Privacy Policy

This policy explains what information MyTeamPoint ("we", "us") collects when you use myteampoint.com and the MyTeamPoint service (the "Service"), how we use it, and the choices you have. The short version: we collect what we need to run the Service for you, we don't sell your data, and your devices stay yours.

1. Information we collect

Account information

Your name, your email address and, if you sign in with your phone, your phone number, plus any profile details you add. If you sign in with Google or your team uses single sign-on, we receive basic identity details from that provider.

Billing information

Payments are processed by Stripe. We receive your subscription status, plan and invoice history; your full card details are held by Stripe, not by us.

Device details

To connect a device we store what the agent and our relay need: the device's name, its certificate and its system, plus status information such as whether it is online, CPU, RAM, disk, uptime and who is logged in. During a session the relay carries traffic between your browser and your device. We do not browse or copy the contents of your devices beyond what a session you open shows you.

Usage and operational data

The audit log of sessions (who opened which device, and when) that you and your workspace admins see, device and browser information, and diagnostics that help us keep the Service reliable and secure.

Support communication

Messages you send to support@myteampoint.com and our replies.

Help desk contacts and e-mail

When you or your organization use the help desk, we store the tickets, their messages, notes and time entries, and the contacts they name: a name, an e-mail address, a phone number if one is added, and the devices that person uses. A technician's public reply is e-mailed to the contact. Once our mail receiver is switched on, mail sent to a ticket's reply address or to an organization's support mailbox is received by our own mail server, which keeps the sender, the message, its attachments and the results of the sender checks (SPF, DKIM and DMARC). Mail from a sender we do not know is held for a technician to accept.

Chat with the person at a computer

A chat between a technician and the person at a computer is stored with its messages, the names shown, when each message was delivered and read, and a screenshot only when the person attaches one. When the chat ends, its transcript is saved on a ticket.

Sound and files in a remote session

During a remote session the computer's sound and the files passed in either direction travel between the computer and the viewer's browser, sealed like the picture. We do not keep the sound or the content of a file. The audit log records each file's name, size, fingerprint (SHA-256), direction, who was connected and how the transfer ended.

Network scans

When an organization scans an office network, the managed computer it chose as the scanner reports what it found on the private addresses it was asked to scan: addresses, hardware addresses and their makers, names, open ports and, where a read-only SNMP login is given, a device's system name and description. Before the first scan an administrator confirms that the organization may scan these networks; we keep who confirmed it, when, and the wording they agreed to. SNMP logins are stored encrypted and never shown again.

AI assistants

If you connect an AI assistant with a key you make for it, or with a browser sign-in (OAuth) you approve, the assistant reads through that key or sign-in what your role lets you read, and nothing else. What it reads leaves our servers for the assistant you chose and its provider, under your agreement with them. What an assistant proposes is stored as a draft until a person approves or refuses it, and every call is recorded in the audit log with the key or the app and the assistant's name. You can revoke a key or an app at any time. We never receive or store the questions you ask your own assistant.

Billing your clients

When you bill your clients, we store your business details and logo, each client's billing details (legal name, address, tax number, currency, language and billing contacts), the quotes, invoices, credit notes, payments and contracts you make, and the time and charges they bill. An issued document is frozen and never changed afterwards. We e-mail a document to the contacts you choose, with a link and the PDF, and keep a record of each e-mail for 30 days. A link opens that one document only, can be withdrawn at any time and stops working when it expires; the name a client types to accept a quote is kept with the quote.

Online payments (Stripe Connect)

If you link your own Stripe account to take card payments, your clients pay on Stripe's page into your Stripe account, under your agreement with Stripe; card details go to Stripe and never reach us. Stripe tells us the payment, refund or dispute of each invoice, and we keep your Stripe account's id, its status, those events for 90 days and the payments they recorded. A card is saved for a contract only when the client ticks the consent, and we keep when they did. MyTeamPoint takes no fee and holds no money for you.

Appointments and booking pages

Appointments keep their time, place, type, the technicians, the organization, ticket or device they are about, and the people invited, who receive invitations by e-mail. Someone who books through your booking page gives a name, an e-mail address and an optional message, and confirms the address with a code we e-mail; we keep a fingerprint of their network address, not the address itself, for 2 days to limit abuse. A private calendar address shows a person's own appointments in their calendar program, without notes, contacts or devices.

Microsoft 365 and Entra ID

When a client's Microsoft 365 is connected, an administrator of that tenant signs in and allows the IT provider by name on our page. We then read the tenant through Microsoft Graph, read only, under the consent that administrator gave to our app: the organization's name and domains, licenses, users (name, sign-in name, e-mail, whether enabled, member or guest, licenses), groups (without members), devices, administrator roles, how sign-in is protected (multi-factor registration, security defaults, Conditional Access, Secure Score) and, where the tenant's license allows, the last sign-in. It is read every 6 hours. Licensed staff can become contacts of the organization. Nothing in the tenant is changed.

Antivirus consoles

When you connect a client's antivirus console (Bitdefender GravityZone or Sophos Central) with credentials made in that console, we store the credentials encrypted and never show them again, and read the console's endpoints, their health and their detections. Detections become threats on the matching devices. We never change anything in the console.

Security assessments

An assessment is a dated snapshot of what MyTeamPoint already holds about an organization's devices, updates, antivirus, network and Microsoft 365, with findings and recommendations; we never scan a client's internet addresses for it. A summary a person approved can be added. Shared with a client, it is reached through a link sent by e-mail that works 30 days and can be withdrawn.

