Pam Terminal
Privacy Policy

Last updated: 08/14/2026

  1. Introduction

    Pam Terminal is a privileged access management product (the “Licensed Software”) that organizations deploy in their own environment (for example as an offline Docker pack). We also operate marketing websites and an account console at pamterminal.com for licensing, billing, downloads, and support (the “Site” or “Account Services”). The Licensed Software and Account Services together are the “Services.”

    Unless an order states otherwise, commercial licenses sold through the Site are fixed-term (term-based): a one-time prepaid purchase for the term you select. They are not perpetual, do not auto-renew, and are not a classic recurring subscription. When the term ends, continuing use requires buying a new license. Fees, term end, and renewals are governed by our Terms of Use.

    The Services are operated by Pam Terminal (“Company,” “we,” or “us”). Contact: [email protected].

    This Privacy Policy explains how we collect, use, disclose, and protect information relating to identified or identifiable individuals (“personal data”) in connection with the Site and Account Services, and when you send materials to us for support.

    Deployment. Session recordings, live session content, credential vault secrets, and audit logs created by self-hosted Licensed Software remain in your environment. Pam Terminal does not act as a cloud broker for those sessions. We receive such operational data only if you upload or email it to us (for example support diagnostics).

    This policy applies where:

    • (a) we act as a data controller (for example account, billing, website, and marketing data about customers and Site visitors); and/or
    • (b) we act as a data processor (for example when you submit support diagnostics or other Customer Content that contains personal data for us to handle on your instructions).

    Relationship to Terms of Use

    Use of the Services is subject to our Terms of Use. Where we process personal data as your processor, our Data Processing Addendum also applies.

    PLEASE READ THIS PRIVACY POLICY CAREFULLY. BY ACCESSING OR USING THE ACCOUNT SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTAND THIS POLICY.

  2. How we use your personal data

    We process personal data to:

    • provide, operate, secure, and improve the Site and Account Services;
    • create and administer accounts, licenses, receipts, and downloads;
    • process payments (via our payment provider) and prevent fraud or abuse;
    • provide customer support and send service notices (including password reset, license, expiry, and release notifications where enabled);
    • understand how the Site is used at a high level and keep it reliable;
    • comply with legal and accounting obligations; and
    • where permitted, send product and marketing communications (you may unsubscribe).

    Legal bases may include contract performance, legitimate interests (securing and improving the Services), consent where required, and legal obligation.

  3. Account, billing, and support data

    When you create an account, sign in, purchase a license, request a demo or quote, or contact us, we may collect:

    • name, work email, and optional company name;
    • password (stored as a hash) and authentication/security metadata (for example rate-limit and session information);
    • notification preferences you choose in your profile;
    • order and license records (product, amounts, tax, status, entitlement windows, machine binding identifiers you supply for key issuance);
    • billing details you provide for tax invoices (for example name, address, country), which may be sent to our payment provider;
    • payment references and limited card metadata returned by the payment provider (we do not store full payment card numbers);
    • contact-form fields (name, email, company, optional phone, subject, message), IP address, and user agent;
    • optional support diagnostics packages you attach (application, license, runtime, machine, integration, and error-log summaries designed to avoid sharing secrets—review before upload); and
    • support correspondence and admin notes we keep while handling inquiries.

    We use this data to authenticate you, fulfill orders, issue licenses, provide downloads, respond to inquiries, and maintain business records.

  4. Session, audit, and operational data (Licensed Software)

    Depending on how you configure the Licensed Software in your environment, it may process:

    • operator and user identifiers from your directory (LDAP/OIDC) or local accounts;
    • asset names, hosts, and connection metadata;
    • session start/end times, protocol type, and gateway information;
    • session recordings, audit events, clipboard or file-transfer events (if enabled);
    • access policy decisions and related mappings; and
    • technical logs needed for security and troubleshooting in your deployment.

    That operational data is processed under your control as controller. Pam Terminal processes it as a processor only if you transmit such data to us (for example via support diagnostics).

    You are responsible for informing your personnel that privileged sessions may be monitored and recorded, and for configuring retention in your environment to meet your policies and law.

  5. Cookies and similar technologies

    We use cookies and similar technologies on the Site for essential purposes such as authentication (session cookies), security, and preference storage required for the Account Services to function.

    We may use Google reCAPTCHA or similar bot-prevention tools on forms (for example login, signup, password reset, and contact). Those tools may set cookies or collect device and usage signals under the provider’s terms and privacy policy.

    We do not use third-party advertising cookies on the Site.

