Privacy policy

1.Who we are

Vitalnodo (vitalnodo.com) is an online service (the "Service") that lets IT technicians and managed service providers ("MSPs") install an agent on the machines they manage, see their health and security status, organize them by client and receive alerts.

The Service is operated by Karim Boulares, an individual domiciled in Tegucigalpa, Honduras ("we"). Contact for privacy matters and for exercising your rights: privacidad@vitalnodo.com.

We also offer the Service to people in Peru and other countries. That's why, in addition to Honduran law, we apply Peru's Personal Data Protection Law 29733 and its Regulations (DS 016-2024-JUS) to the processing that affects them and, where applicable, the European Union's General Data Protection Regulation (GDPR).

2.Our two roles

We process two types of data, in different roles:

3.What data we process

3.1. Account data

• Name, email and company name (at sign-up or in the invitation).
• Password: we never store it in the clear. We store a cryptographic digest (salted PBKDF2-SHA256).
• If you turn on two-step verification (TOTP 2FA), the TOTP secret, stored encrypted.
• Role in the account (owner, administrator, technician or read-only), the clients you have access to and whether you want to receive alerts by email.
• Sign-up and last access dates, failed attempt counter and temporary lockouts.

3.2. Usage and security data

• IP address and browser (user agent) of each signed-in session.
• Audit log of sensitive actions: sign-ins and sign-outs, 2FA turned on or off, invitations, enrollment keys, machines added, approved and removed, icons uploaded and deleted, plan and settings changes, exports and deletions, with the IP they were made from.
• When a machine is enrolled, the public IP the agent connected from is recorded in the audit log.
• Technical operation and error logs generated by our infrastructure provider (they may include the IP and the requested address). We only use them to diagnose failures and they are kept for a limited period.

3.3. Billing data

Payments are processed by Gumroad, which acts as reseller and merchant of record. We don't receive or store card data. From Gumroad we receive and store only what is needed to apply your plan: sale, subscription and product identifiers, the plan and number of machines purchased, subscription status, end date and the purchase license (stored encrypted, together with a cryptographic digest that prevents linking it to two accounts).

3.4. Data you upload about your clients

Client names, notes, tags, names you give to machines, additional alert emails and icons to identify machines (PNG, JPEG or WebP images of up to 256 KB). We ask you not to include sensitive data (health, opinions, data about minors, etc.) in these fields and not to upload photos of people or images containing personal data as icons.

3.5. Technical data collected by the agent

When it enrolls, the agent sends: computer name, operating system and version, platform and architecture, agent version, the machine's own public key and a cryptographic digest (SHA-256) of the machine identifier (never the raw identifier).

After that, every minute, it sends a report with:

• CPU, memory and swap usage; total memory; number of cores; load; number of processes (just the number); uptime and boot time.
• CPU model, manufacturer, model and serial number of the machine (if the system exposes it) and the machine type (laptop, desktop, server, virtual machine, etc.).
• Number of open user sessions (not the user names).
• Local IP addresses and MAC addresses; network adapter name, speed and status; traffic per interface (bytes received and sent per second).
• Disk volumes (name or letter, file system, capacity, free space and % used).
• Sensor temperatures and the SMART status of the disks (checked every 30 minutes).
• Whether a reboot is pending, and technical notes from the agent (for example, "sensors not available").

In addition, every 6 hours, the agent sends the machine's security posture, read-only (it changes nothing on the machine):

• Antivirus or EDR detected: product name, whether it is active, whether it has real-time protection, whether it is up to date, and the date and version of its signatures.
• Firewall: whether it is on, per profile.
• Disk encryption: whether it is on, the method and the encrypted volumes.
• System pending updates (checked every 12 hours): total number and number of security updates. The agent doesn't install them or force a check.
• Operating system: family, name, version, build and edition (for example, Professional or Enterprise).