The MyTeamPoint AI assistant and AI features

AI is off in a workspace until its owner or an admin switches it on after reading what is sent. Then a question, or a use of an AI feature (a ticket summary, a reply or triage suggestion, a script, report or rule from a sentence, an alert explained, an assessment summary), sends what it needs to the AI provider we chose for the Service, OpenAI or Anthropic, which processes it for us to write the answer: device facts, alerts, ticket text, report and assessment content, names of organizations and devices, and the person's own words. Passwords, keys and tokens are removed before anything is sent; contacts' e-mail addresses and phone numbers are replaced by placeholders unless the workspace allows them; files, screens and the bodies of scripts are never sent. We ask both providers not to keep this data where they offer that. Conversations are kept 30 days, or what the workspace chose between 7 and 90 days; what an AI feature wrote is kept 90 days as the record of what a person applied; the audit log records the model, the tokens and the tools used, never the question. The AI writes drafts and suggestions only: a person approves every change.

2. How we use information

• To provide the Service: connecting your devices, showing their status and stats, and brokering your sessions.
• To operate accounts and billing: sign-in codes, invoices and plan limits.
• To keep the Service secure: fraud and abuse prevention, audit logs, incident investigation.
• To improve the Service: aggregate, de-identified usage patterns.
• To communicate with you: service notices, security alerts and replies to your requests.

We do not sell your personal information.

3. Cookies and analytics

There are two kinds of storage on this site, and they are treated differently.

Essential storage. Keeps you signed in and remembers your preferences, including your answer to the cookie question. The site cannot work without it, so it is always on.

Analytics. We use Google Analytics 4 (measurement ID G-KTD0C7RC9C) to count visits and see which pages people find useful. It records the pages you open, roughly where in the world you are, and which browser and device you used. It does not read anything on your devices, and we do not use it for advertising.

Analytics sets two cookies, _ga and _ga_KTD0C7RC9C, which stay for up to two years unless you clear them.

Your choice. If you are in the European Economic Area, the United Kingdom or Switzerland, analytics stays switched off until you agree. Everywhere else it starts on and you can switch it off. Either way you can change your mind at any time using the Cookie settings link in the footer. Saying no changes nothing about how the site works.

We run no advertising, no ad-personalisation and no cross-site tracking, and those Google signals stay switched off whatever you choose. Our fonts are served from our own servers rather than a font CDN, so loading a page does not hand your IP address to a third party.

4. When we share information

We share personal information only with:

• Service providers that help us run the Service - payment processing (Stripe), email and text message delivery, hosting, the AI providers OpenAI and Anthropic for the AI features of a workspace that switched them on, and Google Analytics where you have allowed it - under agreements that limit how they may use it;
• Your workspace, where you join a workspace: other members and admins can see your activity in the shared audit log;
• AI assistants you connect, when you connect one: what your key lets it read goes to that assistant and its provider;
• Services you connect, when you connect them: your own Stripe account for the payments your clients make, Microsoft for the Microsoft 365 tenants your clients connect, and the antivirus consoles you connect, as described above;
• Authorities, where the law requires it; and
• A successor, if we are involved in a merger or acquisition, in which case this policy continues to apply.

The help desk, its mail receiver, chat, sound and file transfer, network discovery, invoices and contracts, the calendar and booking pages, security assessments and the endpoint for AI assistants run on our own servers. Beyond the providers and services named above, they add no service provider.

5. Retention

We keep your information while your account is active. When you delete your account, or remove a device, we delete the associated data within a reasonable period, except where we must keep it for legal, billing or security reasons (for example invoices and audit records).

Some records have their own periods:

• Tickets with their messages, notes, time entries, attachments and chat transcripts: a year after the ticket is resolved or closed.
• Report files: 30 days.
• Check results: 90 days on Business, 30 days on a personal plan.
• Security score history (devices and Microsoft 365): 13 months on Business, 90 days on a personal plan; threats from Microsoft Defender or an antivirus console: a year after they ended.
• Devices found by a network scan: 90 days after they were last seen.
• Drafts proposed by an API key or an AI assistant: decided or expired within 7 days, removed 90 days later.
• Records of remote sessions: a year.
• Quotes, invoices, credit notes, payments and contracts: while your workspace exists, because tax law usually requires you to keep them; the record of each document e-mailed to a client: 30 days.
• Links to shared documents: an invoice's or quote's link until 90 days after it is paid, accepted, declined or void; an assessment's link 30 days; the record of every link removed a year after it stops working.
• The limits of a booking page (a fingerprint of the network address): 2 days.
• Microsoft 365 users, groups and devices: 30 days after they leave the tenant; everything read from a tenant: 30 days after it is disconnected.
• Security assessments: 2 years; one that failed: 30 days.
• AI conversations: 30 days, or what the workspace chose between 7 and 90 days; what an AI feature wrote: 90 days; the monthly count of AI messages and tokens: about 13 months.

6. Security

We protect your data with encryption in transit, a certificate for every device and mutual TLS connections, short-lived single-use session tokens, access controls and audit logging. No system is perfectly secure, so we also encourage you to protect the accounts you use to sign in and to share devices with the least access people need.

7. Your rights

Depending on where you live, you may have rights to access, correct, export or delete your personal information, and to object to or restrict certain processing. You can exercise most of these directly in the app (Account settings), or by emailing support@myteampoint.com. We respond to all requests consistent with applicable law.

8. International transfers

Our infrastructure and service providers may process data in countries other than yours. Where required, we use appropriate safeguards for such transfers.

9. Children

The Service is not directed at children under 16, and we do not knowingly collect their data.

10. Changes to this policy

We may update this policy from time to time. If a change is material we will notify you, for example by email or a notice in the app, before it takes effect.

11. Contact

Privacy questions or requests? Email support@myteampoint.com.