Privacy Policy

The controller for clause 2 activities is [LEGAL_NAME] IKE, [REGISTERED_ADDRESS], GEMI [GEMI], VAT [VAT_ID]. Privacy contact: [PRIVACY_CONTACT]. [DPO_CONTACT_OR_NOT_REQUIRED: assess whether a DPO is required; do not name an unappointed DPO]. This notice covers visitors, Meteorack Account holders, customer representatives and support correspondents. Customer websites/apps have their own notices.

As controller we determine purposes/means for Meteorack Accounts, contract communications, our billing, support and necessary platform protection. Hosting content, customer Auth, databases, objects or app data on customer instructions makes us a processor or subprocessor under the DPA. Roles must be mapped per operation; telemetry is not automatically our controller data and billing is not automatically processor data. If you use a customer's service, contact its controller; we assist under the DPA and our own legal duties.

We collect supplied account/contact details, workspace/access identifiers, billing/tax information, service usage and support communications. We also receive request information, IP, user agent, timestamps and security events. Forms identify necessary fields; without them the related service or lawful billing may be unavailable. Optional information is not a service condition. An organisation administrator may supply invitation information; we provide required notices for indirectly obtained data.

Full card number/CVC is entered in Stripe Checkout/Elements and, according to source/owner review, does not reach our servers. Our Stripe webhook payloads can contain billing name/email/address, brand, last4, expiry and fingerprint, alongside customer/subscription IDs, invoices and retries. We do not claim to store only last4. Prompts, outputs, files and logs may contain personal data you submit; avoid unnecessary sensitive data and secrets.

For individuals contracting with us, account/service provision relies on contract/pre-contract measures, GDPR Article 6(1)(b). Organisation representative communication/access management is assessed as legitimate interest in secure service, Article 6(1)(f), with balancing. Lawful tax/accounting retention relies on Article 6(1)(c) after identifying specific obligations. Security, fraud prevention, minimum operational logs and defence of lawful claims rely on balanced legitimate interests or specific legal duties. Balancing does not permit unlimited collection/retention.

Unnecessary trackers and marketing requiring consent operate only after a separate lawful choice, not general Terms acceptance. Any lawful marketing exception needs documentation and easy objection. [MARKETING_PROCESSING] is unconfirmed. Special-category/criminal data needs an additional lawful condition; Terms alone do not supply one.

Authorised staff and contracted providers access data only as needed. The DPA register distinguishes Hetzner/Backblaze and possible customer-data telemetry from Resend for our account emails, Stripe payments and your own services. Cloudflare authoritative DNS is confirmed; full current proxy/tunnel scope is not. Grafana Cloud receives selected operational logs; contracting entity and exact country need confirmation. Self-hosted Ory Kratos/Hydra are not themselves outside providers.

Accounting/legal advisers and competent authorities receive only necessary data for lawful purposes. Complete [OTHER_RECIPIENTS_AND_ENTITIES]. SoftOne/myDATA is planned, not claimed live. Vague notice does not authorise customer content transfers to unknown AI providers; specific mapping is required before use/publication.

Confirmed primary infrastructure is at Hetzner FSN1, Falkenstein, Germany. M3 off-site backup uses Backblaze B2 EU Central, Amsterdam, Netherlands. Resend's sending region is eu-west-1, Ireland; this does not establish support/metadata/storage residency. DNS, support, payments, AI or external logs need separate international-transfer assessment. We do not promise EU-only processing.

For transfers outside the EEA complete [TRANSFER_REGISTER]: recipient, countries/remote access, adequacy decision or actually executed SCCs/other mechanism, assessment and supplementary safeguards as necessary. Request applicable safeguards at [PRIVACY_CONTACT], subject to necessary lawful redactions. No executed SCCs or DPF certification is claimed without contractual evidence.

Retain data only as needed for its purpose/law. [RETENTION_SCHEDULE] must state specific periods or clear criteria, trigger dates, deletion jobs and review per category. Counsel/accountant must establish corporate/tax retention by specific provision and lawful extensions; no universal ten-year rule is adopted.

Current account deletion deactivates identity and revokes sessions/tokens; no permanent purge or purge_after deadline is established. [ACCOUNT_ERASURE: 30 or 90 days] is undecided, not an active deadline. Organisation ownership with other members needs transfer/resolution but cannot indefinitely defeat lawful rights. Account closure does not itself erase every workspace/customer record.

Owner/source snapshot: API/usage/Edge DDL records have 90-day TTLs, while some rollups and Copilot journal/steps have no terminal expiry. Stripe webhook retention is unknown. Grafana readback indicates 31 days versus an older 14-day portal indication. These are not a verified universal deletion schedule. M3 B2 backups have 45-day Object Lock per version; “about 45 days after deletion” is an estimate, not a guaranteed deadline. Lawful minimisation, isolation from ordinary use, manifest handling and reapplication of deletions after restore are needed. A self-selected lock does not exempt mandatory rights.

Use risk-appropriate measures and the verified security annex. We promise no absolute security, universal backup encryption or certification. B2 bucket at-rest encryption is unconfirmed. Control evidence needs updating before adoption. Report suspected incidents to [email protected].

Subject to GDPR conditions, request access, correction, erasure, restriction, portability and objection. Withdraw consent without affecting earlier lawfulness. Direct-marketing objection is respected without further balancing. Contact [PRIVACY_CONTACT]; we request only proportionate identification. We normally respond within one month. A lawful extension by up to two further months for complexity/number of requests is notified within the first month with reasons. We explain refusal and remedies. Complain to the HDPA or the competent authority of residence/work/infringement, and seek judicial remedies. Prior contact with us is not required for an authority complaint.

[AUTOMATED_DECISION_REGISTER] must verify billing/abuse scoring, Copilot and any Article 22 decisions, effects, appropriately explained logic and human intervention rights where applicable. “No automated decisions” is unverified. [AGE_ELIGIBILITY] and child-data handling need a decision. Business targeting does not establish that customers host no children's data.

The cookie notice includes a source inventory and outstanding browser verification. Unnecessary storage needs the relevant choice before activation. Material changes require clear notice before new processing and fresh consent where required. Complete [EFFECTIVE_DATE] only after review.