Privacy Policy

1. Controller & Contact

Controller within the meaning of Art. 4(7) GDPR:

Binary Black
Hindenburgstr. 75, 77830 Bühlertal, Germany
Represented by: Dhivya Vinayagam
Email: binaryblack21@gmail.com
Phone: +49 17620818902

2. Data Protection Officer

A data protection officer is appointed where required (Art. 37 GDPR, §38 BDSG, in particular if at least 20 persons are regularly engaged in the automated processing of personal data). Data protection officer contact: [[TO BE FILLED: DPO contact details, or set to null if no DPO is appointed]].

3. Our Roles: Controller and Processor

For our website, customer accounts, billing and security of our own systems we act as controller. For the data our customers collect and manage through the Services (device telemetry and monitoring data, device identifiers, remote SSH session recordings and audit logs of the customer's own organisation, and the accounts of the customer's own users), the customer is the controller and we process the data on its behalf as processor under Art. 28 GDPR, based on our Data Processing Agreement. If you are an end user or device operator of one of our customers, please address your requests to that customer. Google (an independent controller for Sign-In) and the providers we use only for our own website (Formspree, Plausible) are not sub-processors for Customer Personal Data.

4. Website Visits & Server Logs

When you visit our website, the web server and its content delivery network process technical data that your browser transmits: IP address, date and time, requested page, referrer, browser and operating-system information, and the HTTP status. Our marketing and documentation websites are delivered through Cloudflare Pages (Cloudflare, Inc.), which processes this data to deliver and secure the pages. Purpose: delivering the website, ensuring its stability and security, defending against attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning website). Server log data of our own console and API servers is generally deleted after 30 days.

The website itself sets no cookies. It stores your light/dark theme choice in your browser's local storage; see our Cookie Policy.

5. Analytics

We use Plausible Analytics (plausible.io), a privacy-friendly web-analytics service, on our marketing and documentation websites. Plausible does not use cookies and does not store personal data about individual visitors or track them across websites; it measures aggregated page views, referrers, country and device type. IP addresses are used only transiently to derive this information and are not stored. Plausible is operated as a hosted service by Plausible Insights OÜ (Estonia) and processes data in the European Union. Purpose: understanding overall use of our website. Legal basis: Art. 6(1)(f) GDPR. You may object at any time (see section 16). Plausible stores nothing on your device; its script only reads technical information needed to send the page view (URL, referrer, screen width). We therefore do not ask for consent under §25(1) TDDDG.

6. Contact Form & Enquiries

If you contact us by email or through the contact form, we process the data you provide (name, email address, company, message) to handle your enquiry. The form is operated by Formspree, Inc. (USA) on our behalf; Formspree receives the form data and forwards it to us. Legal basis: Art. 6(1)(b) GDPR if the enquiry relates to a contract or pre-contractual measures, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). We delete enquiries once the matter is concluded and no statutory retention duty applies (for business correspondence generally six years under §257 HGB / §147 AO, where applicable).

7. Account & Console

To create and operate an account we process your name, business email address, organisation, password (stored only as a salted bcrypt hash), role and access settings, multi-factor-authentication data (the TOTP secret is stored encrypted; backup codes), session information, and security and audit events relating to your use of the console (such as logins, IP address and user agent). Purposes: providing the Services, authentication and account security, preventing misuse. Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) GDPR (security and fraud prevention). Where you use the Services as an employee of a customer, the customer is responsible for informing you about its own use of your account data.

Our console uses cookies that are strictly necessary for login and security (see the Cookie Policy).

8. Google Sign-In

If you choose to sign in with Google, you are redirected to Google (Google Ireland Limited / Google LLC), which authenticates you and transmits your email address and basic profile data (scopes: openid, email, profile) to us. Google processes your data under its own responsibility; see Google's privacy policy. Sign-in with Google is optional. Legal basis: Art. 6(1)(b) GDPR.

9. Transactional Email

We send service emails (email verification, password reset, security notices) through Amazon Simple Email Service (SES) of Amazon Web Services EMEA SARL / Amazon Web Services, Inc. The email address and the content of the message are transmitted to Amazon for delivery. The SES region is configured per deployment (our current default configuration uses the AWS region US East, N. Virginia). Legal basis: Art. 6(1)(b) GDPR. We do not use these emails for marketing.

