The short version. We collect what we need to run your account and the syncs you configure, and nothing more. Your directory data belongs to your organization: we process it on its behalf, never sell it, never use it for advertising and never use it to train AI models. Google Analytics runs only on our public pages and only if you accept it; the app itself has no tracking.
1. What does this policy cover?
This policy explains how AnySCIM (“AnySCIM”, “we”, “us”) processes personal data when you visit anyscim.com, create an account, use the AnySCIM Service described in our Terms of Service, or contact us. It is written to meet the EU General Data Protection Regulation (“GDPR”) and the Italian Personal Data Protection Code (Legislative Decree 196/2003), together with other privacy laws that apply.
2. Controller or processor?
It depends on the data:
- We are the controller of the data about people who visit our website, create an AnySCIM account, pay for a subscription or contact us. We decide why and how that data is processed, and this policy describes it.
- We are a processor of the directory data that our customers sync through AnySCIM: the users, groups and organizational units read from their Google Workspace, and the sync history and audit logs about them. Here the customer organization is the controller and decides what is synced and where. We process this data only on its instructions, under our Terms of Service and, on request, a data processing agreement. If you are an employee whose account is provisioned by AnySCIM, please contact your employer about your data first; we’ll help them answer you.
3. What data do we collect?
Account data
When you sign up or accept an invitation: your name, your work email address and a password, which we store only as a salted scrypt hash. We also keep the organizations you belong to, your role in each, invitations you send or receive, and whether you verified your email.
Security and session data
For each signed-in session: the IP address and browser user agent, and when the session was created and last used. We record failed sign-in attempts so we can temporarily lock an account under attack. Our servers and hosting provider also keep technical logs of requests, including IP addresses.
Billing data
If your organization subscribes, Stripe collects the payment details directly; your card number never reaches AnySCIM. We store the Stripe customer and subscription identifiers, the plan, the subscription status, and the number of active users in your directory, which determines your plan.
Directory data processed for customers
To run the syncs a customer configures, AnySCIM reads from Google Workspace, with read-only access, the following data about the people in the customer’s directory: name, primary email address, user ID, account status, organizational unit, job title, department, cost center, organization and division, employee number, work, mobile and home phone numbers, and group memberships. Only the fields a customer’s mappings use are sent to each Vendor. We keep a snapshot of the directory to detect changes, plus a history of each sync and an audit log of every SCIM request and response. We never read or store directory users’ passwords.
Connection credentials
The Google Workspace authorization and the SCIM tokens or client secrets you enter for each Vendor. They are encrypted at rest.
Communications
When you email us, we keep your message, your address and our replies so we can help you.
Website analytics
Only if you accept analytics cookies on our public pages: pseudonymous usage data collected by Google Analytics, such as pages viewed, approximate location derived from your IP address, device and browser type, and how you arrived on the site. See section 12.
4. Why do we use it?
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and running your account and organization, and providing the Service | Account, session, credentials | Contract (Art. 6(1)(b) GDPR) |
| Running the syncs a customer configures | Directory data, credentials | On the customer’s instructions, as its processor (Art. 28 GDPR) |
| Billing, invoicing and enforcing plan limits | Billing, account | Contract (Art. 6(1)(b)); legal obligation for tax records (Art. 6(1)(c)) |
| Service emails: verification, password reset, invitations, security and billing notices, changes to our terms | Account | Contract (Art. 6(1)(b)) |
| Keeping the Service secure and preventing abuse and fraud | Session, security logs, account | Legitimate interests (Art. 6(1)(f)) |
| Answering support requests and questions | Communications, account | Contract (Art. 6(1)(b)) or legitimate interests (Art. 6(1)(f)) |
| Measuring visits to our public pages | Website analytics | Consent (Art. 6(1)(a)), which you can withdraw at any time |
| Complying with the law and defending legal claims | Any relevant data | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
We don’t sell personal data, we don’t use it for advertising or profiling, and we don’t use any of it to train AI models. We don’t send marketing emails; if we ever do, we’ll ask first where the law requires it.
5. Who at AnySCIM can see my data?
Directory data, sync history and audit logs are visible to the members of the customer organization in the dashboard. Our staff access them only when it is necessary: to answer a support request you made, to investigate a security incident or a breach of our terms, or when the law requires it. Access is limited to the people who need it and to the time it takes.
6. Who do we share it with?
We share personal data only with the following recipients, and only as much as each one needs:
- Hosting and infrastructure. Our cloud hosting provider runs our servers and databases and stores our backups and logs.
- Email delivery. The provider that sends our transactional emails receives the recipient address and the content of each email.
- Stripe processes payments and subscriptions. Stripe is an independent controller for the payment data it collects; see its privacy policy.
