Privacy Policy
1 Introduction
ScriptRebel Systems LLC ("SR," "we," "us," or "our") is committed to protecting the privacy of individuals and organizations that use our software products and services, including AttachLogic™ and the SR Toolbox (collectively, the "Software"), and our website at scriptrebel.com (the "Website").
This Privacy Policy explains what information we collect, how we use it, how we protect it, and your rights with respect to it. By installing or using the Software or visiting the Website, you agree to the practices described in this Policy.
2 Scope
This Policy applies to:
- The AttachLogic™ desktop application and Excel Add-in
- The SR Hub cloud licensing and identity management service
- The scriptrebel.com website and any associated web pages
3 Information We Collect
3.1 Information Collected by the Software (Desktop Applications)
When you install and use the Software, the following information is collected for the purpose of license validation and seat management:
| Data Item | Description | How Collected | Stored in Cloud? |
|---|---|---|---|
| License Key | The alphanumeric key issued to your organization | Entered by user during activation | Yes |
| Machine Hash | A one-way SHA-256 hash derived from your computer's hostname, machine architecture, and node name | Generated automatically by the Software | Yes (hash only) |
| User Hash | A one-way SHA-256 hash of the local part of your email address (the portion before the @ symbol) | Derived from email entered during activation | Yes (hash only) |
| Email Domain | The domain portion of your email address (e.g., yourcompany.com) | Derived from email entered during activation | Yes |
| App ID | The identifier of the SR application being activated (e.g., attachlogic) | Sent automatically | Yes |
| App Version | The version of the Software installed at the time of activation (e.g., 1.0.1) | Sent automatically | Yes |
| EULA Version | The version of the End User License Agreement in force at the time of activation | Recorded automatically from server | Yes |
| Activation Timestamp | The date and time of initial seat activation and subsequent heartbeat validations | Recorded automatically | Yes |
3.2 Information NOT Collected by the Software
The following data is explicitly never transmitted to SR or any third party, and is never collected at all:
- The contents of any EIB template files
- The contents of any attachment files processed by AttachLogic™
- Your plaintext email address (it is hashed before any database write; see Section 5)
- Your computer's hostname or hardware identifiers in plaintext (only the hash is stored)
- IP addresses (never collected under any circumstance — see Section 3.1)
- Any Workday® data, credentials, or configuration
- Any financial, accounting, or business data processed through the Software
- Trial-period usage or content data. AttachLogic™ does not distinguish between trial and paid use at the data level — the Software never touches, reads, or transmits the contents of any file it processes, regardless of license status. See Section 3.6 for more detail.
3.3 Information Collected During License Activation
During the initial activation process, your email address is transmitted to the SR Hub for the sole purpose of delivering a one-time verification code. This transmission occurs over encrypted HTTPS. The plaintext email address is:
- Used in memory only to send the verification email
- Never written to SR's database
- Permanently discarded after the verification email is sent
3.4 Information Collected via the IT Admin Portal
When an IT administrator accesses the SR Hub Admin Portal to download installer files, the following is recorded:
- A hash of the administrator's email address (user part only)
- The email domain
- The license key used
- The app and version downloaded
- The timestamp of the download
No IP address is captured as part of this process (see Section 3.1).
3.5 Information Collected via the Website
When you visit scriptrebel.com, standard web server logs may record your IP address, browser type, referring URL, and pages visited, consistent with standard web hosting infrastructure. The scriptrebel.com website does not use cookies or third-party analytics/tracking scripts. If this changes in the future, this Policy will be updated accordingly.
3.6 What Happens to Your Files (EIB Templates and Attachments)
AttachLogic™'s core encoding function operates entirely on your local machine. When you use the Software to embed attachments into an EIB template:
- The file is read from your local disk into local memory only
- Base64 encoding is performed locally using your machine's CPU
- The output is written to a new local file
This is true regardless of whether you are using a trial license, an active paid license, or an expired license — the file-processing engine has no network dependency and no code path that transmits file data. License validation (Section 3.1) and file processing are entirely independent systems.
