Privacy policy

1. Who is responsible

The controller for the processing described in this policy is Marius Steinbach, Endresstraße 94-96 TOP 15, 1230 Vienna, Austria. Contact [email protected] for privacy enquiries and requests, or [email protected] for general enquiries. Further operator information is in the imprint.

2. Data, purposes and legal bases

Where the GDPR applies, we use the legal bases below. Contract necessity under Article 6(1)(b) applies when you are personally a party to the contract or ask us to take steps before entering one. For people acting for a business customer, the corresponding basis is our legitimate interest in administering that customer's service under Article 6(1)(f).

Visiting and securing the service

We process connection and request information such as IP address, request time, requested address, browser/device information, response status and security events to deliver the website, maintain connections, diagnose faults and protect accounts and infrastructure. Our legal basis is Article 6(1)(f): our legitimate interests in operating a reliable service and preventing fraud, attacks and misuse. Information necessary to deliver a service you have ordered is also processed under Article 6(1)(b).

Accounts, authentication and collaboration

We process your name, email address, account and sign-in identifiers, verification status, authentication and security records, access permissions, memberships, invitations and account settings. These let us authenticate you, control access, support collaboration and manage your account. Our bases are contract necessity and the legitimate interests described above, including preventing unauthorised access. Authentication is operated by localhorst; the central account system is hosted in Austria.

Building, hosting and managing applications

We process project and service settings, region selections, uploaded source and deployment files, application data, build/deployment records, resource measurements, logs and backup selections to provide the services ordered. Account administration and usage accounting rely on contract necessity or legitimate interests as described above. Personal data inside customer applications is handled in the role explained in section 8.

Billing and payments

We process billing contact details, address and tax information, purchased services, measured usage, invoice amounts, payment/subscription identifiers and payment status to calculate charges, collect payment and resolve billing enquiries. Our bases are contract necessity and Article 6(1)(c) for applicable tax and accounting obligations. Fraud prevention and resolving payment disputes also serve our legitimate interests under Article 6(1)(f). Stripe processes payment details, including the payment method information you provide to it. We receive the billing and transaction information needed to administer your purchases.

Messages, complaints and legal obligations

We process contact details, correspondence and supporting information you send us to answer enquiries, handle complaints, respond to privacy or abuse reports, and establish, exercise or defend legal claims. Depending on the request, the basis is contract necessity, Article 6(1)(c) for legal obligations, or Article 6(1)(f) for our legitimate interests in responding and protecting legal rights. Please avoid sending passwords, payment card details or unrelated sensitive data.

Required information and automated decisions

Account, billing and service information identified as required is necessary to enter into or perform the contract, protect access or meet legal obligations. Without it, we may be unable to open your account, accept payment or provide the requested service. Newsletter registration is optional.

We do not use your personal data to make solely automated decisions producing legal or similarly significant effects within Article 22 GDPR. Automated security controls may limit suspicious requests; you can contact us to request review of an access restriction. Stripe's own payment and fraud decisions are addressed in its privacy information.

3. Newsletter and invitations

We send product news by email only with your consent under Article 6(1)(a) GDPR and the applicable electronic-marketing rules. We use your email address, confirmation time and the version of the consent you accepted to manage that permission. A confirmation step verifies your subscription. You may withdraw consent at any time using the unsubscribe link or by emailing [email protected]. Withdrawal does not affect the lawfulness of earlier processing and has no effect on your paid services.

Short-lived security records help limit repeated subscription requests and prevent confirmation-link replay. These use pseudonymous fingerprints or token digests rather than a historical list of requested mailboxes. Their basis is our legitimate interest in preventing abuse.

If someone invites you, we receive your email address from that person and process it with the invitation and its status to deliver and manage the invitation. Our legitimate interests are enabling requested collaboration and preventing misuse; an invitation does not subscribe you to marketing. Contact us if you did not expect an invitation or want its data removed.

4. Service providers and disclosures

Access is limited to people and providers who need the data for their tasks. Recipients include infrastructure and storage providers for the relevant hosting region, operational monitoring providers, and the following services:

• Cloudflare: DNS, traffic delivery and protection, Web Analytics, and email delivery. Traffic protection processes request, connection and security information; email delivery processes recipient addresses, message content and delivery information. See Cloudflare's privacy policy.
• Stripe: payment processing, billing and associated fraud prevention. Stripe receives billing, transaction, device and payment information as necessary for those activities. It acts as a processor for some activities and an independent controller for others, including its own regulatory and fraud-prevention purposes. The responsible Stripe entity depends on the service and location; see Stripe's privacy policy and Privacy Center.
• Professional advisers and authorities: accountants, legal advisers, courts and competent authorities where necessary for legal obligations, accounting or the establishment, exercise or defence of claims.

Processors act under appropriate data processing terms and instructions. Independent controllers are responsible for their own processing. We do not sell personal data or share it for third-party behavioural advertising. Other members of a customer workspace can see information their permissions require, such as membership and project activity.

5. Locations and international transfers

The central localhorst application, account database and authentication system are hosted in Austria. Customer applications are hosted in the region selected for the project. Region selection describes application hosting; it is not a promise that account administration, payments, email, traffic protection or support are processed only in that region.

Cloudflare and Stripe operate internationally and may process data in the United States and other countries outside the European Economic Area. Choosing a region outside the EEA can also involve an international transfer of application data. Where the GDPR applies, transfers require a valid Chapter V basis: an applicable European Commission adequacy decision, or appropriate safeguards such as the Commission's standard contractual clauses with additional measures where necessary. An adequacy framework is relied on only for a recipient and processing actually covered by it.

