Privacy Policy

This policy explains how ENACCS Communications Inc. ("ENACCS", "we", "us"), 7901 4th Street North, Suite 300, St. Petersburg, Florida 33702, USA, handles information when you use the DATARMA apps and the DATARMA Cloud service. ENACCS is the controller of the personal information described here.

1. What stays on your device (we never receive it)

• Your files, photos, videos, documents, contacts, text messages and call logs, and their names and contents, unless you choose to back them up to DATARMA Cloud, in which case they are encrypted first (see section 2).
• Your DATARMA password, your recovery key and the part of each shared-vault code made on your device.
• The list of folders you protect and your app settings (kept in the App; a copy sealed with your password and recovery key is kept in your own DATARMA folder and backups).

DATARMA asks for access to your folders, photo library, contacts or (on Android) text messages only to back them up for you, and only when you use those features. You can withdraw access in your device settings at any time.

2. What we receive and why

Information	Why we use it	Legal basis (EU/UK)
Account: username, email address, password verifier (a one-way hash, never the password), two-step-verification secret for DATARMA Cloud	To create and secure your account, sign you in and send service messages such as password resets and security alerts	Contract
Encrypted backups: your files, encrypted on your device, with their sizes and upload dates	To store and return your backups and shared-vault files. We can't decrypt them	Contract
Recovery copy of your key backup, sealed with your recovery key only	So you can restore DATARMA on a new computer with your recovery key. We can't open it	Contract
Shared vaults: vault number, the server part of the code (stored as a hash), who joined, permissions and expiry	To let the people you choose open the vault	Contract
Subscription status: plan, start and renewal dates, store transaction ID	To give you the storage you paid for. Payment card details are handled by Apple, Google, Microsoft or Paddle; we never see them	Contract
Technical logs: IP address, device type, app version, times and errors of requests	To keep the service secure (for example to limit sign-up and password-guessing attempts) and to fix problems. Kept for 90 days	Legitimate interests
Support messages you send us	To answer you	Legitimate interests

We don't use your information for advertising or profiling, and we don't sell or "share" personal information as those terms are defined in U.S. state privacy laws.

3. Who processes it for us

We use a small number of service providers under contracts that require them to protect your information and use it only for us: Amazon Web Services (hosting and encrypted storage, United States); Apple, Google and Microsoft (app stores and in-app billing); Paddle.com (payments for website purchases); RevenueCat (subscription status across devices); and our business email provider. We may disclose information if the law requires it, to protect people's safety or our rights, or as part of a merger or sale of the business (in which case this policy continues to apply). Because your files are encrypted on your device, we can't hand over readable copies of them to anyone.

4. How long we keep it

Account and subscription information: while your account is open. Cloud backups: until you delete them, or 60 days after your subscription ends. When you delete your account, we delete your account information and all cloud backups within 30 days, except records we must keep by law (such as tax records of purchases), and copies in our encrypted server backups, which are overwritten within a further 35 days.

5. Security

Files are encrypted on your device with AES-256-GCM using keys derived from your password, before they leave the device. Two-step verification is required. Connections to DATARMA Cloud use HTTPS. Shared-vault codes are split so that part of every code never reaches our servers. No system is perfectly secure; we will notify you and the authorities of a breach affecting your personal information as the law requires.

6. Your choices and rights

You can see and change your account details in the App, export your backups at any time, and delete your account in the App (Settings › Delete my account) or by emailing support@enaccs.com. Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict its use, and to complain to your data-protection authority. We will not treat you differently for using these rights. To use them, email support@enaccs.com; we will answer within 30 days (45 days where U.S. state law allows) and may need to confirm your identity.

7. Children

DATARMA is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has created an account, contact us and we will delete it.

8. International users

We are based in the United States and store information there. If you use DATARMA from outside the United States, your information is transferred to the United States, protected by the safeguards in this policy and, where required, by standard contractual clauses.

9. Changes

We will post any changes here with a new effective date, and tell you in the App or by email before material changes take effect.

Contact

ENACCS Communications Inc. · 7901 4th Street North, Suite 300, St. Petersburg, Florida 33702, USA · support@enaccs.com