Privacy policy
We sell a tool that keeps personal data out of places it doesn't belong, so we try to collect as little as possible ourselves. This page explains what this website collects, why, and for how long.
Who is responsible
ProdMask is responsible for this website. You can reach us at support@prodmask.com.
The scanner and Pro don't send us your data
The ProdMask scanner and ProdMask Pro run on your own infrastructure. They don't send us the contents of your databases. We are not a processor of that data.
What this website collects
Founding-seat waitlist
Your email address and anything you add in the form: the plan you're interested in, your stack, company and where you heard about us. We also record which headline the page showed you, without linking it to anything else about your visit. Why: to email you about founding seats and the Pro beta, and to ask for feedback. Legal basis: your consent (GDPR Art. 6(1)(a)), which you give in the form and confirm by email. How long: until you leave the list, using the link in our emails, or 12 months after Pro launches, whichever comes first. If you don't confirm your address, we delete it after 14 days.
Customers
When you buy, Paddle shares your email address, name, business name if you gave one, and the details of your subscription with us. We store these with the licences we issue you. Why: to issue and send licences, let you sign in and download ProdMask Pro, email you about new releases, and provide support. Legal basis: performance of our contract with you (Art. 6(1)(b)). How long: while you're a customer and for 90 days after.
Signing in
We email you a sign-in link that works once and expires after 15 minutes. While you're signed in, your browser holds a session cookie, which is strictly necessary for the account to work. It is deleted when you sign out or close the browser.
Downloading Pro
Customers download ProdMask Pro from their account, or through the link in our emails. That link is signed and works for seven days, and nothing about it is stored. We count downloads per day by release, build and outcome, such as a download that went through or a link that had expired, with nothing about who downloaded. To stop abuse, we count requests per IP address for an hour and downloads per customer for a day.
Release emails
While your licence is current, we email you when a new version of ProdMask Pro is out. Legal basis: performance of our contract with you (Art. 6(1)(b)). After your licence lapses, we email you only about releases that fix a security problem. Legal basis: our legitimate interest in keeping the software you use secure (Art. 6(1)(f)). Every release email has a link to stop them. We record the date you used it, and keep it with your customer record.
Server logs
Our web server records requests: IP address, browser user agent, page and time. Why: security and fixing faults. Legal basis: our legitimate interest in running a secure site (Art. 6(1)(f)). How long: 14 days.
Backups
We back up the website's database every night and keep each copy for 30 days, so data we delete can stay in a backup for up to 30 days.
No tracking
There's no analytics service, no advertising and no tracking cookie on this site. We count page views per day, to compare our landing-page headlines and to see whether people follow the link in the scanner's leak-check report. That count has no cookie, IP address or visitor identifier attached.
Who else handles your data
- Paddle (Paddle.com Market Ltd, United Kingdom) is our reseller and merchant of record. It processes your payment details as an independent controller under its own privacy policy. Paddle's checkout runs on Paddle's servers and may set its own cookies when you open it.
- Brevo (France) sends our emails: sign-in links, licences, release emails and waitlist emails.
- Cloudflare (Cloudflare, Inc., United States) passes every request to this site through its network, to protect the site from attacks and deliver it quickly. It processes your IP address and the details of each request on our behalf.
- Our hosting provider runs this website on servers in Frankfurt, Germany.
Paddle is in the United Kingdom, which the EU recognises as protecting personal data adequately. Cloudflare and our hosting provider's parent company are based in the United States. Any access to data from there is covered by the EU's standard contractual clauses or the EU-US Data Privacy Framework.
Your rights
You can ask us for a copy of your data, and to correct, delete or export it. You can also restrict or object to how we use it, and withdraw your consent at any time. Write to support@prodmask.com. You can also complain to a data protection authority, such as the Hellenic Data Protection Authority (www.dpa.gr).