4 How We Use Your Information
We use the information described above for the following purposes:
| Purpose | Data Used |
|---|---|
| License validation — confirming that a License Key is active and in good standing | License Key, Machine Hash, User Hash, App ID |
| Seat management — tracking which machines have active seats under a license | Machine Hash, User Hash, License Key, App ID |
| EULA compliance audit — maintaining a permanent record of which version of the Software and EULA was accepted at activation | App Version, EULA Version, Activation Timestamp |
| Fraud prevention and license enforcement — detecting unauthorized use or circumvention of seat limits | Machine Hash, User Hash, License Key, Login Events |
| Software update notifications — informing users when a new version is available | App ID, App Version |
| IT Admin installer distribution — providing authenticated download access to licensed installers | License Key, Email Domain |
| Customer support — responding to support requests and diagnosing issues | License Key, App Version, Activation Timestamp |
We do not use your information for:
- Advertising or marketing to third parties
- Sale or rental to any third party
- Profiling or behavioral tracking
- Any purpose unrelated to the operation and support of the Software
5 How We Protect Your Information
All personal identifiers stored in SR's database are processed through one-way SHA-256 cryptographic hashing before storage. We store a hash, not your name or email. The hash cannot be reversed to recover the original value — even SR personnel cannot determine the identity of a specific user from the stored hash.
The license state stored on your machine is encrypted using AES-256 (Fernet) with a key derived from your machine's hardware fingerprint using PBKDF2-HMAC-SHA256 (100,000 iterations). This vault file is hardware-locked and cannot be decrypted on any other machine.
All communication between the Software and the SR Hub uses HTTPS with TLS 1.3. The Software uses the Windows system certificate store to ensure compatibility with corporate TLS-inspection proxies, without requiring custom certificate configuration.
The SR Hub is hosted on Google Cloud Run within Google Cloud Platform's infrastructure. Data is stored in a managed Cloud SQL (PostgreSQL) instance isolated within a Virtual Private Cloud (VPC). Access to administrative endpoints is protected by a secret token stored in Google Secret Manager. Installer artifacts are delivered via short-lived (15-minute) signed URLs, minted on demand, rather than long-lived embedded links.
Transactional emails (one-time verification codes for license activation, update downloads, and IT Admin Portal access) are delivered via Amazon Simple Email Service (Amazon SES), operated by Amazon Web Services, Inc. (AWS). The connection between the SR Hub and AWS SES is authenticated using an IAM credential scoped solely to the ses:SendEmail / ses:SendRawEmail permissions — SES has no access to, and does not store, any other data described in this Policy. Only the recipient email address and the message body (containing the one-time verification code) are transmitted to AWS SES for the sole purpose of delivering that email.
Every installer downloaded through the Software or IT Admin Portal is accompanied by a dynamically-computed SHA-256 hash of the actual file bytes at the time of download. The Software verifies this hash before allowing the installer to be executed, protecting against supply-chain tampering.
6 Automatic Seat Replacement
To minimize administrative overhead for IT administrators, the SR Hub includes an automated seat management system:
- Machine migration: If an Authorized User activates the Software on a new machine (e.g., a hardware upgrade), their previous seat is automatically marked "replaced," and the new machine becomes the active seat — no administrator action required.
- User turnover on shared hardware: If a new user activates the Software on a machine previously used by a different Authorized User, the new user automatically takes over that seat (marked "auto-replaced" for the prior user).
- Seat-limit eviction: If a license is at its seat limit and a new user/machine combination attempts to activate, the seat with the oldest (least recent) heartbeat is automatically evicted to make room, provided auto-replacement has not been disabled for the license.
- Automated compliance monitoring: SR monitors aggregate seat-replacement activity across each license to detect patterns consistent with intentional circumvention of seat limits (as opposed to legitimate hardware turnover). If excessive replacement activity is detected, SR may notify the organization's administrator and, after a grace period, temporarily disable auto-replacement for new (never-before-seen) users on that license until additional seats are purchased. This does not affect existing users' ability to migrate to new machines, nor does it affect any already-active seat.
7 Secure Update Download Flow
When a new version of the Software is available, end users on a direct-download deployment may download the update through a secure, two-step verification process, isolated from the license activation flow:
- The user requests an update and provides their email address; a single-use, six-digit verification code (valid for 15 minutes) is sent to that address.
- The user enters the code, which is validated against a hashed record; upon success, a freshly-minted, short-lived (15-minute) signed download URL is issued for the correct installer.
This verification code and its association with the license key and machine hash are used only to authorize the single download and are not linked to any other stored data. The code record is deleted upon use or expiration. This process is completely isolated from the initial activation verification code pool, so a leaked or expired code from one flow can never be used to authorize the other.
IT administrators use a parallel one-time-passcode (OTP) flow through the Admin Portal to authenticate before receiving a signed download link for IT-managed deployment packages.
