Legal
Privacy Notice
Version 3.8 · effective 1 November 2026
Controller
DataHarbor GmbH, Mainzer Landstraße 51, 60329 Frankfurt am Main, Germany. Data protection officer: privacy@dataharbor.example.
What we collect
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account data | name, email, organisation, billing address | contract performance, invoicing | Art. 6(1)(b) GDPR |
| Authentication data | password hash, TOTP secret, session records | account security | Art. 6(1)(b), (f) |
| Usage metadata | request counts, byte totals, key IDs, source IP | metering, abuse prevention | Art. 6(1)(b), (f) |
| Support correspondence | tickets, emails | support delivery | Art. 6(1)(b) |
| Payment data | invoice records | tax and accounting obligations | Art. 6(1)(c) |
Customer content
Objects you upload belong to you. We process them as a processor on your instructions and do not read their contents. Object metadata is processed to deliver the service: key names, sizes, checksums and access policy.
Cookies
The console sets one strictly necessary session cookie and one cookie that remembers your region preference. The public website sets no tracking cookies and loads no third-party scripts, fonts, or analytics. Server logs are written for security purposes and are retained for 30 days.
Recipients
We use the following processors, all bound by data processing agreements: a payment provider for card processing, an email provider for transactional messages, and a monitoring provider for error aggregation. Data centre operators in Frankfurt, Amsterdam and Warsaw provide physical hosting. No processor receives customer content beyond what is required to deliver its function.
International transfers
Customer content stays inside the EU unless you enable a region outside it. Account and billing data may be transferred to processors in the EEA only; where a transfer outside the EEA is unavoidable, it relies on the European Commission's Standard Contractual Clauses with a transfer impact assessment on file.
Retention
- Account data: for the duration of the contract plus statutory retention periods (up to 10 years for invoices).
- Request logs: 400 days for audit logs you can export; 30 days for operational logs.
- Deleted objects: removed from the index immediately, blocks overwritten within 7 days.
- Support tickets: 24 months after closure.
Your rights
You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests. Requests are answered within one month; we may extend by two months for complex cases and will tell you if we do. You may also lodge a complaint with the supervisory authority of your habitual residence; ours is the Hessian Commissioner for Data Protection and Freedom of Information.
Security
Technical and organisational measures are described on the Security page. We notify affected controllers of personal data breaches within 24 hours of confirmation.