1ARCHIVE Information Security and Data Privacy Policy
1. Introduction
: This Information Security and Data Privacy Policy ("Policy") is issued by Time and Space Technologies, Inc. ("Company", "we", "us", or "our") and applies to all users ("User", "you", or "your") of our licensed 1ARCHIVE software, including the 1ARCHIVE desktop application and web viewer (together, the "Software"). The Company is committed to protecting your privacy, as well as the privacy of your customers, and ensuring compliance with all applicable data protection laws and regulations. This Policy is designed to help the Company fulfill its legal obligations and meet the expectations of our clients and their customers.2. The Software:
1ARCHIVE is a media library platform for creative teams. The 1ARCHIVE desktop application scans the hard drives, network servers, and cloud storage locations that a User adds to the Software and builds a shared, searchable catalog of the files they contain, including file details, compressed image and video previews, and an index that supports AI image search. Once a drive or other storage location has been scanned, the User and the User's team can browse, search, and preview its files even when the original storage is disconnected or offline. The Software also detects backups and duplicates, lets teams organize files into collections and add comments, and lets Users share files and collections with people inside or outside their organization. A companion web viewer lets authorized users view the library from a web browser. Scanning does not upload original files to the Company's servers; original files remain on the storage where the User keeps them. AI image indexing is performed on the User's own device, and the resulting search index, which consists of numerical data and not viewable images, is stored in the cloud so that the User's team can search it. 1ARCHIVE is offered through a free Basic plan with limited features and through paid subscription plans, with optional add-ons such as additional storage, single sign-on, and directory sync. Payments for paid plans are processed through Stripe.3. Guiding Principles
: The Company is dedicated to protecting the confidentiality, integrity, and availability of its information assets and those of our clients and their customers. We commit to using reasonable efforts to comply with applicable information security, privacy, and data protection laws and to safeguard sensitive information from undue risk. We aim to balance the need for business efficiency with the necessity to protect sensitive information, granting access only to those with a legitimate need to know and at the least level of privilege necessary. However, the Company does not guarantee absolute security or compliance due to the inherent risks associated with electronic data and internet usage.4. Data Privacy Policy
a. Compliance with Applicable Laws and Data Protection:
i. The Company collects, uses, maintains, and discloses information in strict adherence to all applicable laws, regulations, and standards, including global data protection and privacy laws such as the General Data Protection Regulation (GDPR) in the European Union and the California Consumer Privacy Act (CCPA) in the United States.
ii. The Company ensures that all data stored and processed through the Software, including any file information and previews generated from files on Users’ drives, servers, and cloud storage that are synced to the cloud, complies with these laws. The Company agrees to implement and maintain appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or disclosure.
iii. Users must ensure compliance with applicable data protection laws concerning the data they store using the Software, including obtaining necessary consents from data subjects. The Company shall not be liable for any loss, unauthorized access, or disclosure of personal data stored using the Software, except to the extent caused by the Company’s gross negligence or willful misconduct. Users acknowledge that storing personal data involves inherent risks and agree to use the Software in compliance with all applicable laws and best practices for data security.
b. Data Collection: The Company may collect and process the following categories of data about you, your team members, and your customers. Personal Data includes identifiable information such as your name, email address, organization name, and payment information that you provide when registering for and using our Software. Payment card details are collected and processed by our payment processor, Stripe, and the Company does not store full payment card numbers. Library Data includes the content and information you add to the Software, such as the names and details of scanned drives and other storage locations, file and folder names, file metadata (for example, size, dates, and technical details), previews and thumbnails generated from your media, tags, transcripts, search indexes, collections, comments, and sharing settings. Library Data may include personal data about your team members, your customers, or people who appear in your media. The Company processes Library Data on your behalf and in accordance with our agreement with you. Usage Data includes non-identifiable information about how you and your team members use our Software, such as the features used, time spent using them, and actions performed. Transaction Data includes details of your subscription and billing transactions, such as your plan, number of seats, add-ons purchased, time, date, and amount.
c. Data Use: The Company uses the data collected for the following purposes. For Service Delivery, we use Library Data to operate the Software on your behalf, including displaying your library, generating and storing previews, running search, and making files and collections available to the people you choose to share them with. For Software Improvement, we analyze Usage Data to understand user behavior and preferences, identify potential improvements, and enhance the user experience. For Customer Support, we use Personal Data to provide customer support, respond to inquiries, and address issues. For Transaction Processing, we use Transaction Data to process subscription payments through our payment processor, Stripe.
