Privacy Policy

We receive this information directly from you, from your organization or a user who invites you, automatically when you use the service, and from integrations your organization chooses to authorize.

RoomStack uses the strictly necessary “roomstack-auth” application cookie to maintain and secure the session. It contains an authentication token, is unavailable to page JavaScript (HttpOnly), is transmitted securely in production (Secure), and limits cross-site sending (SameSite=Lax). Without “Keep me signed in,” the token expires no later than 12 hours. With that option, the cookie may persist for up to 7 days.

Managed-login workflows also use temporary, strictly necessary cookies to link an authentication request to its callback, prevent replay or request-forgery attacks, and complete multi-factor authentication enrolment or changes. These include server-generated correlation and nonce cookies and the RoomStack cookies “roomstack-cognito-external”, “roomstack-cognito-mfa”, and “roomstack-cognito-required-mfa”. RoomStack MFA cookies are encrypted, HttpOnly, restricted to the required API path, and expire no later than ten minutes. They may temporarily contain a protected Cognito authorization; it is not exposed to JavaScript or stored in browser storage.

On the auth.roomstack.ca managed-login domain, Amazon Cognito may use cookies including “XSRF-TOKEN”, “csrf-state”, “csrf-state-legacy”, “cognito”, “lang”, and “page-data”. They protect requests, maintain sign-in workflow consistency, preserve the selected language, and support the managed-login session. The Cognito session cookie may preserve a successful sign-in for one hour. RoomStack nevertheless requires fresh authentication when the workflow or security operation requires it.

Browser local storage holds functional preferences such as language, theme, time zone, measurement units, and certain display settings. During the browser session, session storage holds the context of an activated support mandate: its identifier, a temporary activation token, the target organization, the approved scope and access level, its expiration, and the authorized projects. This context is used only to authenticate and limit delegated support access; it is removed when the mandate is exited or revoked, or when browser session data is cleared.

RoomStack currently uses no advertising or analytics cookies. The cookies described above are necessary for sign-in and security functions; blocking them may prevent authentication or certain security operations. If a non-essential cookie or similar technology is added, it will be blocked until you make a choice and this policy will be updated.

We share information only with authorized people in your organization, project collaborators based on their permissions, and providers that help us operate hosting, storage, transactional email, support, security, and requested integrations. Providers receive only what their mandate requires and are subject to protection obligations.

Amazon Web Services, through Amazon Cognito, acts as RoomStack’s technical identity provider for managed login, account recovery, multi-factor authentication, and passkeys. Cognito receives the information required for these functions, including the verified email address, account identifier, configured authentication factors, and technical sign-in data. RoomStack remains authoritative for account status, organizations, projects, roles, and permissions. When a passkey uses the device PIN, fingerprint, or facial recognition, that verification is performed locally by the device; RoomStack does not receive the fingerprint or facial image.

Public pages may load fonts from external services. Those services then receive technical data needed to fulfill the request, including the IP address and standard browser information.

We may also disclose information when required by law, to protect rights or safety, or in a properly governed business transaction. We do not sell or rent personal information.

Primary application data is hosted in Canada. Some providers or authorized members of an organization may nevertheless process information outside Québec. Before entrusting information to a provider, RoomStack assesses relevant factors and implements appropriate contractual or technical safeguards.

We retain information for as long as needed to provide the service, meet the agreement with the organization, maintain security and audit records, resolve disputes, or comply with law. Periods vary with the nature of the information. At the end of the applicable period, information is securely deleted, anonymized, or destroyed.

RoomStack uses administrative, technical, and physical safeguards proportionate to the sensitivity of the information, including access controls, organization and project isolation, encrypted communications, logging, and backup and incident procedures. No system eliminates all risk; promptly report suspicious activity.

Subject to law, you may request access to or correction of your personal information and, in some cases, deletion, withdrawal of consent, or information about processing. We may verify your identity and may need to refer a request to the organization that controls project data. You can update several account details in RoomStack and manage browser data through browser settings.

RoomStack is a professional service for organizations and is not designed to knowingly collect information from anyone under 14 without required authorization.

We may update this policy. A material change will be communicated appropriately and the date above will be updated.

To exercise a right, ask a question, or make a complaint, contact RoomStack’s person in charge of personal information protection at info@roomstack.ca. You may also contact the Commission d’accès à l’information du Québec where that law applies.