Automated controls
Automated service checks verify credentials and device identity, limit repeated requests, apply plan quotas and determine whether a connection or renewal can proceed. A failed check may temporarily block an attempt, deny a connection or leave a purchase or renewal pending. These are service-access and billing rules, rather than decisions based on an assessment of your personality or behaviour for advertising. If a check affects you incorrectly, contact [email protected] for review by a person. Any additional rights concerning solely automated decisions with legal or similarly significant effects remain available under applicable law.
17Changes and contact
We may update this policy when the Services, processing activities or applicable requirements change. We will post the updated policy with its effective date and notify account holders by service email about material changes. Where a new purpose or activity requires consent or another legal condition, we must meet it before starting that processing. A notice of a change does not itself supply consent.
For questions or requests, contact our General Director at [email protected]. The Terms of Service, including the software licence and payment terms, are available at remoqa.com/pt/terms/.