Privacy Policy

1. Who we are

SnitchOS is a multi-tenant employee-monitoring and workforce-analytics product operated by OS Labs Inc, 705 Lakeview Plaza Blvd, Columbus, OH 43085, United States (“SnitchOS”, “we”, “us”). OS Labs Inc operates the platform on infrastructure it controls and licenses it to managed service providers, who deploy the SnitchOS agent to company-owned Windows endpoints and view the resulting data through the SnitchOS dashboard.

This policy explains how personal data flows through SnitchOS, the roles each party plays, and how the people whose data is processed can exercise their rights. For questions about this policy, contact the SnitchOS contact form.

1.1 Key terms

• Customer — the managed service provider that licenses SnitchOS from SnitchOS.
• Client Tenant — a downstream client organization of the Customer whose workforce is monitored within an isolated tenant in SnitchOS.
• Monitored User — an individual employee or worker whose company-owned, managed device is monitored by the SnitchOS agent.
• Administrator — a person the Customer authorizes to sign in to the SnitchOS dashboard to view or manage data.
• Endpoint data — the monitoring data the agent collects from a managed device, described in Section 3.

2. Controller and processor roles

The parties’ roles depend on the category of data.

2.1 Endpoint data (SnitchOS as processor)

For endpoint data collected from Monitored Users, the Customer and/or its Client Tenant is the data controller and SnitchOS acts as a data processor on the Customer’s documented instructions. The Customer decides which devices are monitored, configures categorization and retention within available settings, and is responsible for the lawfulness of the monitoring. SnitchOS processes endpoint data only to provide and support the service, as set out in the Data Processing Addendum (see the DPA & sub-processors page) and consistent with Article 28 GDPR where applicable.

2.2 Account and billing data (SnitchOS as controller)

For a limited set of data — Administrator identities used to authenticate, account and support records, and billing information — SnitchOS acts as an independent controller. We use this data to operate the Customer relationship, secure the platform, and bill for the service. This policy governs that processing directly.

3. What data is collected

The SnitchOS agent samples a defined set of workplace-activity signals from managed devices, and the platform records the data needed to run multi-tenant accounts.

The public marketing site records first-party, aggregate site-traffic measurement: for each visit our API receives the page path, the external referrer (if any), and any stored campaign (UTM) source, and stores only aggregated daily counters per page, referrer domain, and source — no per-visitor records, cookies, or IP addresses are retained for analytics. If you sign up, the referrer and campaign parameters associated with your visit are stored with your signup so we can attribute it. We do not use third-party advertising cookies or trackers.

3.1 Endpoint data collected by the agent

• Active window — foreground process name and window title.
• Idle and active state, and idle duration.
• Application usage — which applications ran and for how long.
• Website activity — scheme, host, and path only. Query strings and fragments are removed on the endpoint and again on ingest.
• Input counts only — keystroke count, mouse-click count, and mouse-distance totals. The content of what is typed is never recorded.
• Screenshots — one deduplicated frame per minute, skipped while the device is idle.
• Device and operating-system metadata — hostname, OS version, agent version, and the session or user the sample belongs to.
• Administrator identity — name, email, and the immutable object identifier returned by Microsoft Entra ID at sign-in.
• Microsoft 365 usage — only if the Customer connects its Microsoft 365 tenant: Entra sign-in activity and Teams and Outlook usage signals retrieved through the Microsoft Graph API.

3.2 What is explicitly not collected

SnitchOS does not intentionally extract the following data fields. Information in these categories may still be visible in a screenshot, window title, or URL path:

• Keystroke content — the keys or text typed.
• Clipboard contents.
• File contents.
• Message, email, or chat bodies.
• Audio or microphone input.
• Webcam or camera images.
• Saved passwords or credentials.
• URL query strings and fragments — removing the URL components that normally carry SSO tokens, magic-link credentials, and OAuth state. Paths, window titles, and screenshots can still contain sensitive text.

4. Why we process this data

Endpoint data is processed for the workforce-monitoring purposes the Customer configures, including:

• Showing real-time and historical activity, idle time, and application and website usage.
• Classifying activity as Productive, Neutral, or Distraction and producing management reports.
• Raising per-tenant alerts and recording admin actions in an audit trail.
• Providing evidence for the Customer’s own compliance, workforce-management, and security needs.

Account and billing data is processed to authenticate Administrators, operate and secure the platform, provide support, and invoice for the service.

5. Legal bases

Where the GDPR or comparable law applies, processing relies on the following bases.