For the safeguards applicable to a particular transfer, or a copy of relevant safeguards with confidential material redacted where necessary, contact [email protected]. Provider privacy information linked above describes their international processing. Customer-hosted transfers must also comply with the applicable data processing agreement and the customer's instructions.

6. Cookies, browser storage and analytics

• Sign-in and security: the __Host-localhorst cookie carries an opaque session reference. Sign-in is limited to at most one hour, or an earlier token expiry. Authentication, correlation and anti-forgery cookies protect sign-in and forms. These are used to provide requested access and secure the service.
• Theme preference: browser storage remembers your selected light/dark appearance until you change it or clear the stored preference.
• Cloudflare security: Cloudflare may use security cookies when its protection features require them. Names and lifetimes depend on the feature; Cloudflare's cookie information describes these, including the 30-minute __cf_bm cookie where bot protection uses it.
• Cloudflare Web Analytics: we use aggregate page-visit and performance measurements to understand website use and improve performance. Cloudflare describes this service as using no analytics cookies, local storage or individual visitor fingerprinting. Where personal data is involved in transmitting measurements, our basis is our legitimate interest in understanding website performance, subject to any consent required by applicable law. See Cloudflare Web Analytics.
• Stripe payment pages: Stripe may use its own cookies and device information to process payments and prevent fraud. See Stripe's cookie policy for its purposes and controls.

We do not use additional advertising or cross-site marketing trackers. Where a technology requires consent, it must be enabled only after that consent. You can clear stored cookies and preferences through your browser; doing so may sign you out or affect requested functionality. The absence of analytics cookies does not remove other applicable data-protection requirements.

7. Retention and deletion

We keep personal data only for its stated purpose, subject to the following limits and exceptions:

• Uploaded source archives: only as long as needed for build preparation and delivery, and no longer than 48 hours after upload. This limit applies to uploaded source; application content copied into a deployed image or runtime remains part of that service until removed.
• Build artifacts and application data: while needed to supply the service, maintain the active release or perform a requested rollback, export or recovery; removal follows service deletion and the applicable retrieval rights. Keeping a service stopped does not itself delete its data.
• Operational logs: 90 days from collection, followed by deletion or irreversible anonymisation, unless a specific legal obligation or documented incident/claim requires restricted retention of relevant records.
• Backups: no longer than 90 days after creation. A selected shorter retention period or explicit deletion can remove customer backups sooner. Deleted data in protected recovery copies expires within this maximum and is not used for ordinary processing; if a copy is restored, applicable deletion instructions must be reapplied.
• Account and authentication data: for the account's lifetime and then only as needed to complete deletion, authorised retrieval, outstanding billing, security and legal obligations. Expired sessions no longer grant access. Account deletion does not delete another customer's separately controlled workspace data or its lawful records of your participation.
• Newsletter: until consent is withdrawn or the mailing list is discontinued. Subscription abuse and confirmation-replay records expire after 24 hours and are normally physically removed within about 25 hours; an operational outage can delay that cleanup.
• Invitations and correspondence: while an invitation remains relevant, an enquiry or complaint is open, or the records are needed to document the relationship or resolve a dispute. We remove or restrict them when those purposes end.
• Invoices and tax records: generally seven years from the end of the relevant calendar year under Austrian retention rules, and longer where a pending proceeding or another applicable rule requires it. Records subject to a legal hold are restricted to that purpose and reviewed when the hold ends.

Provider records held by Cloudflare or Stripe for their own controller purposes follow their applicable policies and legal obligations. We instruct processors to delete or return data under the applicable contract. Contact us for the retention criteria applying to your particular records.

8. Customer-hosted personal data

A customer who determines why and how their application uses personal data is its controller; a customer acting for another controller may instead be a processor. localhorst acts as processor or subprocessor when it stores or otherwise handles that data on the customer's instructions. That role is separate from our controller role for accounts, billing and platform security.

Customers must have a lawful basis, provide appropriate notices, protect their application, and enter into the applicable Article 28 data processing agreement before submitting personal data for processing on their behalf. Their responsibility does not remove our own obligations as processor or controller. The agreement must govern instructions, confidentiality, security, subprocessors, transfers, assistance, incidents and return/deletion.

If your data is held inside a customer application, contact that application's operator first. We assist the relevant customer as required by the applicable agreement and law; we do not use hosted content for unrelated marketing or to train general-purpose AI models.

9. Your rights and complaints

Where the GDPR applies, you may request access, correction, erasure, restriction of processing and portability, subject to the conditions of those rights. You may withdraw consent at any time without affecting earlier lawful processing.

You may object to processing based on legitimate interests for reasons relating to your particular situation. You may object to direct marketing at any time, without giving a reason.

Send requests to [email protected]. We may need proportionate information to verify your identity. We respond without undue delay and normally within one month. If a permitted extension is necessary because of complexity or the number of requests, we explain it within that first month. Requests are normally free; statutory exceptions apply to manifestly unfounded or excessive requests.

You can complain to a competent supervisory authority, including the authority where you live or work or where the alleged infringement occurred. In Austria: Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, Austria; [email protected]; dsb.gv.at. You do not have to contact us before complaining.

Other mandatory privacy rights applicable in your country remain available.

10. Changes to this policy

We update this policy when our processing or applicable requirements change. The date above identifies this version. We give appropriate advance notice of material changes and obtain a new consent where required; publishing an update does not itself create consent or a new legal basis.