Privacy Policy

Effective Date: May 8, 2026 Last Updated: May 8, 2026 Version: 1.2 This Privacy Policy describes how Regentra, operated by Emry Networks, LLC (“Regentra,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information.

​

1. Scope and Applicability

This Privacy Policy applies when you:

• Visit our websites, including regentra.io and docs.regentra.io (the “Websites”)
• Register for, access, or use our platform at app.regentra.io (the “Platform”)
• Interact with us through email, support channels, events, or sales engagements
• Receive communications from us

This Privacy Policy does not apply to the extent that we process personal information in the role of a processor or service provider on behalf of our customers. That processing is governed by the applicable service agreement and our Data Processing Addendum (“DPA”). If your personal information has been submitted to us by or on behalf of a Regentra customer, please direct your privacy inquiries to that organization.

​

2. Personal Information We Collect

​

2.1 Information You Provide

​

2.2 Information Collected Automatically

​

2.3 Information from Third Parties

We may receive personal information from partners and resellers who refer you to our services, identity providers when you authenticate via Single Sign-On (SSO), and publicly available business contact sources for business-to-business engagement purposes.

​

2.4 Cookies and Similar Technologies

We use only cookies that are strictly necessary to operate the Platform. We do not use advertising cookies, third-party tracking pixels, behavioral analytics cookies, social-plugin cookies, or any technology that participates in cross-context behavioral advertising. These cookies are exempt from the consent requirement of Article 5(3) of the EU ePrivacy Directive (2002/58/EC) as amended, and from the equivalent provisions of the UK Privacy and Electronic Communications Regulations.

​

3. How We Use Personal Information

We use the personal information we collect to:

• Provide, maintain, operate, and improve the Platform;
• Create and manage your account and process transactions;
• Communicate with you about your account, including transactional notifications, security alerts, and service updates;
• Provide customer support and respond to your inquiries;
• Enforce security measures, detect fraud, and protect against abuse;
• Send product updates, feature announcements, and educational content (with the ability to opt out — see Section 11);
• Facilitate optional AI-powered features within the Platform (see Section 4);
• Conduct internal analytics to understand usage patterns and improve the Platform;
• Comply with applicable legal and regulatory obligations.

Lawful Bases (EEA/UK). Where required by applicable law, we process personal information on the basis of: contractual necessity (Art. 6(1)(b) GDPR); our legitimate business interests (Art. 6(1)(f) GDPR — security, service improvement, business-to-business communications); your consent (Art. 6(1)(a) GDPR), where requested; or compliance with legal obligations (Art. 6(1)(c) GDPR).

​

4. Artificial Intelligence Features

Regentra offers optional AI-powered features, including assistance with support ticket responses, compliance analysis, and content classification. These features are powered by third-party AI service providers under contract.

• AI features process only data within the requesting organization’s tenant.
• Customer Data is not used to train, retrain, fine-tune, or evaluate any AI or machine-learning model — whether operated by Regentra or by any third party.
• AI-generated outputs are intended as suggestions and are subject to human review.
• AI features may be disabled at the organization level by an administrator.

Automated decision-making (GDPR Art. 22). We do not engage in solely automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR. Where AI features support human decision-making by Regentra customers, the customer remains responsible for the decision and a human reviewer is in the loop. California Automated Decision-Making Technology (ADMT). Pursuant to the California Consumer Privacy Act regulations governing automated decision-making technology (Cal. Code Regs. tit. 11, §§ 7200–7236), Regentra does not currently use Customer Data to make decisions that produce legal or similarly significant effects on individuals, and we do not currently provide ADMT services that make such decisions on behalf of customers. We periodically reassess this status and will provide pre-use notice, opt-out, and access rights as required if the assessment changes.

​

5. How We Share Personal Information

We do not sell, rent, or trade your personal information. We do not share personal information for cross-context behavioral advertising, and we do not engage in targeted advertising. We may disclose personal information to the following categories of recipients: Service Providers (Subprocessors). We engage third-party service providers — including cloud hosting, database management, payment processing, email delivery, identity authentication, AI processing, and real-time communications — to perform functions on our behalf. These providers are contractually obligated to protect personal information and may only process it in accordance with our instructions. Our current list of subprocessors is published at docs.regentra.io/subprocessors. You may subscribe to subprocessor change notifications at that page. We provide at least 30 days’ notice before engaging a new subprocessor that processes personal information. Customers who object to a new subprocessor for legitimate data-protection reasons may terminate the affected subscription per the DPA. Professional Advisors. We may share information with our legal, accounting, insurance, and other professional advisors as necessary. Business Transfers. In connection with a merger, acquisition, reorganization, bankruptcy, or sale of assets, personal information may be transferred as part of that transaction. We will provide notice of any such transfer via email and/or a prominent notice on the Platform. Legal Requirements. We may disclose personal information if required by law, regulation, legal process, or governmental request, or where we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, or to detect and prevent fraud. Where permitted by law, we will attempt to notify the affected party before making such disclosures. With Your Consent. We may share personal information with third parties when you have given us explicit consent to do so. California “Shine the Light” (Cal. Civ. Code § 1798.83). Regentra does not share personal information with third parties for those parties’ own direct marketing purposes.

