Using Room through your organization

If you got into Quathos Room through a company, a school or any organization, that organization runs the space you are in. This page says what that means, in plain words. The privacy policy and the data processing agreement say the same thing in legal ones.

1. Your account and your organization are two things

Your account lives at accounts.quathos.com and is yours: name, e-mail, password, the devices you sign in from. The organization cannot change it or read its sign-in history. Everything you write, send or record inside the organization belongs to the organization. Removing you from the organization does not delete your account, and deleting your account does not delete what you wrote there.

2. What whoever administers the organization can do

• Decide who is in, with which role and which license, and remove anyone. Removal takes you out of every channel, group and direct message at once.
• Delete any message in the channels and conversations they are part of, including yours. A deleted message leaves a "message deleted" mark in place, and the deletion is written to the audit trail with the administrator’s name.
• Export the organization’s data. Today the export carries the list of people and the audit trail. When it grows to carry messages and files, it will carry direct messages too, because they belong to the organization; we will update this page before that happens, and every export is written to the audit trail.
• Download the recordings and transcripts of meetings, see who joined which meeting and when, and read the audit trail: who did what, with date and time.
• Choose the plan, and with it the retention period. When it ends, messages, files and recordings are deleted for everyone, you included.

3. What they cannot do

• Read a direct message or a private channel they are not part of. Reading requires being in the conversation, for administrators too.
• Turn on your camera or microphone, or record a meeting without the notice everyone in it sees. Capture always announces itself on screen, and leaving the meeting is one click.
• Edit or erase the audit trail. The database refuses changes to a line already written, for administrators too.
• Read your account’s sign-in history, change your password, or see what you do in other organizations you belong to.

4. What we do

We operate the service under the organization’s instructions and the DPA. We do not read your messages, do not use them to train anything, and do not collect usage telemetry beyond the access logs the security page describes. Our own staff reach a customer’s data only through named people, behind VPN and two-step sign-in, when support or an incident requires it, as the privacy policy describes.

5. Privacy requests

To have a message removed, a recording deleted or your name taken out of something inside the organization, ask whoever administers it: they hold the data and decide. If you write to privacy@quathos.com instead, we forward the request to the organization and let you know we did, because acting alone there would mean changing a customer’s records without the customer knowing. Requests about your account itself, at accounts.quathos.com, come to us directly.