Privacy policy

This policy covers the site: the product pages, the contact form, the visitor statistics and the sign-in for registered readers, and the usage statistics of the public KNet SAM demo at demo.sam.karlonet.com (see "The public demo" below). It does not cover the KNet products themselves, installations of them other than the public demo, or the store. The licence terms for the KNet products are published on store.karlonet.com.

The site uses no advertising, no third-party trackers, no third-party analytics and no social media plugins. Its pages and their content come from our own servers and reach you through Cloudflare (see the section "Cloudflare" below). The site itself sets no cookies for visitors who do not sign in.

To count visits we keep our own, first-party statistics. When a page is shown, a small script on the page tells our server which page was viewed. For each view we record:

• the time and the page address, without the query part of the address (only the campaign values utm_source, utm_medium and utm_campaign are kept, if the link you followed had them);
• the name of the site you came from (the host name only, not the full address), if your browser sends it;
• the browser family, the operating system and the type of device (desktop, mobile or tablet), read from your browser's user agent; the user agent itself is not stored;
• the country, from the country code that Cloudflare supplies with the request (otherwise "unknown");
• a visitor key: a one-way hash of a random value of the day, your IP address, your browser's user agent and the site name. The random value changes every day (UTC) and is deleted once the day has ended, so the key cannot be turned back into your IP address and visits on different days cannot be linked to each other.

The statistics do not store your IP address. Views are not counted when your browser sends "Do Not Track" or "Global Privacy Control", for automated browsers and known bots, for pages loaded in advance (prefetch), and on the administration and sign-in pages. The individual views are deleted after 30 days. Daily totals (number of views and visitors per page, referring site, country, browser, operating system, device type and campaign) are kept; they contain nothing that identifies a person.

Like any website, our servers receive your IP address and browser information in order to deliver the pages to you. Our web servers write a technical access log (time, IP address, page requested, browser) that is used only for security and to find faults; it is kept for at most 14 days and then deleted. The site itself does not store this information beyond what is described above.

At demo.sam.karlonet.com you can try KNet SAM with made-up machines and a shared demo account. The demo is reset every night. It counts how it is used, in the same way as the site's statistics: no cookies, no third-party scripts and no stored IP addresses. The demo keeps a random identifier for each browser tab in the tab's own session storage (not a cookie, gone when the tab is closed) so that the pages of one visit belong together.

What the demo counts:

• pages and tabs opened, by the page's pattern (for example "the firewall page", not which firewall), how long each page was visible, the page you entered and left on, and the order of the pages within the visit;
• signing in and out with the demo account, and failed sign-ins (not what was typed);
• which features you tried, for example opening the terminal or the remote desktop and for how long, running a command or a batch command (how many machines, never the command), starting an update run, installing a package, downloading a report or resolving an alert, and which of the made-up machines you opened;
• tabs, buttons, menu items, options and table headers you selected, and dialogs you opened, by their label on the screen (a label that contains something you typed is left out), and that a search box was used (never the search text);
• every request your browser makes to the demo's server: which function (with any identifiers removed), the answer's status code and how long it took, including actions the demo does not allow;
• errors in the page (the kind of error and its message with any quoted text and numbers removed) and requests that did not reach the server;
• about your browser: the size class of the window and the screen (such as "laptop"), the pixel density, the language, the time zone, light or dark appearance and whether the screen is a touch screen; the browser family, operating system and device type from the user agent; the site you came from (host name only) and the campaign values utm_source, utm_medium and utm_campaign of the first page;
• the country, only when the request carries a country code (the demo is not served through Cloudflare, so usually it does not).

The demo never records anything you type: no commands, no terminal input, no search text, no form values and no passwords, and nothing shown on the terminal or the remote desktop. Within the demo each counted event is stored with your IP address and your browser's user agent for a short time, at most two days and normally less than a minute: our website fetches the events, turns the address and user agent into the same daily visitor key as described under "Visiting the site" (with the site name "demo", so a visit to the demo cannot be linked to a visit to this site), and the demo then deletes them. The address and the user agent are not stored by our website.

Automated clients (bots, crawlers and scanners) are counted separately by the kind of client and what they asked for. When your browser sends "Do Not Track" or "Global Privacy Control", the demo counts only that a page was viewed, without any of the details above, and stores the other requests without your IP address, user agent, tab identifier, referring site and country. The individual events are deleted after 30 days; daily totals are kept and contain nothing that identifies a person. Like the site's, the demo's servers receive your IP address to deliver the pages and may write it to their technical logs, which are used only for security and to find faults.

The site is served through Cloudflare (Cloudflare, Inc., a company in the United States), which we use as a content delivery network and to protect the site against attacks. Every request to the site passes through Cloudflare before it reaches our servers, so Cloudflare processes it on our behalf, including your IP address, the page requested and your browser information. This processing can take place outside Canada, including in the United States, where the information may be accessible to courts and authorities under the laws that apply there. Cloudflare may set a strictly necessary security cookie of its own, for example when it checks that a request does not come from an automated attack. The country code used by our statistics is supplied by Cloudflare with each request. How Cloudflare handles personal information is described in its privacy policy.

When you send a message through the contact form we keep what you entered: your name, your e-mail address, your company (optional), the topic and your message, together with the time it was sent. We do not keep your IP address with it. The message is sent by e-mail to our own mailbox so we can answer you, and it is also kept in the site's administration for 180 days, after which it is deleted automatically. We use it only to answer your message and to follow up on your request. To protect the form from abuse, your IP address is used for a short time in the server's memory to limit how many messages can be sent; it is not written to storage.

You can also write to us directly at Show e-mail address.

Some parts of the site, such as product documentation, are available to registered readers only. If you sign in, the site sets a sign-in cookie that keeps you signed in for up to 30 days or until you sign out. It is necessary for signing in and is used for nothing else. When you sign in through a single sign-on provider, a second, short-lived cookie (10 minutes) protects the sign-in step itself.

For a signed-in account we keep your e-mail address, your name, your role on the site, the sign-in identities linked to your account (the provider, its identifier for you and the e-mail address and name it reported) and the times of your first and last sign-in. We keep this while your account exists; you can ask us to delete it.

We do not sell, rent or trade personal information, and we do not share it with advertisers. Cloudflare processes the requests to the site on our behalf, as described above. Apart from that, we disclose personal information only where the law requires it.

The site and its data are hosted in Canada, on servers operated for us. Requests to the site pass through Cloudflare's network, which can process them outside Canada (see the section "Cloudflare" above).

The site is served over encrypted connections (HTTPS). Access to the administration is limited to the people who run the site, and account passwords are stored only as salted hashes.

You may ask us for access to the personal information we hold about you, ask us to correct it, and withdraw your consent, for example by asking us to delete a contact message or your account. Write to Show e-mail address; we will answer within 30 days. Because the visitor statistics cannot be linked to a person, we cannot find or delete individual views of yours; they are deleted after 30 days.

If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

The site is meant for businesses and IT professionals and is not directed at children.

When we change this policy we publish the new version on this page with its date.