​

6. Data Security

We maintain a comprehensive security program that includes technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption in transit and at rest (AES-256-GCM with AAD binding for tenant credential storage), multi-factor authentication, logical tenant isolation, role-based access controls, account lockout mechanisms, append-only audit logging, vulnerability management, and industry-standard security headers and input validation. Regentra is currently pursuing SOC 2 Type II certification. While we are committed to protecting your personal information, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your information.

​

7. Data Retention

We retain personal information for the periods set out below, after which we delete or anonymize it. Where deletion is not immediately feasible (for example, because information is stored in backup archives), we securely isolate the information from further processing until deletion is possible. We may retain information for longer periods where required by applicable law, regulation, or to comply with a legal hold.

​

8. International Data Transfers

Personal information may be transferred to, stored in, and processed in the United States or other countries where our service providers operate. These countries may have data protection laws that differ from those in your jurisdiction. Where we transfer personal information outside the European Economic Area (EEA), the United Kingdom, or Switzerland, we rely on appropriate transfer mechanisms, including:

• The European Commission’s 2021 Standard Contractual Clauses (Modules 2 and 3 as applicable);
• The UK International Data Transfer Agreement and the UK Addendum to the SCCs;
• The Swiss Federal Data Protection and Information Commissioner-approved version of the SCCs.

We perform Transfer Impact Assessments where required and apply supplementary technical measures (encryption in transit and at rest, key-management isolation by tenant, and access controls). EEA and UK Representative. If you are located in the EEA or UK, you may direct queries about our processing to our Article 27 Representative. Contact details for our Representative are published at docs.regentra.io/eu-representative and are also available on request from privacy@regentra.io.

​

9. Your Privacy Rights

Depending on your jurisdiction, you may have certain rights regarding your personal information.

​

EEA / UK / Switzerland

If you are located in the EEA, UK, or Switzerland, you have the right to access, rectify, erase, restrict the processing of, or port your personal information; the right to object to processing based on legitimate interests; and the right to withdraw consent at any time without affecting the lawfulness of processing performed before withdrawal. You also have the right to lodge a complaint with your local data protection authority.

​

United States — Comprehensive State Privacy Laws

The following rights are available to residents of states with comprehensive privacy laws, including California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Florida (FDBR), Iowa (ICDPA), Tennessee (TIPA), Indiana (INCDPA), Delaware (DPDPA), New Hampshire (NHDPA), New Jersey (NJDPA), Minnesota (MCDPA), Maryland (MODPA), Kentucky, and Rhode Island (collectively, “applicable state privacy laws”):

• Right to know / access the categories and specific pieces of personal information we have collected, sources, business purposes, and recipients.
• Right to correct inaccurate personal information.
• Right to delete personal information we have collected.
• Right to portability — receive your information in a structured, commonly used format.
• Right to opt out of the sale or sharing of personal information for cross-context behavioral advertising. We do not sell or share personal information as those terms are defined under any applicable state privacy law.
• Right to limit the use and disclosure of sensitive personal information under California CPRA. We use sensitive personal information only for purposes permitted under Cal. Code Regs. tit. 11, §§ 7027(m)(1)–(8) and do not exceed those purposes.
• Right to non-discrimination for exercising your privacy rights.

Global Privacy Control. We honor opt-out preference signals transmitted by browsers or platforms that comply with the W3C / IAB Global Privacy Control specification (e.g., the Sec-GPC HTTP header). Receipt of a GPC signal is treated as a valid request to opt out of any sale or sharing where applicable. Colorado, California, Connecticut, Texas, Oregon, Montana, Delaware, and New Jersey require honoring such signals; we apply the same treatment in all jurisdictions for consistency. Authorized Agents. California, Colorado, and Virginia residents may use an authorized agent to submit a request. We may require proof of authorization (for example, a power of attorney or signed authorization). Verification and Response Window. We will verify your identity using information already associated with your account. We respond to verifiable consumer requests within 45 days, with one 45-day extension where reasonably necessary. Appeal. If we decline a privacy rights request in whole or in part, you may appeal by replying to our written response within 60 days. We will respond to your appeal within 60 days. If we deny the appeal, we will provide instructions to lodge a complaint with the relevant state Attorney General or, in California, the California Privacy Protection Agency.

​

Other Jurisdictions

We respect the privacy rights of individuals under applicable laws globally, including the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), the Brazilian Lei Geral de Proteção de Dados (LGPD), and the Australian Privacy Principles (APPs). To exercise any right described in this Section, please contact us at privacy@regentra.io.

