Privacy Policy
1. Who we are
Dren Group / IT ("Dren IT", "we", "us") operates it.dren.group and provides managed IT, cybersecurity, and counter-surveillance services. Contact: it@dren.group.
2. What we collect
We collect only what we need to deliver the service:
- Ticket data: when you submit a support ticket we collect the name, callback number, email, code word, priority, subject, and description you provide.
- Telemetry from managed endpoints: when a customer enrolls a device with the dren-agent, we collect machine-level metadata (hostname, OS version, hardware inventory, CPU/RAM/disk metrics, uptime, software inventory) and event/alert records. We do not collect user file contents, keystrokes, screenshots, webcam input, microphone input, or browsing history.
- Account data: for staff and admin accounts we collect email and authentication metadata (last sign-in, session timing).
- Standard server logs: IP, user agent, requested URL, response status. Used for abuse prevention and operational diagnostics.
3. How we use it
Strictly to deliver and operate the service: triage and resolve tickets, monitor and protect managed endpoints, secure our infrastructure, send transactional notifications, and comply with legal obligations. We do not sell personal data, ever, to anyone.
4. Subprocessors we rely on
We use the following providers to run the service. Each has its own security posture; we accept responsibility for vetting them and sign DPAs where applicable.
- Supabase (database + auth)
- Netlify (web hosting)
- Cloudflare (DNS + edge + WAF)
- Resend (transactional email)
- Sentry (error monitoring)
5. How long we keep it
Ticket data: retained for the life of the customer relationship plus 24 months. Endpoint telemetry: rolling 24-month window; metric rollups longer. Server logs: 30 days. On written request, we will delete or export your data within 30 days unless we are required to retain it by law.
6. Your rights
Depending on where you live, you may have rights to access, correct, delete, port, or restrict processing of your personal data. Email it@dren.group with the subject "Privacy request" and we will respond within 30 days.
7. Security
Data in transit is encrypted with TLS 1.2+. Data at rest is encrypted by our subprocessors. Access to production systems is gated behind single-admin authentication and audit-logged. We follow least-privilege principles for staff access and run regular security reviews.
8. Children
Our services are not directed at children under 13. We do not knowingly collect personal information from children.
9. Changes
We will post material changes here with an updated effective date. Continued use of the service after a change constitutes acceptance.
10. Contact
Questions about this policy: it@dren.group.