Privacy Policy

1. Who We Are

VMSTools Pro is a product of OpenWare Pro LLC (“OpenWare,” “we,” “us,” or “our”), a Colorado limited liability company. We provide a cloud-based SaaS platform for remotely monitoring, managing, and maintaining Milestone XProtect video management systems. Our public website is at vmstools.pro, and the platform is accessible at app.vmstools.pro.

This Privacy Policy describes how we collect, use, store, and protect information when you visit our public website, apply for access, or use the VMSTools Pro platform, including the web dashboard, the VMSTools Pro Agent, and the Tray Application (collectively, the “Service”). By using the Service, you agree to the practices described in this Policy.

2. Information We Collect

This Policy separates two things:

• Routine operation: what the Service does on its own once the Agent is installed, such as health monitoring and telemetry. Sections 2.1 through 2.9 describe this, along with information you provide to us directly.
• Tools you choose to run: reports, scripts, video export, backups, diagnostics, and similar tools that act only when you start them. Section 2.11 describes this.

2.1. Account Information

When your application is approved and your account is created, we collect your name, email address, organization name, and password. Passwords are stored as cryptographic hashes using industry-standard algorithms and are never stored in plain text. We also store your selected role, display preferences, and account settings. For security, the Service keeps an activity log of account actions, which records the IP address of the user and an approximate location derived from it.

2.2. Phone Numbers

Customers may optionally provide a mobile phone number to receive SMS and MMS notifications about events on their own video surveillance systems. Phone numbers are verified via a one-time passcode sent to the number before being saved as a delivery channel.

2.3. System Telemetry

The VMSTools Pro Agent collects and transmits system performance telemetry from machines where it is installed. This includes: CPU utilization and processor information; memory usage and allocation; disk capacity, usage, and I/O performance metrics; network interface throughput; running process names and their resource consumption; Windows service status; the Agent host’s computer name and its local and public network addresses; the name (not the password) of the XProtect account the Agent signs in with, which is used to identify the Agent’s own activity in audit log views; and XProtect-specific metrics such as camera count, recording server status, and storage allocation. Telemetry is collected at approximately 60-second intervals. To determine the public network address, the Agent contacts a third-party service directly (see Section 5.7).

2.4. XProtect Configuration Metadata

During routine operation, the Agent collects XProtect configuration data including: camera names, hardware device names, recording server assignments, storage configurations, retention settings, user-defined properties, system topology information, and license information such as the software license code, device license counts, and Care Plus dates. This metadata describes the configuration of your video management system but does not include video footage or passwords. Tools you choose to run may gather additional details, as described in Section 2.11.

2.5. Audit Log Data

If you enable audit log collection, the Service captures XProtect audit log records. These records may include: XProtect usernames, workstation identifiers, timestamps, event types (login, playback, export, search, configuration change), and associated metadata such as camera names and time ranges accessed. Audit log data may contain personal information in the form of usernames and workstation identifiers.

2.6. Community and Communication Data

If you use Community Chat, Ideas, or Bug Report features, we collect the messages, images, reactions, and other content you post. Community Chat messages include your chosen display name, avatar, and timestamps. Community content is visible to all users of the Service.

2.7. Health Check and Report Data

When you run system health checks, we collect the findings, configuration assessments, performance measurements, and any notes you provide. Health check reports are generated and stored within your Tenant.

2.8. Scripts

If you use the Script Editor or Workbench tools, we store the scripts you create and their execution metadata (timestamps, success/failure status). Script content may include references to your system configuration.

2.9. Usage and Website Analytics

In the platform: We collect information about how you interact with the Service, including pages visited, features used, session duration, and browser and device information (user agent, screen resolution). This data helps us understand usage patterns and improve the Service.

On our public website: We use Umami, a privacy-focused analytics tool that we host on our own infrastructure, so no third party receives this data. It records the page URL and title, referring site, campaign tags (UTM parameters), browser, operating system, device type, screen size, language, country or region, and events such as a completed application. Your IP address is used only momentarily to determine country or region and is not stored. Visitors are counted using a rotating, salted hash rather than a persistent identifier. Website analytics use no cookies and no cross-site tracking.

2.10. Application Information

When you apply for access at vmstools.pro/apply, we collect your name, work email, company, and role; your XProtect version, number of Management Servers, approximate camera count, and industry; your optional answer to “What problem do you hope VMSTools Pro will solve?”; whether you are willing to give occasional feedback; and your acknowledgment of this Policy. With each application we also automatically record your IP address, your browser’s user agent, the page that referred you to the form, and any campaign tags (such as utm_source, utm_medium, and utm_campaign) in that page’s address. We use this information to evaluate your application, contact you about it, limit abuse of the form (for example, by limiting how many applications can be sent from one network), and understand customer needs so we can improve the Service. Submitting an application does not create an account.

