Privacy notice

The controller for the processing described here is Kerem Sinecek, Eugen-Richter-Straße 11k, 44359 Dortmund, Germany, reachable at info@veltic.app. Where you use Veltic to store your own customers' data, you are the controller for that data and the operator acts as your processor. The separation is described in the data processing agreement.

No data protection officer is appointed; the operator does not meet the thresholds of Article 37 GDPR or section 38 of the German Federal Data Protection Act. Data protection requests therefore go to the contact address above.

Opening a page on veltic.app transmits the data your browser sends with every HTTP request: IP address, requested URL, referrer, user agent, language and the time of the request. This data is processed to deliver the page and to defend against attacks, on the basis of Article 6 paragraph 1 letter f GDPR. The legitimate interest is operating a reachable and secure website.

The marketing pages are delivered by a Cloudflare Worker. Cloudflare processes the connection data of the request as a processor. No analytics, advertising or tracking script runs unless you have consented to it in the cookie banner. Consenting to the analytics category starts PostHog, described under Product analytics below. The marketing category still activates nothing, because no such tool is integrated.

Veltic is invite only while it is being tested. Entering your address on the waiting list stores that address, the time of the entry, the page you came from and your IP address shortened to the network, so that the operator can later show that the entry was made. The legal basis is your consent under Article 6 paragraph 1 letter a GDPR, given by submitting the form; the shortened IP address rests on Article 6 paragraph 1 letter f GDPR, the legitimate interest being the ability to evidence that consent and to defend the form against abuse.

No confirmation email is sent. The address is used for two things only: to tell you when a place opens up, and for occasional messages about the state of the test. Every message carries a one click unsubscribe link, and an unsubscribed address is skipped by every later message, permanently. You can also withdraw at any time by writing to the contact address above; the withdrawal does not affect the lawfulness of the processing before it.

Approving a request creates an account and sends a username and a temporary password to that address. The password exists only in that one message; it is stored solely as a bcrypt hash and has to be replaced the first time you sign in.

Waiting list entries are deleted on withdrawal, and at the latest six months after the test phase ends. The address is passed to no one other than the email processor named below.

Creating an account processes your email address, your chosen username and a bcrypt hash of your password. The email address is confirmed with a six digit code that is stored only as a hash and expires after fifteen minutes. The legal basis is Article 6 paragraph 1 letter b GDPR, because the account is required to provide the service.

Signing in creates a session. The session token is stored in your browser in the strictly necessary cookie veltic-session-token and in the platform database as a SHA-256 hash, together with the IP address and the user agent of the sign in. Failed sign in attempts are recorded with the username and the IP address for at most thirty days to rate limit brute force attempts, on the basis of Article 6 paragraph 1 letter f GDPR.

If you sign in with Google, Google transmits your Google account identifier and your email address to the operator after you have confirmed the consent screen. Nothing else is requested. The identifier is stored so that a later sign in resolves to the same account.

Every change to the control plane is written to an audit log with the acting account, the action, the affected resource, the IP address and the user agent. This is how the operator can reconstruct who created a database, revealed a credential, restored a backup or changed a role. The legal basis is Article 6 paragraph 1 letter f GDPR; the legitimate interest is the traceability and security of a multi tenant platform.

Container logs, query history and monitoring counters are processed to operate the platform and to answer your own support questions. Query history is bound to the account that ran the statement.

Content you place on the platform yourself, such as rows in your databases, uploaded files and deployed applications, is not evaluated by the operator. It is accessed only on your instruction or where a legal obligation requires it.

Payments run through Stripe Payments Europe Ltd. When you start a checkout, Stripe receives the data required for the payment, including your email address and payment method details. The operator never sees or stores your card number; it receives a customer identifier, the subscription status and the billing email address. The legal basis is Article 6 paragraph 1 letter b GDPR.

Invoices and the records required by tax and commercial law are retained for the statutory period, currently ten years under section 147 of the German Fiscal Code and section 257 of the German Commercial Code. The legal basis for that retention is Article 6 paragraph 1 letter c GDPR.

Verification codes, activation links and service notices are sent through Amazon Simple Email Service over SMTP. Amazon Web Services acts as a processor and receives the recipient address, the subject and the message body. Marketing email is not sent from this path.

With your consent under section 25 paragraph 1 TDDDG and Article 6 paragraph 1 letter a GDPR, the operator measures how the dashboard and the public pages are used, using PostHog. Ingestion runs exclusively against the European endpoint eu.i.posthog.com; PostHog stores the data in the European Union under a data processing agreement pursuant to Article 28 GDPR. You can withdraw your consent at any time through the Cookie settings link in the footer, with effect for the future.

What is transmitted is limited by design: a pseudonymous device identifier, the page visited, and events from a fixed catalogue such as creating a project or a failed deployment. Session recording is switched off in code. Automatic capture of clicks and page text is disabled. Your IP address is discarded before an event is stored. Signed in users are identified by their internal user identifier together with their role, never by name or email address.

Content you store on the platform is never transmitted. Statements you run in the SQL console, log lines, database contents, file names in storage, email subjects and connection strings are blocked by a technical guard in the code, not merely by convention.

The platform additionally reports the outcome of deployments from the server, without your consent and independently of it, because that measurement identifies no person: it is keyed to the project, records the runtime, the duration and a classified failure reason, and contains no user identifier and no free text. The legal basis is Article 6 paragraph 1 letter f GDPR, the operator's legitimate interest in a working service.

The operator uses the following processors, each under a data processing agreement pursuant to Article 28 GDPR.

Cloudflare, Amazon Web Services, Stripe, PostHog, Vercel and GitHub are groups with United States parent companies. Where a transfer to a third country occurs, it is based on the European Commission's standard contractual clauses under Article 46 paragraph 2 letter c GDPR, in combination with the adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it.

Analytics events are addressed to PostHog's European endpoint and are stored on infrastructure in the European Union. A transfer to the United States is therefore not part of the ordinary operation; it remains possible only for administrative access by the parent company, covered by the clauses named above.

The virtual private server itself is operated by STRATO AG, Berlin, Germany. All platform data at rest therefore stays inside the European Economic Area.

You have the right to access your data under Article 15 GDPR, to rectification under Article 16, to erasure under Article 17, to restriction of processing under Article 18, to data portability under Article 20 and to object to processing based on legitimate interests under Article 21. Where processing rests on consent, you may withdraw that consent at any time under Article 7 paragraph 3 without affecting the lawfulness of processing before the withdrawal.

You also have the right to lodge a complaint with a supervisory authority under Article 77 GDPR, in particular with the authority of your habitual residence, your place of work or the place of the alleged infringement.

Providing an email address, a username and a password is required to create an account. Without them the contract cannot be performed and no account can be created. Everything else you enter into the platform is voluntary and under your control.

The platform does not use profiling or automated individual decision making within the meaning of Article 22 GDPR. Rate limits and fair use checks are technical thresholds, and a decision to restrict an account is taken by a person.