5.1 Where the Customer is controller

For endpoint data, the Customer (and/or its Client Tenant) determines and documents the legal basis for monitoring its own workforce. This is commonly the controller’s legitimate interests in managing and securing its business, performance of the employment relationship, or compliance with a legal obligation, and — where local law requires it — the informed consent of Monitored Users. The Customer is responsible for identifying and meeting the correct basis in each jurisdiction. SnitchOS processes this data only on the Customer’s instructions.

5.2 Where SnitchOS is controller

For account, support, and billing data, SnitchOS relies on performance of its contract with the Customer, its legitimate interests in operating and securing the service, and compliance with legal obligations such as tax and accounting requirements.

6. How data is shared

SnitchOS does not sell personal data and does not share it for cross-context behavioral advertising. Endpoint data stays within the Customer’s isolated tenants and is accessible only to the Administrators the Customer authorizes. We disclose personal data only to the sub-processors below, to the Customer that controls it, and where required by law or to protect the security and integrity of the service.

6.1 Sub-processors

We engage a small number of vendors to run the service. Each is bound by contractual data-protection terms. The current list is maintained on the DPA & sub-processors page; a summary is below.

7. International transfers

The platform runs on a single dedicated server that SnitchOS operates and controls. Where personal data is transferred across borders — for example to a sub-processor or where the Customer or its Monitored Users are located outside the hosting region — such transfers are made under an appropriate safeguard, including the European Commission’s Standard Contractual Clauses (SCCs) and, where relevant, the UK International Data Transfer Addendum, together with any supplementary measures required by law. Details of the hosting location are available to Customers on request.

8. Retention

We keep personal data only as long as needed for the purposes above, then delete it on the following schedule.

During active service, screenshots follow the 30-day hot / 365-day cold schedule above. When a Client Tenant is offboarded, its endpoint data — including screenshots — is purged from the live platform as part of the offboarding run, and residual backup copies expire through the normal backup cycle within 14 days. On termination of the Customer relationship, data is disposed of in line with the DPA.

9. Security measures

SnitchOS protects personal data with technical and organizational controls, including:

• TLS 1.2 or later for data in transit between the agent, dashboard, and API.
• Tenant isolation enforced at the database row, object-store key, and API scope layers, so cross-tenant access is refused.
• A code-signed agent and MSI, with publisher, signed-manifest, and package-hash verification before updates apply.
• Microsoft Entra single sign-on for Administrators, with no local passwords.
• An append-only audit log recording actor, IP, target, and outcome for every authenticated change.

Off-site backup copies are encrypted in transit. They are not additionally encrypted at rest; access to the backup target is restricted to authorized SnitchOS operators. No system can guarantee absolute security, and the Customer remains responsible for securing its own Administrator accounts and devices.

10. Your rights

Depending on where they live, Monitored Users and other individuals may have rights to access, correct, delete, or restrict personal data, to object to or limit certain processing, to data portability, and — under US state laws such as the California Consumer Privacy Act as amended by the CPRA — to know what is collected, to request deletion or correction, and to opt out of any “sale” or “sharing” (SnitchOS does neither). Exercising a right will not lead to discriminatory treatment.

10.1 How to exercise a right

For endpoint data, the Customer or Client Tenant is the controller. If you are a Monitored User, direct your request to your employer or the organization that manages your device; they decide how data about you is handled. If a Customer receives a request it needs help fulfilling, or if you are unsure who to contact, submit the SnitchOS contact form and we will route or support the request and assist the responsible controller. We may need to verify identity before acting, and we respond within the timeframes applicable law requires.

11. Customer responsibility for employee notice

The Customer (and, where relevant, its Client Tenant) is responsible for providing Monitored Users with lawful notice of monitoring and for obtaining any consent required in the applicable jurisdiction. Several US states — including New York, Connecticut, and Delaware — require advance written notice of electronic monitoring, and other jurisdictions impose their own notice or consent rules. SnitchOS is intended only for company-owned, MSP-managed devices used with appropriate notice; it is not designed for personal devices and is not designed to be undetectable.

12. Children’s data

SnitchOS is a workplace product for company-owned devices used by adult workers. It is not directed to children and is not intended to collect data from anyone under the age of majority. We do not knowingly process children’s personal data.

13. Changes to this policy

We may update this policy to reflect changes in the service, our sub-processors, or the law. When we make a material change, we will update the effective date above and, where appropriate, notify the Customer. Continued use of SnitchOS after an update means the revised policy applies.

14. Contact us

For privacy questions or to exercise a right, use the SnitchOS contact form. For legal notices, contact the SnitchOS contact form. For general product support, contact the SnitchOS contact form. Postal notices go to OS Labs Inc, 705 Lakeview Plaza Blvd, Columbus, OH 43085, United States.