REC Privacy Policy

What REC does

REC watches you carry out a procedure on your computer, in SAP, in the browser or in Windows applications, and turns it into a step-by-step document, in Word and PDF, with an image of each step, as well as process diagrams and automation scripts. All of this happens locally, on your machine.

Account and license

REC is contracted by companies, and accounts are created by Atomic Solutions at the request of the client company. To sign in and keep the license valid, the application talks to the Atomic license server over an encrypted connection (HTTPS). It sends:

• When you sign in: your e-mail and your password. The password is checked and never stored as text: the server keeps only a cryptographic digest of it.
• Device identification: a code computed from the Windows identifier and the user name on the machine, turned into a digest (hash) from which those values cannot be recovered, plus the computer name and the REC version. It binds the license to the machine and feeds your company's usage report.
• When the application opens: the license renewal, with the same device data. Without internet, REC keeps working for a grace period.
• Forgotten password or password change: the e-mail and the language, to send the reset code, and the new password. The code arrives by e-mail.
• Corporate sign-in: when your company uses corporate sign-in, authentication happens at your company's identity provider, in the browser, and REC receives only the confirmation of who you are.

The server keeps your name and e-mail, the company and contract you belong to, the machines where you signed in (with the REC version and the first and last access dates), the open sessions and a log of security operations. Like any internet service, it also records the IP address and the date and time of each access.

The license server and the e-mail delivery run on Amazon Web Services, in a data center in the United States, which is an international data transfer made with the safeguards provided by the Brazilian LGPD. The data is kept in a private network, encrypted in transit and at rest, with access restricted to the Atomic Solutions team.

What you record (images, text and steps) is not part of any of this and never leaves your computer.

What the application accesses during a recording

To describe each step, REC needs to observe what is happening on screen. While a recording is active, it accesses:

• Screen images. One capture per step, of the window you selected or of the full screen, according to your choice. These images contain everything visible at the moment of capture.
• Typed values. Keystrokes are converted into text so the step is described usefully ("Fill in the Customer field with ACME Ltd").
• Window, field, button, and menu names. From the applications you use during the recording.
• Addresses of the pages you visit. When you record a procedure in a browser, in Web mode or through the extension, because the address is part of the procedure.
• SAP transaction, screen, and field names. When you record a procedure in SAP GUI.

Because REC captures your screen, the resulting images and text may contain personal information, yours or that of other people, depending on what is open at the time of the recording. That is why this policy exists, and why the protections below matter.

Passwords

REC does not capture passwords. When the field in use is a password field, or when the application cannot safely confirm that it is not, it never translates the keystrokes into characters: it records only that typing occurred, and the final document reads "Type the password in the X field".

The criterion is deliberately conservative. When in doubt, REC treats the field as a password and does not record its content.

Hide typed values

Beyond the automatic password protection, there is a Hide typed values option on the main screen. With it enabled, every typed value is replaced by ••• in the generated document, preserving the description of the step without exposing its content.

Use this option when documenting a procedure with real data from customers, patients, employees, or any information that should not appear in the final document. The option is off by default and the choice is yours on every recording.

Extension for Edge and Chrome

In the Complete process, REC can record the pages in the user's own Edge or Chrome through the REC: browser recording extension. The extension is optional and only works together with REC installed on the same computer.

• What it reads: while REC records a Complete process, the clicks, what is typed in fields, form submissions, the page addresses and an image of the tab at the moment of each action. Outside a recording, it records nothing.
• Where it goes: only to REC on the same computer, over a local connection (127.0.0.1). The extension sends nothing to Atomic Solutions or to third parties.
• Pairing: the first time, you type in the extension the 6-digit code that REC shows. The extension keeps a pairing token and the recording state, and REC keeps only a digest (hash) of that token. Only paired extensions can talk to REC.
• Passwords: the value typed in password fields never leaves the page: the step records only •••.

To remove it, just uninstall the extension from the browser: the pairing token is deleted, and the digest kept by REC becomes useless.

Where the information is stored

The recordings and what the application needs to work stay on your computer:

• Recordings (.rec) and generated documents (Word and PDF): in the folder you choose when saving. REC keeps no copy anywhere else.
• Settings, diagnostic log and automatic recovery save: in %LOCALAPPDATA%\AtomicSolutions\REC\ (up to version 1.0.1, %LOCALAPPDATA%\SAPDocRecorder\). In the version installed from the Microsoft Store, Windows redirects these files to the application's isolated folder, under %LOCALAPPDATA%\Packages\.
• License: the license.bin file, in the same folder, with the license signed by the server, your name and e-mail and the renewal token. It is encrypted by Windows and can only be read by your user on this machine.
• Web mode browser profile: in %LOCALAPPDATA%\AtomicSolutions\REC\WebProfile. When you record a procedure in a browser, REC opens the Edge or Chrome already installed on your machine using a dedicated profile, separate from your personal one. If you sign in to a site during the recording, the cookies of that session stay in this folder, on your computer. Deleting it removes those sessions.

The diagnostic log records the internal behavior of the program, errors and technical events, so that a problem can be analyzed. It stays on your machine and is never sent anywhere. If you choose to send us a log when requesting support, that is your own action, and it is worth opening it first to check the content.

What REC does not do

• It does not send what you record. Images, text, steps and documents stay on your computer. The license server receives only the account and device data described above.
• It does not collect telemetry. It does not record which features you use, what you record or for how long.
• It does not install updates on its own. Updates come through the Microsoft Store; the license server only states the minimum accepted version.
• It shows no ads and does no advertising tracking.
• It does not sell or share information with third parties. The only services involved are the infrastructure ones that keep the license server and the e-mail delivery running.
• It records nothing unless you start a recording. Outside an active recording, neither REC nor the extension watches your screen, your keyboard or your browser.

Who is responsible for each piece of information

The content of your recordings is yours and remains exclusively under your control. Atomic Solutions does not receive, store or process that content.

Under the LGPD and the GDPR: when you record a procedure that contains personal data of third parties, you, or the organization you work for, are the controller of that data, and Atomic Solutions acts neither as controller nor as processor of it. The account and license data described above, on the other hand, is handled by Atomic Solutions to perform the contract with your company and to protect access to the product against misuse.

If your procedure involves personal data of customers, patients, or employees, it is up to your organization to define the legal basis for processing and the rules for storing and circulating the generated document. The option to hide typed values and the choice between capturing a specific window or the full screen exist precisely to help with that.

Deletion

What is on your computer you delete whenever you want:

• The recordings and documents, in the folder where you saved them.
• The %LOCALAPPDATA%\AtomicSolutions\REC\ folder, which holds settings, logs, the license, the automatic save and the browser profile of Web mode.

Uninstalling the application through the Microsoft Store also removes the files it kept in the isolated area of the package.

The data on the license server is kept while your account exists. To request access, correction or deletion, talk to your company or to our data protection officer (contact below). Server backups are deleted automatically within 35 days, and access logs (IP address, date and time) are kept for the six months required by the Brazilian Internet Civil Framework (Marco Civil da Internet).

Children

REC is a professional documentation tool used by companies. It is not directed at children.

Changes to this policy

If the behavior of the application changes in a way that affects what is written here, this page will be updated and the last updated date changed. Earlier versions of the application continue to behave as described in the policy in force at the time of their release.

Contact

Questions about this policy, or about data handling in REC: