Privacy policy v2

Precision Techserve Private Limited, part of the Precision Group, with its registered office at 22, 1st Floor, Habibullah Road, T. Nagar, Chennai 600017, Tamil Nadu, India (“we”), provides InsTIL Pro, an IT service and asset management platform, and operates instilonline.com. This policy covers the website, and the InsTIL Pro platform we host: its web application, mobile app, Outlook add-in and endpoint agent.

We play two roles. For the website, and for the people who buy and administer a subscription, we decide what is collected and why — we are the data fiduciary (controller). For the data an organisation puts into its own InsTIL Pro workspace, that organisation decides, and we act as its data processor, on its instructions and under the agreement between us. If you use InsTIL Pro because your employer does, your employer is responsible for that data and its own privacy notice applies to it.

Where InsTIL Pro is deployed on a customer’s own premises or in the customer’s own cloud subscription, we do not host or receive that data at all; the customer does.

Only what you submit, and what is needed to deliver the page.

• Subscription form — registered company name, organisation type and size, country, state and city; your name, designation, work email and telephone number; the workspace address you would like; the number of technicians and assets; your preferred start date and any notes.
• Support form — your name, company, email, optional telephone number and your message.
• Microsoft marketplace — if you subscribe through Microsoft’s commercial marketplace, Microsoft passes us the subscription, the plan, the purchaser’s email address and your organisation’s Microsoft Entra tenant ID, so that we can set up and bill the right subscription. Microsoft’s own privacy statement covers what Microsoft collects when you buy there.
• Your IP address — read on each form submission and held briefly in memory to limit repeated submissions. It is not written to the message or to our logs. Our application logs record each submission’s reference number and company name, and our hosting provider, Microsoft Azure, keeps standard request logs as part of running the service.

This website sets no cookies, runs no analytics or advertising scripts, and loads its fonts and images from itself, so visiting it does not send anything about you to a third party.

• To reply to your enquiry or support request.
• To prepare, provision and administer the subscription you asked for, including billing through Microsoft where you bought through the marketplace.
• To tell your administrators about service changes, maintenance and security matters affecting your workspace.
• To keep the service secure, investigate misuse and meet our legal obligations.

We process this data because you gave it to us voluntarily for that purpose, because you have consented, or because the law requires it. We use it only for the purposes above, and if we need it for a new one we will ask first. We do not sell personal data, we do not use it for advertising, and we do not share it with third parties for their own marketing.

It is sent over TLS to our application, which emails it to our own team through Microsoft 365 or through a mail server we operate. The reply address is set to yours so that a reply reaches you directly, and you receive an acknowledgement carrying a reference number.

Each workspace holds what the customer organisation puts into it or connects to it. Depending on how the organisation configures it, that includes:

• User profiles — name, employee ID, work email, telephone, designation, department, team, location, reporting manager, date of joining, and, where the organisation collects them, date of birth, an alternative email, a profile photo and a signature image.
• Directory data — profiles synchronised from the organisation’s Active Directory, LDAP, Microsoft Entra ID or HR system, including the fields the organisation chooses to map.
• Tickets and conversations — requests, incidents and changes, their descriptions, attachments, comments, approvals and feedback.
• Email — messages sent to a support mailbox the organisation connects, so that they can become tickets.
• Assets — hardware, software and non-IT assets, and the person each is assigned to.
• Technician availability — where the organisation uses these features, technicians’ leave records and active or inactive working status.

Every customer has a separate database, subdomain and attachment store; no customer’s data sits in a shared application schema. We access a workspace only to provide, support and secure the service, or when the customer asks us to.

An organisation may install the InsTIL agent on its computers to keep its asset register current. The agent reports only to that organisation’s own workspace, over an authenticated, encrypted connection. It collects:

• Hardware and operating system details — model and serial numbers, processor, memory, disks, BIOS, battery, monitors and attached devices.
• Network identifiers — IP and MAC addresses and domain membership.
• Installed software, updates and antivirus status.
• The currently logged-on user, the last logged-on user and the local user accounts on the machine.
• When the organisation enables it, a list of running programs with the user each runs as, and resource utilisation, refreshed every few minutes.
• When the organisation enables it, the device's approximate location.

The agent does not capture screens, keystrokes, clipboard contents, browsing history or the contents of your files, and it offers no remote control of the machine.

• The camera and photo library are used only when you choose to attach a picture to a ticket.
• To send you notifications, the app registers a push token together with a device identifier, the device model and the app version.
• Notifications are delivered through Google Firebase Cloud Messaging, and on iPhone through Apple's push service. A notification can show the ticket number, its status, the requester's name and a short excerpt of the ticket, so that text passes through those services. You can turn notification categories off in the app, or turn notifications off on your device.
• Sign-in tokens are kept in your device's secure storage.

The app does not use your location, contacts or microphone, and contains no analytics, advertising or crash-reporting libraries.