With that data the Service calculates security alerts (for example, antivirus missing, disabled or out of date, pending security updates or an unsupported operating system). To know whether a system version is still supported, the Service checks a public catalog of end-of-support dates (endoflife.date). No data about your machines is sent in that check.

Some of this data (computer name, serial number, IP, MAC) can indirectly identify the person using the machine, so we treat it as personal data. The security posture describes the machine, not the person, but we treat it as the Customer's confidential information because it can reveal weaknesses. There is a simpler explanation, with a real example, in The data Vitalnodo collects.

3.6. What the agent doesn't collect

The agent doesn't collect or send: files or their contents, file or document names, emails or messages, browsing history, keystrokes, screenshots, audio or video, passwords, GPS location, session user names, or the list of processes with their arguments. Nor does it collect the list of installed programs, except the antivirus products in section 3.5.

Remote access. Vitalnodo's design includes a future remote access feature (terminal and desktop). In the current version it is turned off: the distributed agent doesn't contain that feature and the Service rejects it. If it is turned on in the future, it will be subject to additional terms and to a prior update of this policy, which we'll tell you about before it applies.

3.7. Cookies and local storage

• fd_s cookie: strictly necessary to keep your session. It is HttpOnly, Secure and SameSite=Lax, and it expires after 14 days at most or when you sign out. Because it is strictly necessary, it doesn't require consent.
• lang cookie: only if you choose a language with the ES | EN selector or follow a link from the English site; it remembers your choice (es or en) for 1 year. It doesn't identify anyone and doesn't require consent.
• Browser local storage: only to remember your theme preference (light or dark), your language and whether you closed the "Install app" notice.
• Installable app: the browser keeps a copy of the app's static files (code, styles, fonts and icons) to open it faster and show an "Offline" page. That copy never stores data about your account or your machines.
• We don't use advertising cookies or third-party analytics tools.

3.8. Browser notifications (optional)

If you turn on notifications on a device (Settings › App & notifications), we store the delivery address (endpoint) your browser gives us and the public keys used to encrypt the notifications, a summary of the browser and system (for example, "Chrome · Android"), the date it was added, the date of the last delivered notification and which types of notification you want to receive.

Notifications are carried by your browser's push service: Google (Firebase Cloud Messaging) in Chrome, Edge for Android and other Chromium-based browsers; Apple in Safari; Mozilla in Firefox; and Microsoft in Edge for Windows. They are end-to-end encrypted: that service sees the delivery address, the time and the size, but not the content, which is limited to the machine name and the type of alert.

To remove them: click "Turn off on this device" or "Remove" in Settings › App & notifications, sign out on that browser or block the site's notifications in the browser. If the push service tells us that the subscription no longer exists, we delete it.

4.What we use the data for and on what legal basis

We don't sell personal data, we don't use it for advertising and we don't make automated decisions with legal effects about you. A machine's "health", "alerts" and "security posture" are calculations on the machine's technical data, not assessments of people.

We don't send you marketing communications. If we ever want to, we'll ask for your consent first where the law requires it, and you'll be able to withdraw it at any time.

5.Who we share data with

We use these providers to deliver the Service. The full, up-to-date list, with links to their policies, is in Subprocessors.

Gumroad processes payment data under its own privacy policy, because it is the one selling you the subscription. Gumroad doesn't receive data about your machines.

We may also disclose data to authorities when a regulation or a valid order requires it. Where the law allows, we'll let you know beforehand.

6.International transfers

Our providers process data mainly in the United States and, in Cloudflare's case, also across its global network. For users outside the USA, this is an international transfer (in Peru, a cross-border flow under art. 15 of Law 29733; in the European Economic Area, a transfer under Chapter V of the GDPR).

• We choose providers that take on data protection obligations by contract. Cloudflare offers a processing agreement with the European Commission's standard contractual clauses and states that it is certified under the EU-U.S. Data Privacy Framework. Gumroad states that it uses standard contractual clauses for transfers from the EEA.
• For users in Peru, the cross-border flow is necessary to perform the contract you enter into with us and goes to recipients that take on equivalent protection obligations by contract, in accordance with Law 29733 and its Regulations.

