Privacy Policy

Controller

NubeStack ("NubeStack", "we", "us") is the controller for the personal data described here. Contact: support@nubestack.com.

What we collect

• Account data: email address, optional name, organisation name and membership role.
• Seat assignments you enter: an optional person name or email for each seat.
• License activation data sent by the apps to license.nubestack.com: a one-way device fingerprint hash, the device label you choose, operating system family and app version, and (from OpsPilot 0.4.0) whether the license key was set by your IT team in the app’s policy file rather than typed, which your organisation’s admins see in the portal. No host names, user names, terminal content or usage data are sent.
• License checks: while OpsPilot 0.3.0 or later, activated online, is open and the computer is in use, it asks every few minutes whether that device is still licensed. The check sends the product, the activation identifier, the device fingerprint hash, the app version, a timestamp, a random value and a proof made with the device’s activation secret. We do not record it: only short-lived rate-limiting counters, keyed by the activation identifier and by a daily-rotated hash of the IP address, are kept in the server’s memory, and they are never written to disk. The renewal, about once a day, records the date of each device’s last renewal, which your organisation’s admins see in the portal.
• Billing records: Paddle subscription and transaction identifiers, amounts, invoice numbers and status. Payment details are collected and held by Paddle, not by us.
• Security records: an audit log of licensing and account actions, sign-in session records, and short-lived rate-limiting counters keyed by daily-rotated hashes of IP addresses.

Why we use it

• To provide the subscription you bought: issuing and enforcing licenses, sending license keys, renewal files and reminders (performance of contract).
• To prevent abuse of license keys and secure the service (legitimate interests).
• To keep financial records (legal obligation, largely fulfilled by Paddle as Merchant of Record).

Who we share it with

• Paddle.com, our reseller and Merchant of Record, for payments, tax and invoicing.
• Our hosting and email delivery providers, as processors acting on our instructions.
• Nobody else, unless required by law.

Retention

• Account and organisation data: while the account exists, then deleted on request unless needed for legal claims.
• Released device records: deleted 13 months after release.
• Online renewal records: deleted 60 days after the license they describe expired.
• Webhook payloads from Paddle: stripped of content after processing.

Your rights

You can ask to access, correct, export or delete your personal data, or object to processing, by writing to support@nubestack.com. You may also complain to your data protection authority.