    You can control cookies through your browser settings; disabling essential cookies may prevent sign-in or form submission.

  6. Providing personal data to others

    We may share personal data with:

    • service providers who help us host the Site, deliver email, process payments, provide bot protection, or operate support tools (bound by confidentiality and processing terms);
    • our current online payment merchant of record, Lemon Squeezy, for checkout, tax, receipts, and related fraud prevention;
    • professional advisors (legal, accounting) under confidentiality;
    • authorities when required by law or to protect rights, safety, and security; and
    • a successor in connection with a merger, acquisition, or asset sale, subject to appropriate protections.

    We do not sell personal data. We do not share personal data for cross-context behavioral advertising as those terms are commonly defined under U.S. state privacy laws, except where a specific feature requires consent and is disclosed at collection.

  7. Security of information

    We implement technical and organizational measures designed to protect personal data on the Account Services, including access controls, encrypted transport where applicable (HTTPS), logging, rate limiting, and least-privilege administration. No method of transmission or storage is completely secure; residual risk remains.

    For Licensed Software, you are responsible for securing your deployment, including OS patching, network isolation, backups, identity provider configuration, and storage of recordings and secrets.

  8. Data retention

    We retain controller data (accounts, orders, licenses, inquiries, and related logs) for as long as needed to provide the Account Services, meet legal/accounting requirements, resolve disputes, and enforce agreements.

    Support diagnostics and inquiry content are retained while useful for support and compliance, then deleted or anonymized on a commercially reasonable schedule, except where longer retention is required by law.

    Password-reset tokens are short-lived. Application logs may be retained for security and troubleshooting for a limited period.

  9. International data transfers

    We may process personal data in countries other than where you are located (including through hosting and subprocessors). Where required, we use appropriate transfer mechanisms (such as Standard Contractual Clauses) as described in our DPA.

  10. Your privacy rights

    Depending on your location, you may have rights to access, correct, delete, restrict, or port personal data, to object to certain processing, and to withdraw consent. To exercise rights regarding data we control, contact [email protected].

    If we process data solely as your processor, we will direct you (or the data subject) to the relevant customer/controller, and assist that customer as required by our DPA.

  11. Notice to California residents

    California residents may have rights under the CCPA/CPRA, including rights to know, delete, and correct personal information, and to non-discrimination for exercising rights. Categories of personal information we collect are described in Sections 3–5 (identifiers, commercial information, internet activity, and professional information).

    We do not sell personal information. To submit a request, email [email protected]. We may need to verify your identity before responding.

  12. When we act as a processor

    When you submit support diagnostics, contact messages, or other Customer Content containing personal data for Pam Terminal to handle on your behalf, we process that personal data as a processor/service provider. We will:

    • process it only to provide and secure support and related Account Services and per your documented instructions;
    • not use it for our own marketing;
    • require subprocessors to protect it appropriately; and
    • assist with data subject requests as described in the DPA.

    You remain the controller of that data and are responsible for the lawfulness of your instructions and for notices to your users. Self-hosted session and vault data that never leaves your environment is outside this processor relationship.

  13. Subprocessors

    We use selected subprocessors and service providers. Depending on features you use, these include:

    • infrastructure / hosting providers for the Site and Account Services;
    • Lemon Squeezy for payment processing and merchant-of-record functions;
    • Google (reCAPTCHA) for bot protection on forms; and
    • email delivery infrastructure used to send transactional messages.

    A list of Subprocessors is available on request at [email protected]. We provide notice of material changes where required by the DPA or applicable law.

  14. Marketing communications

    We may send product updates and marketing to work emails you provide, subject to your profile preferences where available. You can opt out via the unsubscribe link, profile settings, or by emailing us. Security and account messages (such as password reset and email verification) are not marketing and may still be sent. Optional system emails—payment receipts, license keys, and expiry reminders—follow your System notifications preference in your profile. Optional onboarding tips may be sent the first time you download a release from Products if Onboarding is enabled. Merchant-of-record providers may also send their own payment receipts independently of those settings.

  15. Children’s privacy

    The Services are not directed to children under 16 (or a higher age required by local law), and we do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us and we will take appropriate steps to delete it.

  16. Changes to this Privacy Policy

    We may update this Privacy Policy from time to time. Material changes will be indicated by updating the “Last updated” date and, where appropriate, additional notice. Continued use of the Account Services after the effective date constitutes acceptance of the updated policy.

  17. Contact information

    For privacy questions or requests:

    Pam Terminal
    Attn: Privacy
    [email protected]