7.How long we keep data

When the account is deleted (by the owner from the app, with password and, if enabled, a 2FA code), we immediately delete from the database all the account data, its users, clients, machines, metrics, alerts, audit log and subscription data; we delete the uploaded icons, and the agents are no longer accepted. Only a record of the deletion is kept in the audit log (account identifier, user, IP and date) for 400 days, as proof of the action.

Automatic database recovery backups may keep deleted data for up to 30 days before it disappears. Emails already sent and Gumroad's billing records are subject to those providers' retention and to the applicable legal obligations.

8.Security

We apply technical and organizational measures proportionate to the risk. Among them:

• All communication with the Service is encrypted (HTTPS/TLS). The agent only opens outbound connections and exposes no ports.
• Each machine has its own Ed25519 key pair and signs every submission. Our database only stores public keys and cryptographic digests of enrollment keys and sessions, never a reusable secret in the clear.
• Salted PBKDF2-SHA256 passwords; encrypted 2FA secret and purchase license; two-step verification available; lockout after failed attempts.
• Strict separation between accounts: every query is limited to the session's account, and each icon is only served to the account that uploaded it.
• Audit log of sensitive actions and security notices by email.

The details are on our Security page and in Annex II of the Data processing agreement. No system is infallible. If an incident affects your data, we'll tell you without undue delay and notify the authority when the law requires it. We don't claim any security certifications of our own (such as ISO 27001 or SOC 2).

9.Your rights and how to exercise them

Under the applicable law, you can exercise the rights of information, access, rectification (updating and inclusion), cancellation (erasure) and objection ("ARCO rights") and, where applicable, data portability, restriction of processing and withdrawal of consent.

From the app

You can correct your name and email, change your password, manage 2FA, delete icons and, in Settings › Privacy & data, export the account data as JSON (owner and administrators) and delete the account (owner).

By email

Write to privacidad@vitalnodo.com stating which right you are exercising and attaching what is needed to verify your identity. We don't charge for handling reasonable requests.

Deadlines

We reply within the applicable legal deadlines: for data subjects in Peru, those of the Regulations of Law 29733 (DS 016-2024-JUS); for users in the European Economic Area, one month (art. 12.3 GDPR). Our goal is always to reply within 10 business days at most.

Technical machine data

If your request concerns a machine managed by a technician or a company, that Customer will handle it, because it is the one deciding about that data. We'll forward your request within 5 business days at most and help them respond.

Complaints

If you aren't satisfied with our reply, you can contact:

• Peru: the National Authority for Personal Data Protection (Ministry of Justice and Human Rights).
• Honduras: to the best of our knowledge as of this version, there is no general personal data protection law in force. You can bring the habeas data action recognized in art. 182 of the Constitution.
• European Economic Area: the supervisory authority of your country of residence.

10.Minors

Vitalnodo is a professional service for people over 18. We don't target minors and we don't knowingly collect data about minors in accounts. If we detect an account belonging to a minor, we'll delete it.

Monitored machines may be used by minors (for example, at a school). The agent only collects the technical data in section 3.5, never data about their activity. It is up to the Customer to have the machine owner's authorization and, where appropriate, to inform the users.

11.Users in the European Economic Area and the United Kingdom

If you are in the EEA or the United Kingdom, the GDPR (or the UK GDPR) also applies to you. We are not established in the European Union. If the regulations require us to appoint a representative in the Union (art. 27 GDPR), we'll publish their contact details here.

12.Changes to this policy

We may update this policy. If the changes are significant (for example, new categories of data, new purposes or turning on remote access), we'll let you know by email or in the app at least 30 days in advance. The date of the last update is shown at the top of this page.

13.Contact

Controller

Karim Boulares · Tegucigalpa, Honduras

Privacy and rights

privacidad@vitalnodo.com

General contact

hola@vitalnodo.com