2.11. Data From Tools You Choose to Run

Beyond routine operation, the Service provides tools such as reports (for example, the Camera Report), scripts, video export, system backup, and diagnostics. These tools act only when a user starts them, and each one shows what it will do. Depending on what you select, a tool may gather details such as camera network addresses, camera usernames, MAC addresses, still images (snapshots) from your cameras, or other configuration and system information. You decide what a tool gathers, whether its results are saved in your Tenant, and where they go. If you direct the Service to send or share content, such as sending a video export or file to a destination outside your network or sharing it with others, that content travels through our infrastructure as needed to carry out your request and is kept only for as long as you choose to keep it there. This content is your data, and we handle it only to carry out your instructions (see Section 4.8 of our Terms of Service).

3. What Routine Operation Does Not Collect

We want to be explicit about what the Service does not collect or access during routine operation:

Passwords: Your XProtect passwords are stored locally on the machine where the Agent is installed. They are never transmitted to, stored on, or accessible by the VMSTools Pro Cloud Platform. None of the Service’s built-in reports or tools collect camera passwords.

Video Footage: Routine operation never accesses, transmits, or stores video. Video moves only when you use a tool such as Video Export, and only to the destination you choose.

Direct Camera Connections: The Service interacts with cameras through the XProtect Management Server. We never connect directly to cameras.

Analysis of Surveillance Content: The Service does not perform facial recognition, license plate recognition, or any other biometric analysis. Routine operation does not capture camera images. Tools that capture still images (snapshots), such as Camera View Integrity, store those images in your Tenant. They may show people or vehicles, and they are your data under Section 2.11.

Tools you choose to run act on your instructions, as described in Section 2.11.

4. How We Use Your Information

We use collected information for the following purposes:

(a) To provide, operate, maintain, and improve the Service, including rendering dashboards, generating reports, processing commands, and delivering telemetry-based alerts and advisories;

(b) To authenticate your identity and secure your account;

(c) To send service emails, including application updates, welcome messages, agent installation links, password reset notifications, account security alerts, and notices of changes to our Terms or this Policy;

(d) To send occasional product news, such as launch announcements and new features, as described below;

(e) To evaluate applications for access and contact applicants;

(f) To provide AI-powered features, as described in Section 6;

(g) To respond to your support requests, feedback, and bug reports;

(h) To monitor and analyze usage trends to improve the Service; and

(i) To comply with applicable legal obligations.

Product news. When you apply or create an account, we may send you occasional product news. Every product-news email includes an unsubscribe link, and you can unsubscribe at any time. Unsubscribing does not stop service emails about your application, account, or security, which are necessary to provide the Service.

5. Data Sharing and Third-Party Services

We do not sell, rent, or trade your personal information to third parties. We share data only in the following limited circumstances:

5.1. Service Providers

We use third-party services to operate the platform. As of the date of this Policy, these include: Resend / Amazon SES for email delivery, Twilio for SMS/MMS notification delivery, and Anthropic for AI-powered features (see Section 6). These providers process data only as necessary to deliver their respective services.

5.2. AI Processing

When AI features are invoked, certain data is transmitted to Anthropic’s API for processing. Some AI features, such as the AI Advisor, show you the data used with each response. See Section 6 for details.

5.3. Cross-Tenant Community Features

Content you post in Community Chat, Ideas, or Bug Reports is visible to all users of the Service across all Tenants. Do not share confidential or sensitive information through Community Features.

5.4. Legal Requirements

We may disclose information if required by law, regulation, subpoena, court order, or other legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, the safety of others, or to investigate fraud or a security incident.

5.5. Business Transfers

In the event of a merger, acquisition, or sale of substantially all of our assets, your information may be transferred as part of the transaction. We will notify you of any such transfer and any choices you may have regarding your information.

5.6. SMS/MMS Notification Data

Phone numbers and SMS/MMS opt-in consent are not sold, shared with third parties or affiliates for marketing or promotional purposes, or used for any purpose other than delivering the operational notifications the customer has personally configured for their own systems.

When a customer enables SMS/MMS notifications, their phone number is shared only with our SMS delivery provider (Twilio) for the sole purpose of delivering the messages the customer has configured. Twilio processes this data under their own privacy policy and data processing agreements.

5.7. Services the Agent Contacts Directly

To show your network’s public IP address on the dashboard, the Agent asks a third-party service, api.ipify.org, for that address. The service sees your network’s public IP address and that a request was made. We do not send it any of your data, and it is not a processor of data on our behalf.

5.8. Content You Choose to Send or Share

When you use a tool to send or share content with a destination or person you choose, that content goes where you direct it. See Section 2.11.

6. Artificial Intelligence Data Processing

This section describes how data is processed by AI features within the Service.

6.1. What Data Is Sent

When you use AI-powered features (such as the process advisor, health check report writer, or best practices analysis), the Service transmits specific contextual data to the AI provider’s API. This may include: system hostnames, performance metrics, advisory flags, process names and resource consumption, XProtect configuration metadata, health check findings, and notes you add to a health check. The AI Advisor shows you the data it used with each response.

6.2. What Data Is NOT Sent

The Service is designed to exclude the following from AI transmissions: XProtect credentials, IP addresses, camera credentials, video footage, audit log records containing usernames, and personally identifiable information. We make reasonable efforts to strip or anonymize sensitive data before AI transmission, but we cannot guarantee that all sensitive information will be excluded in all circumstances.