- Google. AnySCIM calls the Google Workspace APIs on your organization’s behalf. If you accept analytics cookies, Google Analytics receives the website analytics described above. Our pages also load fonts from Google Fonts, which receives your IP address and browser details to deliver them.
- Vendors you connect. AnySCIM sends directory data to the SCIM endpoints the customer configures, as instructed by the customer. Each Vendor processes it under its own terms with the customer.
- Professional advisers and buyers. Our lawyers and accountants where needed, and a buyer or successor if AnySCIM is involved in a merger, acquisition or sale of assets, in which case this policy continues to protect your data.
Our service providers act as our processors, under contracts that require them to protect the data and use it only to provide their services to us.
7. Requests from authorities
We disclose personal data to public authorities only when we are legally required to, or when it is necessary to protect the rights, property or safety of our users, the public or AnySCIM. We review every request and push back on those that are overly broad or lack a valid legal basis. Unless the law prohibits it, we’ll tell the affected customer before disclosing its data.
8. International transfers
Some of our service providers, including Stripe and Google, process data in the United States or other countries outside the European Economic Area. When personal data leaves the EEA, we rely on an adequacy decision, such as the EU-US Data Privacy Framework for certified companies, or on the European Commission’s Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.
9. How long do we keep it?
| Data | How long |
|---|---|
| Account data | Until you delete your account |
| Sessions, with IP address and user agent | Until you sign out, or at most 30 days |
| Password reset and email verification links | 1 hour and 3 days respectively |
| Invitations | Valid for 7 days; deleted 30 days after they expire or are revoked, unless accepted |
| Directory snapshots, sync history, audit logs and connection credentials | Until the connection or the organization is deleted, or the customer asks us to delete them |
| Billing and invoicing records | As long as tax and accounting law requires (in Italy, up to 10 years) |
| Support emails | Up to 2 years after the conversation ends, unless we need them longer to handle a claim |
| Google Analytics data | Up to 14 months |
Deleted data may persist in encrypted backups for a limited time until those backups expire. After the retention period ends, we delete the data or anonymize it so it no longer identifies anyone.
10. How do we protect it?
- All traffic uses HTTPS, enforced with HSTS, and our pages run under a strict content security policy.
- Passwords are hashed with scrypt and a per-user salt. Session, invitation and reset tokens are random, and we store only their SHA-256 hash.
- Vendor tokens and client secrets are encrypted at rest, with a master key that is never stored in the database.
- Access to Google Workspace uses read-only scopes for users, groups and organizational units.
- Each organization’s data is kept in its own separate store, and only its members can access it.
- Repeated failed sign-ins temporarily lock the account, and sign-in never reveals whether an email address is registered.
No system is perfectly secure. If a personal data breach affects you, we’ll notify you and the competent authorities as the law requires.
11. Your rights
Under the GDPR and similar laws you have the right to:
- access your personal data and receive a copy of it;
- rectify data that is inaccurate or incomplete;
- erase your data;
- restrict processing in certain cases;
- port your data, receiving it in a structured, machine-readable format;
- object to processing based on our legitimate interests;
- withdraw consent at any time, without affecting processing that took place before.
You can do much of this yourself: edit your profile and delete your account from the dashboard, export your organization’s directory and audit log, and, as an owner, delete the organization. For anything else, email us at the address in section 15. We’ll answer within one month, and may need to verify your identity first. When we act as a processor, we forward your request to the customer organization and help it respond.
You also have the right to lodge a complaint with a supervisory authority, in particular in the country where you live or work. In Italy, that is the Garante per la protezione dei dati personali.
12. Cookies and local storage
The AnySCIM app and sign-in pages set no cookies and load no tracking scripts. They use your browser’s local storage only for what is strictly necessary: your session token and details of the current session, and the organization you last selected. Signing out ends the session on our servers and clears them.
On our public pages (the home page, pricing and documentation), we ask before using Google Analytics. Until you click Accept, the Google Analytics script isn’t even downloaded and no analytics cookies are set. If you accept, Google Analytics sets _ga cookies to distinguish visits, with Google signals and ad personalization turned off. We remember your choice in local storage. You can change it at any time with the Cookie settings link in the footer of those pages, and declining deletes the analytics cookies.
13. Children
AnySCIM is a service for businesses and is not intended for anyone under 18. We don’t knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we’ll delete it.
14. Changes to this policy
We may update this policy when the Service or the law changes. The date at the top shows the latest version. If a change is significant, we’ll notify account owners by email before it takes effect and, where the law requires it, ask for consent.
15. Contact
For questions about this policy or to exercise your rights, email sales@anyscim.com with “Privacy request” in the subject.