d. Data Sharing: The Company may share your data and your customers' data with third parties under the following circumstances. When you share files or collections, the Software makes the shared previews and related information available to the recipients you choose, including people outside your organization. We may share data with third-party service providers that perform services on our behalf, such as cloud hosting and storage, payment processing, sign-in and directory services, error reporting, customer support, and data analysis. These third parties are required to respect the security of your data and your customers' data and treat it in accordance with the law. Additionally, we may disclose data if required by law or in response to legal proceedings, to protect our rights, property, or safety, or that of our users or others, and in connection with a merger, acquisition, or sale of assets.
e. Data Protection: The Company implements various security measures to maintain the safety of your personal information and that of your customers, including encryption, secure servers, and access controls. Procedures are in place to deal with any suspected personal data breach, and you, your customers, and any applicable regulator will be notified of a breach where legally required. These measures include secure data storage, regular security audits, and restricted access to data.
f. User Rights: You and your customers have certain rights in relation to the personal data we hold. These rights include the right to access, rectify, or erase your personal data, the right to restrict or object to processing, and the right to data portability. For any requests to exercise these legal rights, please contact us at support@1archive.io. We will respond to all legitimate requests within one month, although it may take longer if the request is particularly complex, or you have made a number of requests. In this case, we will notify you and keep you updated.
g. Updates to the Policy: The Company may update this Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. Significant changes will be notified through the Software or by email. Your continued use of our Software following the posting of changes to this policy will be deemed your acceptance of those changes. We encourage you to review this Policy periodically to stay informed about our data protection practices.
h. Contact Information: If you have any questions or concerns about this Policy, please contact us at support@1archive.io. We have appointed a data privacy manager responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact the data privacy manager using the details set out above.
5. Responsibilities: Security Organization, Authority, and Obligations
a. Policy Authority and Maintenance: The Company has the authority to develop, maintain, and enforce this Policy and any additional policies, procedures, standards, and processes as necessary to protect the integrity of our information assets. We are responsible for ensuring that these policies and procedures are kept up to date with the latest industry standards and legal requirements.
b. Policy Review: The Company will initiate an annual review of this Policy, engaging relevant stakeholders as appropriate. This review process ensures that the Policy remains effective and compliant with any changes in legal or regulatory requirements.
c. Exceptions: The Company recognizes that specific business needs may occasionally call for an exception to this Policy. Exception requests must be made in writing and approved by us. All approved exceptions will be documented and periodically reviewed to ensure they remain valid and necessary.
d. Obligation to Comply: Clients must comply with all aspects of this Policy that apply to them. Any attempt to bypass or circumvent security controls may be treated as a violation of this Policy. For example, sharing access credentials, including passwords, deactivating anti-malware software, removing or modifying secure configurations, or creating unauthorized network connections are prohibited unless we have granted an exception.
e. Sanctions: Any violation of this Policy may result in sanctions. Sanctions may include suspension, access restrictions, or more severe penalties up to and including termination of service. If we suspect illegal activities, we may report them to the applicable authorities and aid in any investigation or prosecution of the individuals involved.
f. Acknowledgment: Clients must acknowledge that they have read, understood, and agree to comply with this Policy either in writing or through an approved online process. Acknowledgment must be completed on a timely basis following account creation or as otherwise designated by us. Material changes to this Policy may require additional acknowledgment. The Company will retain acknowledgment records.
6. Data: Information Classification and Risk-Based Controls
: The Company has established a three-tier classification scheme to protect information according to risk levels: Public Information, Confidential Information, and Highly Confidential Information. All information should be treated as Confidential Information unless otherwise marked.a. Public Information: Public Information is information that the Company has made available to the general public. Examples include press releases, marketing materials, job announcements, and any information that the Company makes available on its publicly accessible website. Do not assume that any information you obtain from The Company’s internal network or systems is publicly available. For example, draft marketing materials are typically Confidential Information until their release.
