Privacy policy
Effective 2026-09-08 · Applies to chertrepat.com, the CHERT Repatriation Platform (app.chertrepat.com) and the CHERT Repatriation Server software.
Who we are
CHERT ("we") publishes CHERT Repatriation, software that moves an organisation's data from cloud providers to a server the organisation controls. Contact: legal@chertrepat.com. Security reports: security@chertrepat.com.
The two editions handle data differently
Server edition runs entirely on your own hardware. CHERT receives no data from it. Everything below about processing applies to the Platform edition only, except where stated.
Platform edition is a hosted control plane. It orchestrates a migration; it does not store your content. Message bodies, attachments, files and database contents flow from the source provider directly to your destination server over an encrypted tunnel or the provider's API. They are never written to CHERT systems.
What the Platform processes
- Account data: your name, work email, organisation, billing details, and the sign-in records needed to secure your account.
- Migration metadata: the list of users, groups, aliases and mailboxes in your source tenant; mailbox sizes and folder names; item counts and Message-ID hashes used to verify that the migration is complete; job status and logs with addresses and subjects redacted.
- Credentials: OAuth tokens and service credentials you authorise for your source and destination. They are stored encrypted in a secrets vault, bound to the migration job, and revoked automatically when the job closes.
- Audit trail: every consent, approval, credential use and cutover action, kept so that you can prove what was done and when.
Google user data
When you connect a Google Workspace tenant or a Gmail account, CHERT Repatriation requests access to directory information, Gmail (read), Gmail settings, Contacts (read) and Calendar (read). This access is used solely to copy that data to the destination server you designate and to verify the copy. CHERT Repatriation's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not allow humans to read it except with your explicit consent for support, and do not transfer it except to the destination you choose, as required by law, or as part of a merger where these commitments continue.
Microsoft user data
When you connect a Microsoft 365 tenant or an Outlook.com account, the same limits apply to data obtained through Microsoft Graph and Exchange Online: it is copied to your designated destination, verified, and not used for any other purpose.
Salla merchant data
When you authorise the CHERT Repatriation app on a Salla store, we read products, categories, customers, orders and coupons to copy them to your destination store. We never write to your Salla store.
Retention
Credentials are revoked at job close. Migration metadata and logs are deleted 90 days after a job closes unless you delete them sooner. The audit trail and signed verification report are kept for as long as your account exists, then deleted 30 days after account closure. Billing records are kept as required by law.
Where data is processed
Platform control-plane data is processed in the region you select when you create the organisation — currently the European Union (Frankfurt) — and is not moved between regions.
Sharing
We share data only with the infrastructure and payment providers needed to run the service, under contracts that restrict them to processing on our instructions; with authorities when legally compelled; and with no one else.
Your rights
You can export or delete your organisation's Platform data from the console at any time, and you can write to legal@chertrepat.com to exercise any right you have under applicable law, including the Saudi Personal Data Protection Law and the EU GDPR.
Changes
We will post changes here with a new effective date and notify Platform account holders by email at least 14 days before a material change takes effect.