Back to site

Privacy policy

Last updated: November 10, 2026

This policy explains what personal data OpenRMM collects when you visit openrmm.io, buy or use OpenRMM Cloud, or contact us; why we collect it; who receives it; how long we keep it; and what rights you have. It applies wherever you are, and it gives the information required by privacy laws such as the EU and UK General Data Protection Regulation (GDPR), Brazil's General Data Protection Law (LGPD) and the privacy laws of California and other US states.

1. Who we are

OpenRMM runs the openrmm.io website, the customer portal and the hosted OpenRMM Cloud service. It is the controller of the personal data described here, except for the data in your console (section 4). We are based in Brazil. For any privacy question or request, write to contact@openrmm.io.

OpenRMM is also open-source software (AGPL-3.0) that anyone can run on their own servers. A copy you run yourself sends us nothing; this policy covers only our website and hosted service.

2. What we collect

  • Account and order: your email address; your name, company and tax ID when you give them, for invoices; the address you choose for your console and the country of your company, which decides the region it runs in; your plan, number of devices and billing status.
  • Sign-in: you can sign in with a link sent by email, with no password. If you set a password, we keep only a one-way hash of it. If you turn on two-step verification, its secret is stored encrypted, and recovery codes only as hashes.
  • Payments: handled by the provider you choose: Mercado Pago, Stripe, or NOWPayments for cryptocurrency. We never receive your full card number. We keep a record of each payment: amount, currency, status, the provider's reference and the payment details the provider sends us, which can include your name, email address and tax ID.
  • Messages: what you send through the sales form (name, company, email, phone, number of devices and message), through support in the portal, or by email.
  • Security and technical data: your IP address when you start an order, ask for a sign-in link or send the sales form, so that we can block abuse; and a record of security events on your account, such as sign-ins, failed attempts and changes to your details. Our hosting provider, Cloudflare, processes the technical data of every request (such as IP address and browser type) to deliver and protect the site.
  • Your console: the devices, users, scripts, alerts, remote sessions and everything else that you and your agents put in the console you subscribe to (section 4).

We do not use analytics, advertising or tracking tools, and we do not build profiles of visitors. Cryptocurrency donations go straight to a public blockchain address; we collect nothing about who sends them.

3. Why we use it

  • To provide the service you ordered: create your account and console, sign you in, take payments, send service emails (sign-in links, receipts, payment reminders and console notices) and answer support requests. Basis: performance of a contract (GDPR art. 6(1)(b); LGPD art. 7, V).
  • To answer a sales inquiry you send us, before any contract. Basis: steps taken at your request (GDPR art. 6(1)(b); LGPD art. 7, V).
  • To keep the payment and tax records the law requires. Basis: legal obligation (GDPR art. 6(1)(c); LGPD art. 7, II).
  • To keep the site and service secure and to prevent fraud and abuse. Basis: our legitimate interest in protecting the service and its users (GDPR art. 6(1)(f); LGPD art. 7, IX).
  • Optional cookies, if we ever add any, would be used only with your consent (GDPR art. 6(1)(a); LGPD art. 7, I). There are none today.

We do not sell personal data or share it for targeted advertising, and we do not make decisions about you based solely on automated processing.

4. Data in your console

Your console holds data about your organization and the devices you manage. You decide what goes into it: you are its controller, and we process it on your behalf only to run, secure, back up and support the service. We do not look at it except when running the service requires it, when you ask us for help, or when the law requires it.

When you open your console, openrmm.io confirms who you are and passes your name and email address to it (single sign-on).

The console's AI assistant uses the AI provider and API key you configure, such as OpenAI or Anthropic, under that provider's terms. We do not resell AI services and do not use your data to train models.

If your devices are managed through OpenRMM by one of our customers, that customer is responsible for that data: please contact them first. We will help them answer you.

5. Cookies and browser storage

We use only what the site needs to work:

NamePurposeDuration
orc_portalKeeps you signed in to the customer portal30 days, or until you sign out
orc_sessionKeeps an administrator signed in to the admin area12 hours
orc_previewUnlocks the site during its pre-launch preview (only while the preview lasts)30 days

The site also keeps your language (orc_lang), color theme (orc_theme) and cookie choice (orc_cookie_consent) in your browser's storage. They stay in your browser until you clear them and are never sent to us.

We use no advertising or analytics cookies. You can review your cookie choice at any time with the "Cookies" link at the bottom of each page. The payment pages of Mercado Pago, Stripe and NOWPayments set their own cookies, under their own policies.

6. Who receives your data

Only providers that help us run the service, each with only what it needs:

  • Cloudflare: hosting, security, the site's database and storage of the encrypted backups, in North America for consoles in every region.
  • Civo: the servers that run customer consoles, in the region closest to the country of the company given at signup: New York (United States) for the Americas; London (United Kingdom) for Europe, Africa and the Middle East; Jakarta (Indonesia) for Asia and Oceania. The region is shown before payment and in your account.
  • Resend: sending emails, including your sales and support messages to our mailboxes.
  • Mercado Pago, Stripe and NOWPayments: payments, each only when you choose it. They are independent controllers of the data they collect at checkout, under their own privacy policies.
  • Google Fonts: the site's fonts are loaded from Google's servers, which receive your IP address and browser details when a page opens.

We may also disclose data when the law requires it, to protect rights, property or safety, or if the service changes hands, in which case this policy continues to apply to your data.

7. International transfers

Our providers process data in several countries, including the United States. When your data leaves your country, we rely on safeguards the law recognizes, such as the standard contractual clauses in our providers' data processing terms.

8. How long we keep it

  • Account details: while your account exists. If you ask us to delete it, we do, except the records the law requires us to keep.
  • Payment and invoice records: as long as tax and accounting laws require (in Brazil, generally five years).
  • IP addresses used against abuse: 90 days, then deleted automatically.
  • Sign-in links expire in 15 minutes; an unconfirmed sign-up expires in one hour and is then deleted.
  • Security events on your account: while the account exists.
  • Your console: while your subscription is active. When it ends, by cancellation or non-payment, the console is frozen and its data kept for 90 days so that you can reactivate it; then it is deleted.
  • Console backups: encrypted. Daily backups are kept for 7 days, and the final backup taken when a console is frozen is kept for 90 days.
  • Sales and support messages: as long as needed to answer you and follow up.

9. Security

We protect your data with encryption in transit (HTTPS); one-way hashes for passwords, sign-in links and recovery codes; encryption of two-step verification secrets; encrypted backups whose decryption keys are kept offline; a separate, isolated environment for each customer console; and access limited to what running the service requires. No system is perfectly secure: if a breach affects your data, we will notify you and the authorities as the law requires.

10. Your rights

Depending on where you live, you can ask us to confirm whether we process your data and give you a copy; correct it; delete it; send it to you or to another service in a portable format; restrict or object to its use; and withdraw consent you gave. You can also ask which companies we share your data with. Exercising these rights will never be held against you.

You can update your name, company and tax ID yourself in the customer portal. For anything else, write to contact@openrmm.io from the address on your account, or tell us how we can confirm it is you. We answer within 15 days.

You can also complain to a data protection authority: in Brazil, the ANPD (Autoridade Nacional de Proteção de Dados); in the European Union or the United Kingdom, the authority where you live or work.

11. Children

OpenRMM is a service for businesses and IT professionals. It is not meant for anyone under 18, and we do not knowingly collect their data.

12. Changes to this policy

We may update this policy as the service changes. The date at the top shows the current version. If a change significantly affects how we use your data, we will tell customers by email before it takes effect.

13. Contact

contact@openrmm.io