You sign in to the add-in with your InsTIL account, on your organisation’s usual InsTIL sign-in page, opened in a small Outlook window. The add-in then keeps a sign-in of its own for 7 days. It is recorded like any other sign-in, with the IP address and app used, and signing out of the add-in ends that sign-in only. Tickets are always raised under the InsTIL account you signed in with.

The add-in may read your Outlook email address to show it in the form. It does not read the message you have open, its sender or its attachments; only what you type into the add-in, and any files you choose to attach, are sent to create a ticket.

Passwords are stored only as salted hashes, and multi-factor authentication secrets are stored encrypted. Organisations can instead sign users in through Microsoft Entra ID or SAML single sign-on, in which case the password is entered with the organisation’s identity provider and never reaches InsTIL Pro. Where an organisation uses its own directory (Active Directory or LDAP) for sign-in, the password passes through InsTIL Pro to be checked against that directory and is not stored.

To keep the service secure and answer “who did what, when”, the platform records sign-ins and sign-outs, the IP address and browser or app used, the actions users take, and changes to tickets and records. These records belong to the customer’s workspace and are visible to its administrators.

This website uses none. The InsTIL Pro web application uses only what it needs to work: cookies and browser storage that keep you signed in, remember the app version, and hold your display preferences and saved filters. When you sign in through Microsoft, Microsoft’s sign-in library keeps its tokens in your browser session. The Outlook add-in keeps its sign-in token in its own browser storage for up to 7 days, and removes it when you sign out. There are no advertising or analytics cookies, and nothing that tracks you across other sites. If measurement is ever added, this page will say what it is before it is switched on.

We use a small number of service providers, each only for the purpose shown:

• Microsoft — Azure hosting for this website and for hosted workspaces; Microsoft 365 for mail; Microsoft Entra ID for single sign-on and directory synchronisation where the customer connects it; and the commercial marketplace for subscriptions bought there.
• Google (Firebase Cloud Messaging) and Apple — delivering mobile push notifications.
• Services a customer connects — for example the customer’s own mail server or email provider, HR system, directory, or an asset-tagging vendor it authorises. These act for the customer, not for us.
• Content delivery — the InsTIL Pro web application loads its fonts from Google Fonts, and the Outlook add-in loads its program code and styles from Microsoft. These requests carry your IP address and browser details, but no workspace data.
• OpenStreetMap — only where an organisation enables device location, to turn coordinates into a place name.

We may also disclose data where the law requires it, to a court or authority with power to demand it, or to protect the security of the service and its users. If our business is reorganised or transferred, this policy continues to apply to the data transferred.

Workspaces we host are held in Microsoft Azure’s Central India region, unless a different region is agreed when your subscription is set up. Push notifications, and the global infrastructure of the providers listed above, may involve processing outside India. If your organisation requires data to stay within its own network or cloud subscription, InsTIL Pro can be deployed there instead.

Each customer’s data is isolated in its own database; stored credentials and secrets are encrypted; access is controlled by role and enforced on the server; and multi-factor authentication is available for every account. Our security overview describes these measures. No system is perfectly secure: if a breach affects personal data, we will notify the affected customer and, where the law requires, the Data Protection Board of India and the people concerned.

• Website enquiries and subscription correspondence: for as long as we have a relationship with your organisation, and afterwards only where the law requires us to keep it.
• Workspace data: for the term of the subscription. When it ends we stop processing the data, provide an export if asked, and delete it after the period set out in our agreement.
• By default the platform automatically deletes detailed sign-in and request logs after 7 days, error logs after 3 days, and mail pulled from a connected mailbox 2 days after it is received — once it has become a ticket, it is kept with that ticket. These periods are configurable, and may differ where InsTIL Pro is deployed on a customer's own infrastructure.
• The audit trail of actions users take, and the history of each ticket, are kept for the life of the workspace, so that the organisation can answer who did what and when.
• Database backups of hosted workspaces are kept for 14 days and then overwritten.
• A sign-in to the Outlook add-in lasts 7 days; after that you sign in again.
• Password-reset codes expire after 10 minutes.

Under the Digital Personal Data Protection Act, 2023 you may ask us for a summary of the personal data we hold about you and how we use it; ask us to correct, complete, update or erase it; withdraw any consent you have given; and nominate someone to exercise these rights on your behalf. You also have the right to have a grievance addressed, and, if you are not satisfied with our response, to complain to the Data Protection Board of India. If you are elsewhere, you may have similar rights under local law, and we will honour them.

Write to instil-support@precisionit.co.in or to the Grievance Officer below. We may need to confirm your identity first. If the data sits inside a customer’s workspace, we will pass your request to that customer, who decides what happens to it, and help them respond.

InsTIL Pro and this website are for organisations and their staff. They are not directed at children, and we do not knowingly collect personal data from anyone under 18.

When this policy changes we will update the date at the top of this page. If a change is material, we will also tell the administrators of the subscriptions it affects before it takes effect.