b. Confidential Information: Confidential Information is information that may cause harm to The Company, its clients, employees, or other entities or individuals if improperly disclosed, or that is not otherwise publicly available. Examples include the Company financial data, client-provided data, customer lists, revenue forecasts, program or project plans, intellectual property, client contracts, and communications or records regarding internal the Company matters and assets. Protect Confidential Information with specific administrative, physical, and technical safeguards implemented according to risks.
c. Highly Confidential Information: Highly Confidential Information is information that may cause serious and potentially irreparable harm to The Company, its clients, employees, or other entities or individuals if disclosed or used in an unauthorized manner. Examples include personal information for employees, clients, customers, and sensitive business information such as budgets, financial results, or strategic plans. Additional safeguards for Highly Confidential Information include strict access controls, encryption, and physical security measures.
7. User Accounts and Access Control
a. User Accounts: The Company assigns unique user accounts, passwords, and other authentication credentials to each individual who uses the Software. Users are responsible for maintaining the confidentiality of their login information and are prohibited from sharing their accounts, passwords, or authentication credentials with others. Access to the Software is granted based on user-specific accounts, and users may only access the features or data for which they have been authorized.
b. Identity and Access Management: The Company uses identity and access management controls to protect user accounts and ensure that users only have access to the resources required for their use of the Software. Each user is assigned a unique account, and the Company monitors account usage to detect unauthorized access or suspicious activity. Users must protect their login credentials and immediately report any unauthorized access or potential security breaches.
c. Acceptable Use Policy: Users are expected to use the Software for its intended purposes and comply with all applicable laws and this Policy. The Software should not be used for illegal activities, unauthorized commercial purposes, or any activity that may create a conflict of interest with the Company. Any violation of this Policy may result in the suspension or termination of user accounts.
8. Incident Reporting and Response
a. Incident Reporting: Immediately notify us at support@1archive.io if you discover a cyber incident or suspect a breach. Treat any information regarding cyber incidents as Highly Confidential Information. Examples of cyber incidents include loss or suspected compromise of user credentials, suspected malware infections, loss or theft of any device containing the Company information, suspected entry into The Company’s network or systems by unauthorized persons, any breach of Confidential or Highly Confidential Information, and any attempt to obtain passwords or other confidential information through social engineering or phishing.
b. Incident Management: The Company manages a cyber incident response plan to handle information security incidents effectively. We will investigate all reported or detected incidents and document the outcome, including any mitigation activities or other remediation steps taken.
c. Data Breach Notification: Applicable law may require the Company to report cyber incidents that result in the exposure or loss of certain kinds of information to various authorities or affected individuals or organizations, or both. Breaches of Highly Confidential Information, especially personal information, are the most likely to carry these obligations. Our incident response plan includes a step to review all incidents for any required notifications. Coordinate all external notifications with our legal team. Do not act on your own or make any external notifications without prior guidance and authorization.
9. Transparency About Data Security:
While the Company employs reasonable security measures to protect data stored and processed through the Software, including encryption, secure servers, and access controls, it is important to understand that absolute security cannot be guaranteed. Due to the nature of the internet, cloud storage, and the potential for criminal cybersecurity activities, there are inherent risks in using electronic systems to store and transmit data. By using the Software, you acknowledge these limitations and the shared responsibility in protecting data, including:a. Inherent Risks: Using the Software involves risks, such as data loss, unauthorized access, and security breaches. These risks may arise from factors outside the Company's control, including internet vulnerabilities, actions by third-party service providers, and cybercriminal activities like hacking, phishing, or other malicious attacks.
b. Company’s Limited Liability: The Company is committed to protecting your data but cannot be held responsible for data breaches or losses resulting from circumstances beyond its control. This includes actions by you, your customers, third-party providers, or criminal activities. The Company is not liable for any unauthorized access, loss, alteration, or disclosure of data, except when caused directly by the Company’s gross negligence or intentional misconduct.
c. Third-Party Service Providers: The Company may use third-party services for certain functions, such as cloud storage and payment processing. While we strive to choose reputable providers, we are not responsible for their security practices or any breaches that occur through them. Users are encouraged to review these third parties’ privacy and security policies.
d. Awareness of Cybersecurity Threats: Cybersecurity threats are constantly evolving, and no system can be entirely secure. The Company encourages users to remain vigilant, follow best practices for data protection, and regularly update passwords and other security measures