Privacy Policy

Effective date: November 1, 2026

This policy explains what information Statewide Processing, Inc. ("Statewide", "we", "us") collects, how we use it, and your choices. It covers:

• statewideprocessing.net: our main website, including the contact form and online shop
• Statewide ID at login.statewideprocessing.net: the shared sign-in for our sites
• iRemote at iremote.statewideprocessing.net: our remote-desktop apps, web viewer, and relay servers

Together these are the "Services". ATM placement and processing agreements are covered by your separate written agreement with us.

1. The short version

• We collect what we need to run the Services: account details, device and connection records, order details, messages you send us, and security logs (including IP addresses).
• iRemote sessions are encrypted end to end between the two devices. Our relay passes along encrypted session data it can't read.
• iRemote does keep connection records: our servers keep per-PC session history (for 90 days) and a relay security log, and the app keeps a connection history on your own computer (365 days by default; you can change this in Settings).
• Card payments for iRemote are handled by Stripe. We never see or store your full card number. The online shop does not take payment online.
• We don't sell your personal information. We don't use advertising or analytics trackers.

2. Information we collect

2.1 Website and contact form

• Contact form. Your name, email address, phone number (if you give it), and your message. We use this only to reply to you, and we keep contact messages for up to 24 months.
• Server logs. Like most websites, our web server logs each request: IP address, date and time, page requested, referring page, and browser user agent. These logs are rotated daily and kept for 14 days.

2.2 Online shop

• Orders. When you place an order, we collect the shipping address, the billing address (or that it's the same as shipping), any order notes, and the items ordered. Your name and email (and phone, if you added one) come from your Statewide ID account. You can choose to save these addresses to your profile.
• Payment. The shop does not take card payments online. Placing an order does not charge you. After you order, we contact you to confirm stock, shipping and payment, and payment is arranged directly with you. No card details are entered in the shop.
• Cart. Your cart may be saved in your browser so it's still there when you come back.

2.3 Statewide ID (your account)

• Username, email address, whether your email is confirmed, account role and plan, when the account was created, and when the password was last changed.
• Password. Stored only as a salted one-way Argon2 hash. We can't see your password.
• 2-step sign-in (optional). If you turn on authenticator-app sign-in, we store your authenticator secret in encrypted form and your backup codes only as one-way hashes.
• Sign-in sessions. A hashed session identifier, when it was created and expires, and the IP address it came from.
• Security log. Sign-in events (successful and failed sign-ins, sign-outs, password changes, lockouts) with time, username, and IP address. We use this to spot suspicious sign-ins, including emailing you when your account signs in from a new IP address. We also keep short-lived counters of failed attempts to block password guessing.
• Admin actions. When our staff change an account, we log who did it, what changed, the time, and the IP address.

2.4 iRemote

• Devices. For each PC or Mac you add to your account: the name you give it, platform (e.g. Windows, macOS), a device identifier/fingerprint, a hashed device token, and when it was added, last seen, and removed. During device sign-in we briefly store a pairing code and the requesting IP address.
• Per-PC session history (our servers). For each session: the device, start time, duration, connection mode (e.g. view-only or control), the viewer's display name, and a session reference. This shows in your account under your PCs.
• Relay security log (our servers). For each connection attempt: time, session ID, the connecting IP address, mode, outcome (e.g. connected, rejected, rate-limited), and duration.
• Support links. If you create one, we store a hashed token, the device, an optional note, and when it was created, used, expires, or was revoked.
• Update checks. The apps check our server for updates. These requests include the app version, platform, and your IP address, but not your account or device ID.
• Stored only on your computer. The app keeps settings, trusted-device keys, and a local connection history (metadata such as time, session ID, and peer, never screen, keystroke, or clipboard content). It's kept 365 days by default; you can set it from 1 to 3,650 days in Settings. We don't receive this data.