6.3. AI Provider

As of the date of this Policy, the AI provider is Anthropic, PBC. Anthropic’s privacy practices are governed by their own privacy policy, available at anthropic.com/privacy. Anthropic’s commercial API terms provide that customer data submitted through the API is not used to train their models. We may change AI providers in the future and will update this Policy accordingly.

7. Data Security

We implement industry-standard security measures to protect your data, including:

(a) Encrypted connections: All data transmitted between the Agent and the Cloud Platform uses encrypted WebSocket (WSS) over TLS. All web traffic uses HTTPS/TLS encryption.

(b) Password security: Account passwords are stored using industry-standard cryptographic hashing algorithms with salt. We never store passwords in plain text.

(c) Authentication: The Service uses JSON Web Token (JWT) based authentication with role-based access controls (Owner, Admin, Operator, Viewer).

(d) Tenant isolation: All data is logically isolated at the database level by Tenant ID. All queries and operations are scoped to your Tenant.

(e) Credential isolation: XProtect passwords remain on the Agent machine and are never transmitted to the cloud.

While we take reasonable precautions to protect your data, no method of electronic storage or transmission is completely secure. We cannot guarantee absolute security.

8. Data Retention

We retain your information as follows:

Account Information: Retained for as long as your account is active and for thirty (30) days after account closure to allow for data export.

Telemetry, Audit Log Data, Command Results, and Reports: Currently kept for as long as your account exists, and deleted within thirty (30) days after account closure. Configurable retention periods are coming. If you ask us for a shorter retention period before then, we will honor it. You are responsible for determining the retention period appropriate to your regulatory requirements.

Health Check Reports: Retained within your Tenant for as long as your account is active.

Applications: Approved applications are kept for as long as the resulting account exists. Applications that are declined or never approved may be deleted after twelve (12) months of non-use. You may ask us to delete your application sooner.

Website Analytics: Kept in aggregate form. Website analytics do not store IP addresses or use persistent identifiers.

Community Content: Retained for as long as the content exists in the Community Features. You may edit or delete your own messages.

Anonymized Analytics: Anonymized, aggregated usage data that cannot identify you or your organization may be retained indefinitely.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

(a) Access: You may request a copy of the personal information we hold about you.

(b) Correction: You may update or correct inaccurate information through your account settings or by contacting us.

(c) Deletion: You may request deletion of your account, your application, and associated personal data. We will process deletion requests within thirty (30) days.

(d) Data Export: You may export your business data at any time through the Service’s built-in export features (CSV, PDF, and PowerShell script files).

(e) Opt-Out of AI Processing: You may decline to use AI-powered features. AI features are invoked only when you actively initiate them.

(f) Opt-Out of Product News: You may unsubscribe from product-news emails at any time using the link in any such email.

(g) Do Not Sell: We do not sell your personal information. If applicable privacy laws grant you a “do not sell” right, that right is satisfied by our existing practices.

To exercise any of these rights, contact us at privacy@vmstools.pro.

10. State Privacy Law Compliance

10.1. Colorado Privacy Act (CPA)

If you are a Colorado resident, you have rights under the Colorado Privacy Act, including the right to access, correct, and delete your personal data, and the right to opt out of the processing of your personal data for targeted advertising (which we do not engage in) or the sale of personal data (which we do not do). To exercise your rights, contact us at privacy@vmstools.pro.

10.2. California Consumer Privacy Act (CCPA)

If you are a California resident, you have additional rights under the CCPA, including the right to know what personal information we collect and how it is used, the right to delete your personal information, and the right to non-discrimination for exercising your privacy rights. We do not sell personal information as defined by the CCPA.

11. Cookies and Tracking

Public website (vmstools.pro): The public website sets no cookies. Website analytics are cookieless, as described in Section 2.9.

Platform (app.vmstools.pro): The platform uses a small number of cookies for sign-in: a session-renewal cookie and, if you choose “Remember this device,” a trusted-device cookie. Your sign-in token and display preferences are kept in your browser’s local storage.

We do not use advertising cookies, third-party tracking cookies, or behavioral advertising technologies. We do not participate in ad networks or cross-site tracking.

12. Children’s Privacy

The Service is designed for business use by IT professionals and is not directed at individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will take steps to delete that information promptly.

13. International Data Transfers

The Service is hosted in the United States. If you access the Service from outside the United States, you understand and consent to the transfer of your information to the United States, where data protection laws may differ from those of your jurisdiction. We will take reasonable steps to ensure that your information is treated securely and in accordance with this Privacy Policy.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of significant changes via email or in-app notification. Continued use of the Service after changes constitutes acceptance of the updated Policy. We encourage you to review this Policy periodically.

15. Contact

If you have questions about this Privacy Policy or your data, contact us at:

OpenWare Pro LLC 412 Sumner St Longmont, CO 80501 Email: privacy@vmstools.pro Web: https://vmstools.pro