​

10. Sensitive Personal Information

We do not collect sensitive personal information (as defined under applicable privacy laws, including the CCPA/CPRA) beyond what is necessary to provide the Service — for example, account credentials for authentication purposes. We do not use or disclose sensitive personal information for purposes other than those permitted under Cal. Code Regs. tit. 11, §§ 7027(m)(1)–(8), and we do not use sensitive personal information to infer characteristics about individuals. Where a Regentra customer has executed a Business Associate Agreement (see Section 13) and uses the Service to process Protected Health Information (“PHI”) as defined under HIPAA, that PHI may meet the definition of “sensitive personal information” under state law. Such processing is governed by the BAA, which controls over this Privacy Policy with respect to PHI.

​

11. Email Communications

​

Transactional Messages

As part of operating the Service we send transactional and relationship messages — for example, account-creation confirmations, password resets, multi-factor authentication codes, invoice and payment notifications, ticket replies, security alerts, and material service updates. These messages are exempt from CAN-SPAM’s commercial-email requirements under 15 U.S.C. § 7702(17) and are necessary to operate the Service. You cannot opt out of transactional messages while you maintain an active account.

​

Marketing Messages

Lifecycle, product, educational, and changelog emails are commercial messages under 15 U.S.C. § 7702(2). Each marketing email:

• Identifies Emry Networks, LLC (operating as Regentra) as sender;
• Contains our valid physical postal address;
• Contains a clear and conspicuous unsubscribe link that does not require login or payment to use.

You may also unsubscribe by emailing privacy@regentra.io with the subject “Unsubscribe.” We honor opt-out requests within 10 business days, as required by 16 C.F.R. § 316.5, and unsubscribe URLs remain functional for at least 30 days from the message date. Marketing-email send-log data is retained for 30 days and then deleted.

​

Your Preferences

You can review and adjust your marketing-email preferences in Settings → Notification Preferences. Opting out of marketing communications does not affect transactional messages.

​

Multi-Tenant Context (MSPs and their End Users)

Where a Regentra customer (such as a managed-service-provider organization) configures the Service to send messages to its own end users, the customer is the “sender” under 15 U.S.C. § 7702(16) for those messages and is responsible for content accuracy, recipient consent (where required), and honoring opt-outs. Regentra acts as the technological provider; the customer’s CAN-SPAM, TCPA, GDPR, ePrivacy, and other applicable obligations are addressed in the applicable service agreement and DPA.

​

SMS / Text Messaging (when offered)

If we offer SMS-based features and you elect to enroll, your consent and our use will comply with the U.S. Telephone Consumer Protection Act (47 U.S.C. § 227) and FCC implementing rules. SMS communications require prior express written consent, will identify the sender, and will support STOP and HELP keywords. Standard message and data rates apply. We do not send SMS between 9:00 PM and 8:00 AM the recipient’s local time, and we honor STOP requests immediately.

​

12. Multi-Tenant and Enterprise Data

Regentra provides a multi-tenant platform designed for organizations managing services across multiple client entities. The relationships and respective responsibilities between Regentra, our customers, and their end users are defined in the applicable service agreement and our Data Processing Addendum, which is auto-incorporated into the Terms of Service and available at docs.regentra.io/data-processing-addendum. The DPA includes the 2021 EU Standard Contractual Clauses (Modules 2 and 3 as applicable), the UK Addendum to the SCCs, and the Swiss-FDPIC-approved version, where applicable.

​

13. HIPAA / Protected Health Information

Regentra provides tools that may be used by HIPAA-regulated organizations. If your use of the Platform involves the storage or processing of Protected Health Information (“PHI”) as defined in 45 C.F.R. § 160.103:

• A Business Associate Agreement must be executed with Regentra before any PHI is uploaded or processed.
• Use of the Platform for PHI must be limited to features identified as HIPAA-Eligible at docs.regentra.io/hipaa-eligibility.
• The Customer remains responsible for the customer-side implementation responsibilities listed at that page (encryption practices, access controls, audit-log review).

To request a BAA, contact legal@regentra.io.

​

14. Children’s Privacy

The Platform is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete such information promptly.

​

15. Third-Party Links and Services

The Platform may contain links to third-party websites, services, or applications that are not operated or controlled by us. This Privacy Policy does not apply to information collected by third parties through such links. We encourage you to review the privacy policies of any third-party services you access.

​

16. Accessibility

Regentra is committed to making the Platform accessible to all users. We target conformance with the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA. Our current accessibility statement and any published Voluntary Product Accessibility Templates (VPATs) are available at docs.regentra.io/accessibility.

​

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the Last Updated date at the top of this page and provide appropriate notice, which may include posting a notice on the Platform or sending a notification to account administrators. Where required by applicable law, we will obtain your consent to material changes.

​

18. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about our data practices:

• Privacy Inquiries: privacy@regentra.io
• Legal, DPA, and BAA Requests: legal@regentra.io
• Postal Address: Emry Networks, LLC — physical mailing address published at docs.regentra.io/contact
• EEA / UK Article 27 Representative: see docs.regentra.io/eu-representative

If you are not satisfied with our response to a privacy concern, you may have the right to lodge a complaint with your applicable data protection authority.