Session content. The screen image, keyboard and mouse input, clipboard text, and files you transfer are encrypted on one device and decrypted only on the other (ECDH P-256 key exchange, AES-256-GCM). Our relay forwards this encrypted data in real time and can't read it.

How a connection is approved. You connect with a session ID. By default, the person at the target computer sees a prompt and must approve each connection, and both screens show a 6-digit security code you can compare before trusting a new device.

2.5 Billing (iRemote)

Your first PC is free. Extra PCs are $5 per PC per month, billed monthly through Stripe's hosted checkout. We store your Stripe customer and subscription IDs, subscription status, number of extra PCs, billing-period end date, and payment-failure status. We also keep a record of Stripe billing events. You enter card details on Stripe's pages; we never receive your full card number. See Stripe's Privacy Policy: https://stripe.com/privacy.

2.6 Email

We send account, security, and billing emails (confirmation, password reset, new sign-in alerts, payment notices) through Zoho Mail. Each message waits in a queue until it's sent. The message body (which may contain one-time links) is deleted once sent, or after 3 days if it can't be delivered.

3. Cookies and tracking

We use only the cookies the Services need to work:

The shop may also save your cart and preferences (such as light/dark theme) in your browser's local storage.

We don't use Google Analytics, advertising pixels, or other third-party tracking. Our captcha runs on our own server, and our fonts are served from our own server. (Checked on the public pages on October 31, 2026. Update this section if you add analytics later.)

4. How we use information

To provide and run the Services; create and protect accounts; connect your devices; show you your devices and session history; process and fulfil orders; bill subscriptions; reply to messages; send service and security emails; detect and stop fraud, abuse, and unauthorized access; deliver software updates; meet legal, tax, and accounting duties; and enforce our Terms of Use.

We don't use your information for advertising, and we don't sell or rent it.

5. Who we share it with

Only service providers that help us run the Services, and only what they need:

• Stripe: iRemote payments and subscriptions
• Zoho Mail: sending email
• Hosting provider: our servers are hosted in the United States
• Shipping carriers: the name and address needed to deliver shop orders

We may also disclose information when the law or valid legal process requires it; to protect the rights, safety, or property of our users, the public, or us; or as part of a merger, acquisition, or sale of assets (this policy would keep applying to your information).

6. How long we keep it

Stripe keeps payment records under its own policies.

7. Your choices and rights

• See and fix your data. When signed in, you can view your devices, session history, and billing status; rename or remove devices; change your password; and turn 2-step sign-in on or off.
• Billing. Manage or cancel your subscription from your Billing page (through Stripe's billing portal).
• Local history. Change how long the app keeps connection history in iRemote Settings.
• Delete your account or get a copy of your data. Email statewidep@gmail.com. When we delete an account, we sign it out everywhere, revoke its devices, and remove the account. Some records (security logs, billing and tax records, backups until they roll off) may be kept as described in Section 6.
• Depending on where you live, you may have other rights (to access, correct, delete, or port your data, or to object to processing). Email us to use them. We won't treat you differently for doing so.

8. Security

We use end-to-end encrypted sessions, HTTPS, Argon2 password hashing, encrypted 2-step sign-in secrets, hashed session and device tokens, rate limiting, account lockouts, and signed software updates. No system is perfectly secure, so please use a strong, unique password and turn on 2-step sign-in. If we learn of a breach affecting your personal information, we'll notify you and the authorities as the law requires.

Report security issues to statewidep@gmail.com.

9. Children

The Services aren't meant for children. You must be at least 18 years old to create an account. We don't knowingly collect information from anyone under 18. If you think a child has given us information, email us and we'll delete it.

10. Where data is processed

Our servers are in the United States. If you use the Services from somewhere else, your information is transferred to and processed there.

11. Changes to this policy

We may update this policy. If we make a material change, we'll post the new version here with a new effective date and, where appropriate, tell you by email or in the Services.

12. Contact

Statewide Processing, Inc.
9016 E 46th St, Tulsa, OK 74145
Email: statewidep@gmail.com