This policy says what personal information SpoolStream collects, why, who sees it, where it is kept, for how long, and what you can ask of us. SpoolStream is operated from Québec, Canada. The person in charge of the protection of personal information is the operator of the service, reachable at [email protected].
1. Two roles
For the people who use the service (their email, name and sign-in details), we decide why and how the information is used: this policy covers that. For the documents and data your organization sends through the service, your organization decides, and we process them for it: that is covered by the data processing addendum.
2. What we collect
- When you register. Registration in the dashboard asks for an email address and a name for your organization, and sends a code to confirm the address.
- When you sign in. The dashboard signs people in with email and password plus a one-time code, with Google, or with Microsoft Entra ID, and an organization can require its own single sign-on. Roles are owner, admin, operator and viewer. Signing in with Google or Microsoft gives SpoolStream the person's email address, name and account identifier at that provider; no token from the provider is kept.
- When you use the service. The jobs and documents your applications send, the printers and computers you connect, and the settings you choose. The agent tells the service the computer's name, its operating system and architecture, the agent's version, and the printers it can reach (queue name, print server and driver).
- The record of what happens. Each audit entry records who acted (a person, an API key or an agent), what was done, when, and the caller's network address and browser or client name; it never records a password, a token or a document.
- When you pay. Payment cards are entered on Stripe's own pages: no card data reaches SpoolStream. Stripe receives a customer record carrying the organization's identifier, and one total per counted quantity for each closed period.
- On this website. This website sets no cookie, runs no third-party script, loads no font or image from another site, and has no analytics of its own.
We do not sell personal information and we do not use it for advertising.
3. Why we use it
To create and secure your account, to run the service you asked for (printing, history, reports, notices), to bill when billing exists, to keep the service safe and to answer you. We do not use it for anything that you would not expect from those purposes. Where the law requires your consent, you give it by registering and using the service, and you can withdraw it by closing your account.
4. Who can see it
- Our subprocessors, who host and run the service for us. They are listed, with what each receives and where, on the subprocessors page.
- The service has no operator console, no platform administrator screen and no way for its staff to sign in as a customer. Operator tasks (setting a plan, linking a billing customer) are one-off commands run with the database owner's login, which row-level security does not restrict; each change they make is recorded in the organization's audit trail.
- Authorities, when the law requires it, after we check that the request is valid.
5. Where it is kept
The hosted service runs in Toronto on DigitalOcean (App Platform for the application, managed PostgreSQL for the database), with Cloudflare for its domain name and Cloudflare R2 for documents. Payments through Stripe and monitoring on Grafana Cloud are planned and not switched on. The application and the database run in Toronto, Canada. The region of the document store is not chosen: the store (Cloudflare R2) gives no guarantee that documents stay in Canada. Some providers are established in the United States or elsewhere, so personal information can be handled outside Québec and outside Canada. We choose providers that protect it and we sign their data processing terms.
6. How long we keep it
- By default a document is deleted from storage 24 hours after its job ends, and 168 hours (7 days) after a failed one, and never while the job is in progress or uncertain.
- A job's record and its history outlive the document and are kept for as long as the organization exists; no separate retention period applies to them yet.
- An organization's audit trail is kept 7 years by default (its owner can choose 1 to 25). Security events that belong to no organization are kept one year.
- Webhook delivery records are trimmed 30 days after the delivery finishes.
- Daily statistics of each organization's jobs (counts by state and printer, no document) are kept 25 months; the usage ledger is kept until the organization is erased.
- A registration that is never verified is deleted after 24 hours.
- Removing a member deletes that person's account, sign-in methods and second factor; the jobs they sent stay with the organization and the audit trail keeps the account's identifier.
- Deleting an organization erases everything, jobs and their history included, 30 days after the owner asks; the owner can restore it during those 30 days. One thing is kept: if the organization was billed through Stripe, its Stripe customer number, with the date of the erasure and nothing else of the customer in our database, so that a late message from Stripe is recognised and ignored. When the erasure is carried out, the organization's subscriptions at Stripe are cancelled, so Stripe stops billing it; that number is never linked to an organization again.
- After an erasure, SpoolStream keeps a security event that names the erased organization, for one year. The link to the organization's customer record at Stripe is deleted with the organization; only the Stripe customer number is kept, with the date of the erasure, while Stripe keeps its own record.
7. How we protect it
- Every table that holds a customer's data carries the organization's identifier, a filter in the application and PostgreSQL row-level security. Our integration tests prove that organization B cannot read or change organization A's data, and receives 404, not 403.
- API keys and agent credentials are stored only as a keyed hash (HMAC-SHA256 under a secret pepper). A lost key is replaced, never recovered.
- Second-factor secrets, recovery codes and webhook signing secrets are stored encrypted (AES-256-GCM) under a key kept in the secret store, not in the database. Passwords are stored only as a hash made by ASP.NET Core Identity.
- After 5 failed sign-in attempts an account is locked for 15 minutes, and one-time codes count toward the same limit. An organization cannot yet require its members to use a second factor. A dashboard session ends after 8 hours without activity, and after 7 days at most.
- Our rule is that document bytes, file names and external references never appear in logs, traces, exceptions, diagnostics, webhook delivery logs or the audit trail.
The security page has the rest. If an incident puts your personal information at risk of serious harm, we tell the people concerned and the authorities as the law requires, and we tell our customers without undue delay and at the latest 48 hours after we become aware of it.
8. Your rights
You can ask us for access to the personal information we hold about you, to correct it, to delete it, or to receive it in a usual format. Write to [email protected]. We answer within 30 days. A member of an organization can also be removed by an owner of that organization. For information in documents that your organization sent us, ask your organization first: it decides.
If you are not satisfied, you can complain to the Commission d'accès à l'information du Québec, or to the Office of the Privacy Commissioner of Canada. If you live elsewhere, you can complain to your own authority.
9. Cookies
This website sets no cookie, runs no third-party script, loads no font or image from another site, and has no analytics of its own. The dashboard uses only the cookies it needs to keep you signed in: see the cookie notice.
10. Children
SpoolStream is a business service. It is not meant for people under 18, and we do not knowingly collect their information. If you think a child has registered, write to us and we will delete the account.
11. Changes
When we change this policy in a way that matters, we tell the owners of each organization by email at least 30 days before. The date at the top of this page is the date of the last update.