Privacy policy
Effective
In plain words
We collect what we need to run the service and nothing more. We don't sell personal information, we don't use advertising trackers, and we only read the staff list from Microsoft 365, never mailboxes.
For our MSP partners' clients, the MSP and its client decide how training data is used. We process it on their behalf.
Who we are
NetMinder Security is operated by 1001039001 Ontario Inc., operating as NetMinder Security ("NetMinder", "we", "us"), based in Ontario, Canada.
We provide phishing simulation and security awareness training to managed service providers (MSPs), who offer it to their own clients. This policy explains what personal information we handle, why, and the choices you have.
Our two roles
On our website and for MSP accounts, we decide how personal information is used. We are responsible for it under Canadian privacy law.
For the employees of an MSP's clients (the people who receive practice emails and take lessons), we handle personal information on behalf of the MSP and its client. They decide who is enrolled and how results are used, and we follow their instructions. If you're one of those employees, your employer or its IT provider is your first contact. We'll pass any request we receive to them.
What we collect
The information depends on how you use NetMinder.
- Website visitors: if you request a demo, your first and last name, work email, phone number, company name, website, client count and message. Our hosting provider also records standard request data such as IP address and browser type for security.
- MSP users: name, email, password (stored only as a one-way hash), the MSP's name and branding, and sign-in records including IP address and browser.
- Client employees: name and work email from the client's Microsoft 365 or entered by the MSP, Microsoft account ID, whether the account is active, lessons assigned and finished, quiz answers and scores, and completion certificates.
- Practice email activity: which practice emails were sent, and when a link was opened, along with the IP address, browser details and timing we use to tell real people apart from email security scanners.
- Microsoft 365 connection: the tenant ID and the client admin's consent. We use the User.Read.All permission to read names, email addresses and account status. We never read mail, files, calendars or chats.
What practice emails never collect
Practice emails link only to a short lesson. Our pages never ask for passwords, payment details or other sensitive information, and practice emails carry no attachments or software. We don't record what people type outside the lesson's quiz.
How we use it
We use personal information only for these purposes:
- To run the service: sending practice emails and lessons, sending reminders, keeping staff lists in sync and producing reports and certificates.
- To keep accounts and the service secure: sign-in, rate limiting, audit logs and investigating misuse.
- To reply to demo requests and support questions.
- To improve the product using aggregated, de-identified statistics that don't identify any person or client.
- To meet legal obligations.
What we never do with it
We don't sell personal information, rent it, or use it for targeted advertising. We don't use client employees' data for our own marketing.
Email from us
We send account and service emails that are needed to run NetMinder, such as training invitations, reminders and monthly reports for MSPs. If you request a demo, we'll reply about that request.
We only send marketing email where Canada's Anti-Spam Legislation (CASL) allows it, and every marketing email has an unsubscribe link.
Where it's stored
NetMinder runs on Cloudflare's global network, so personal information may be stored or processed outside Canada, including in the United States. When it is, it's subject to the laws of those countries, and we rely on our providers' contractual and security commitments to protect it.
How long we keep it
- Client and employee training records: while the MSP's account is active, so past reports stay accurate. People who leave a client's Microsoft 365 are marked inactive and their history is kept for reporting.
- When an MSP closes its account or removes a client: we delete that data within 90 days, except where the law requires us to keep it.
- Demo requests: up to two years after our last contact, then deleted.
- Security logs: as long as needed to protect the service, normally no more than one year.
How we protect it
Traffic is encrypted in transit. Passwords are stored only as hashes. Each MSP can see only its own clients, sign-in is rate limited and important actions are recorded in an audit log. No system is perfectly secure, and we can't guarantee it, but we work to protect personal information and will notify affected people and the Privacy Commissioner of Canada about breaches that create a real risk of significant harm, as the law requires.
Cookies
We use one cookie to keep MSP users signed in, and your browser remembers whether you chose the light or dark theme. We don't use advertising or analytics cookies.
Your rights
You can ask to see the personal information we hold about you, correct it, or withdraw consent where we rely on it. Email shane@netmindersecurity.com and we'll respond within 30 days. We may need to confirm your identity first.
If you're a client employee, we'll forward your request to your employer or its IT provider, who decides on it, and help them respond.
If you're not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada. People in Quebec, Alberta and British Columbia may also contact their provincial privacy regulator.
Children
NetMinder is a workplace service and isn't meant for anyone under 16. We don't knowingly collect personal information from children.
Changes to this policy
We'll update this page when our practices change and show the new effective date at the top. If a change is significant, we'll tell MSP account holders by email before it takes effect.
Contact us
Our privacy officer is accountable for how we handle personal information. Email shane@netmindersecurity.com with any question or request.