8 Automatic Operating System Detection
The Software automatically detects the operating system on which it is running (Windows or macOS) using standard operating-system APIs, and includes this platform indicator in its requests to the SR Hub when checking for updates or requesting a download link. This is not a user selection or preference — it is determined automatically by the Software itself.
This platform indicator is used only to determine which version number to display and which installer artifact to return in that specific response. It is not stored in the SR Hub database and is not retained as part of any seat, activation, or audit record.
9 Offline Grace Period
If the SR Hub is unreachable when the Software attempts its periodic license validation, the Software will continue to function normally using its locally cached, encrypted license vault for up to seven (7) days from the last successful server validation. During this period, the license status will display as "Active (Offline)" along with the remaining time. This grace period resets automatically the next time the Software successfully validates against the SR Hub. After seven days without a successful validation, the Software enters a restricted mode until connectivity is restored and the license is re-validated. No data collection differs during offline operation — the Software simply relies on data already stored locally.
(This grace period is also documented for IT administrators in the AttachLogic™ IT Admin Guide.)
10 Data Retention
| Data | Retention Period |
|---|---|
| Active Seat records | Retained while the seat is active; marked as revoked, replaced, expired, or auto-replaced upon status change. Records are retained for audit purposes. |
| Login event logs | Retained indefinitely for license enforcement and EULA audit purposes. Note: these records contain only hashed identifiers (Seat ID, timestamp) and do not constitute personal data — see Section 5.1. |
| Verification codes (one-time activation codes) | Deleted immediately upon use or expiration (15 minutes), whichever comes first. SR does not retain a historical record of which codes were sent to which user beyond this window. |
| Update-download verification codes | Deleted immediately upon use or expiration (15 minutes), whichever comes first. Maintained in a table completely separate from activation codes. |
| IT Admin download logs | Retained indefinitely for audit purposes. Contains only hashed identifiers, email domain, license key, app/version, and timestamp — no IP address and no plaintext PII. |
| Local vault file (attachlogic.vault) | Retained on the user's machine until uninstallation or manual deletion. User is prompted to retain or delete during uninstallation. |
11 Data Sharing and Disclosure
SR does not sell, rent, or trade your information to any third party.
We may disclose information in the following limited circumstances:
- Service providers: We use Google Cloud Platform to host the SR Hub and Amazon Web Services (Amazon SES) to deliver transactional emails. These providers process data on our behalf subject to their data processing agreements and privacy policies, and are contractually/technically restricted to the minimum data needed to perform their function (see Sections 5.4 and 7).
- Legal requirements: We may disclose information if required to do so by law, court order, or governmental authority.
- Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of SR's assets, information may be transferred to the successor entity, subject to the same privacy protections described in this Policy.
- Protection of rights: We may disclose information to protect the rights, property, or safety of SR, our customers, or others, including for fraud prevention and license enforcement purposes.
12 Data Breach Notification
In the event of a data breach affecting your organization's information, SR will notify affected organizations without undue delay, and in any event within seventy-two (72) hours of becoming aware of the incident, consistent with industry-standard practice (e.g., the notification window established under the EU General Data Protection Regulation). Notice will include, to the extent known, the nature of the incident, the data potentially affected, and steps SR is taking in response.
13 Limitation of Liability
To the maximum extent permitted by applicable law, SR's total liability arising out of or related to this Privacy Policy or SR's collection, use, or handling of data described herein shall not exceed the total license fees paid by the affected organization to SR in the three (3) months preceding the event giving rise to the claim. This limitation is consistent with, and cross-referenced in, the Limitation of Liability provisions of the AttachLogic™ End User License Agreement.
14 Your Rights
Depending on your jurisdiction, you may have the following rights with respect to your information:
- Access: Request information about what data we hold related to your organization's license
- Correction: Request correction of inaccurate information
- Deletion: Request deletion of your organization's seat records (note: this will deactivate the associated license seats)
- Portability: Request a copy of your organization's license and seat data
15 Children's Privacy
The Software is designed for use by business professionals and is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately.
16 International Users
SR is based in Arizona, United States. If you are accessing the Software or Website from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.
By using the Software, you consent to the transfer of information specified in Section 3.1 above (in hashed formats as set forth in that section) to the United States in accordance with this Policy.
17 Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this Policy. We will make reasonable efforts to notify Licensees of material changes, which may include a notice within the Software or an email to the contact address on file for your organization's license.
Continued use of the Software following notice of changes constitutes acceptance of the updated Policy.
18 Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
ScriptRebel Systems LLC