10. Payments

Payments for paid plans are processed by Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA). When you enter a payment method in the console, the card or payment data is sent directly from your browser to Stripe via Stripe's embedded payment fields; we do not store full card data, only references (customer, subscription and payment-method identifiers, which are stored encrypted) and billing status. Stripe processes payment data as an independent controller for its own legal obligations (for example anti-money-laundering and fraud prevention) and as our processor otherwise. Stripe's script (Stripe.js) is loaded only on the console's billing/checkout page when you enter a payment method, not on other pages or on our websites; Stripe may set or read information on your device there (see the Cookie Policy). Legal basis: Art. 6(1)(b) GDPR; for accounting records Art. 6(1)(c) GDPR (§§147 AO, 257 HGB, §14b UStG: retention generally 6 to 10 years); and Art. 6(1)(f) GDPR for fraud prevention. Billing event records received from Stripe have their raw payloads (which may contain payer name and email) redacted after 90 days.

11. Device Telemetry & Monitoring Data

When a customer connects devices to the Services, the device agent transmits data such as device identifiers, firmware and software versions, deployment status, heartbeats, system metrics, logs and diagnostic data such as crash dumps, together with the device's IP address, to our servers. This data may contain personal data (for example IP addresses or identifiers linked to a person). For this data the customer is the controller and we are the processor; the details are in our Data Processing Agreement. We use device data in our own interest only to the extent necessary to operate, secure and bill the Services (Art. 6(1)(b) and (f) GDPR), for example to enforce plan limits and to detect abuse. Dashboards are rendered by a Grafana instance that we operate ourselves.

12. Remote SSH Recordings & Audit Logs

If a customer uses the remote SSH feature, we process on its behalf the metadata of sessions (who, which device, when, approvals), a tamper-evident audit log, and, depending on the customer's policy, recordings of the terminal session. Recordings can contain any personal data displayed in the session. Again the customer is the controller and we act as its processor under the DPA. Recordings are stored on infrastructure operated by us and are deleted automatically after the retention period configured by the customer's organisation (default 90 days, adjustable). Audit events are retained to preserve their integrity and evidential value, in line with the customer's instructions.

13. Recipients & Processors

We use the following service providers. Where they act as our processors, they are bound by data processing agreements under Art. 28 GDPR.

Where the provider or its location differs for your deployment, the Data Processing Agreement lists the current sub-processors. The current list is also published at /subprocessors. We also disclose data where we are legally obliged to do so, for example to authorities, and to our tax advisers and auditors as needed for our accounting.

14. Third-Country Transfers

Where data is transferred to providers in the USA or other third countries, this is based on an adequacy decision of the European Commission (EU-US Data Privacy Framework, where the recipient is certified) or on the EU standard contractual clauses (Art. 46 GDPR) together with supplementary measures where necessary. You can request a copy of the safeguards from us at the contact above.

15. Retention

We keep personal data only as long as necessary for the purposes described:

• Account data: for the duration of the contract, then deleted or blocked unless statutory retention applies.
• Accounting and tax records: 6 to 10 years under §257 HGB and §147 AO.
• Server access logs of the console and API servers: generally deleted after 30 days.
• Session tokens: access token about 60 minutes, refresh token 7 days.
• Remote SSH recordings: deleted automatically after the retention period configured by the customer organisation (default 90 days).
• Billing webhook payloads: personal content redacted after 90 days.
• Device telemetry and other customer data: until deletion by the customer or the end of the contract, in accordance with the DPA.
• Contact enquiries: until the matter is concluded, plus statutory retention for business correspondence where applicable.

Data that is subject to a legal retention obligation is blocked from other use and deleted once the obligation ends.

16. Your Rights

You have the following rights regarding your personal data: access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to withdraw a consent at any time with effect for the future (Art. 7(3)). To exercise them, contact binaryblack21@gmail.com.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The supervisory authority competent for us is: [[TO BE FILLED: competent data protection authority (Landesdatenschutzbehörde) of the federal state of the company seat]].

17. Obligation to Provide Data; Automated Decisions

Providing personal data is not legally required, but certain data (for example email address and organisation for an account, payment data for paid plans) is necessary to conclude and perform a contract; without it we cannot provide the respective Services. Using the website does not require you to provide data beyond the technical data described above. We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR). Automatic enforcement of contractual plan limits and abuse protection (such as rate limiting) is based on technical rules, not on an assessment of your personality.

18. Security

We protect personal data with appropriate technical and organisational measures (Art. 32 GDPR), including encrypted transport (HTTPS/TLS), access controls with role-based permissions, multi-factor authentication (mandatory for owner and administrator roles), and tamper-evident audit logging. Details for customers are in the Annex of our Data Processing Agreement and on our Security page. No method of transmission or storage is completely secure.

19. Changes

We may update this Privacy Policy when our processing or the legal situation changes. The version published here applies; the date of the last update is shown at the top.