Privacy Policy

1.1 This policy explains how personal data is handled when you use this website and the services available through it. Personal data means information that identifies you, or that can be linked to you.

1.2 The controller under the General Data Protection Regulation (GDPR) is the person below. As controller, this person decides why and how personal data is processed.

If you simply view the website without registering or submitting information, your browser still sends technical data to our server. We process the following server-log information because it is needed to provide the requested pages:

• · the page visited;
• · the date and time of access;
• · the volume of data transferred in bytes;
• · the source or referring page;
• · the browser used;
• · the operating system used; and
• · the IP address used, which may be anonymized.

Our legal basis is Art. 6(1)(f) GDPR: our legitimate interest in maintaining and improving the website’s stability and operation. We do not disclose or otherwise use these logs. We may, however, review them later where there are specific indications that the website has been used unlawfully.

A hosting provider delivers this website and its content for us. The provider performs the service itself or through selected subcontractors, using only servers located in the European Union. Data collected through the website is processed on those servers.

We have entered into a data processing agreement with the hosting provider. It requires protection of visitor data and prohibits unauthorized disclosure to third parties.

The website uses SSL or TLS encryption to protect personal data and other confidential material while it is transmitted, including orders and messages sent to us. An encrypted connection is indicated by “https://” and the lock icon in your browser.

If you contact us by email, we collect the information you include in your message. We use it only to handle and answer your request, establish contact with you, and carry out the related technical administration.

This processing is based on our legitimate interest in responding to you under Art. 6(1)(f) GDPR. If your message concerns entering into a contract, Art. 6(1)(b) GDPR also applies. We delete the data once the matter is conclusively resolved, unless a legal retention duty requires us to keep it.

You can provide your email address to join the RecoveryCodes waitlist. We use it only to tell you when new accounts become available. The form sends the address directly to an endpoint operated for us by Deploybase at api.deploybase.eu.

We process the address on the basis of your consent under Art. 6(1)(a) GDPR. Deploybase receives the technical information necessarily transmitted with the request, such as your IP address, so that it can accept and secure the submission.

You may withdraw your consent at any time by contacting the controller. We will then remove your email address from the waitlist unless another legal basis requires its retention. Withdrawal does not affect processing carried out before it.

Depending on the options configured for your organization, you can create or access an account through Google, GitHub, GitLab, or an organization-managed OpenID Connect provider. Using one of these options is voluntary.

No social sign-in provider is contacted merely because you view our sign-in page. When you choose a provider, your browser is redirected to that provider so that you can authenticate and authorize the requested data transfer. The provider will receive the technical data needed to serve that request, including your IP address.

The provider processes the authentication step under its own privacy terms. We initiate the flow at your request in order to create or perform the account contract under Art. 6(1)(b) GDPR.

After successful authentication, the provider sends us a provider-specific account identifier and your email address, together with confirmation information used to determine whether that address has been verified. A provider may also return basic profile information within the permissions shown on its authorization screen, but RecoveryCodes uses the identifier and email address to create, link, or sign in to your account.

We retain the provider name and provider-specific identifier with your account and record when that identity was last used. We do not send your RecoveryCodes browsing or purchasing activity back to a social sign-in provider.

Google describes its privacy practices at https://business.safety.google/privacy/, GitHub at https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement, and GitLab at https://about.gitlab.com/privacy/.

Google Ireland Limited provides the Google option. Information may also be transferred to Google LLC in the United States. Google participates in the EU–US Data Privacy Framework, for which the European Commission has adopted an adequacy decision.

5.1 To perform contracts, we use service providers that support all or part of the order process. We send them personal data only as described below and as required to perform the contract.

Checkout is provided by Paddle.com Market Ltd, Judd House, 18-29 Mora Street, London, EC1V 8BT, United Kingdom. Starting an order takes you to Paddle’s web interface, where you enter billing and delivery addresses and payment details to complete payment. Paddle collects this information under its own responsibility and processes the payment in its own name.

After payment, Paddle gives us the order and transaction information needed to fulfill the order. We process that transfer for performance of the contract under Art. 6(1)(b) GDPR.

We have a data processing agreement with Paddle that protects website-visitor data and prohibits disclosure to third parties. The European Commission has issued an adequacy decision that ensures an adequate level of data protection in the United Kingdom.

We use Plausible, provided by Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia. It anonymously records and evaluates visitor interactions so that we can understand matters such as visitor counts, page views, bounce rates, and time on the site.

Plausible is configured not to process personal data. It collects non-personal browser and user-agent information, stores it without personal identifiers, and uses it for statistics. The information is deleted when it is no longer needed for our analysis.

If personal data is nevertheless processed in an individual case, the legal basis is Art. 6(1)(f) GDPR. The legitimate interest is analyzing usage statistically in order to improve the website.

We also run an analytics component ourselves within the application infrastructure, exclusively on servers in the European Union. It does not send data to an outside provider.

This component records account-creation events to measure adoption and improve onboarding. For each event, it stores the “signup” event type, the signup method such as email, an identity provider, or invitation, the subscription-plan tier at the time, and the new user ID for internal correlation. It does not collect cookies, IP addresses, browser fingerprints, or device identifiers.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is measuring and improving the service. Because this component remains on our own EU-based servers and no third party receives its data, it does not require a separate data processing agreement.

Retention depends on the purpose and legal basis for processing and, where relevant, statutory periods such as commercial and tax-record retention requirements. Any more specific period stated elsewhere in this policy takes priority.

• · Consent under Art. 6(1)(a) GDPR: data is retained until consent is withdrawn.
• · Contract-related processing under Art. 6(1)(b) GDPR: where a statutory retention period applies, data is routinely erased when that period ends, provided it is no longer needed to enter into or perform the contract and we have no legitimate reason to retain it further.
• · Legitimate interests under Art. 6(1)(f) GDPR: data is retained until you object under Art. 21(1) GDPR, unless compelling protected grounds override your interests, rights, and freedoms or continued processing is needed to establish, exercise, or defend legal claims.

In all other cases, we erase stored personal data when it is no longer required for the purpose for which it was collected or otherwise processed.

8.1 Depending on the conditions set by applicable data protection law, you may exercise the following rights against the controller in relation to your personal data:

• · access under Art. 15 GDPR;
• · rectification under Art. 16 GDPR;
• · erasure under Art. 17 GDPR;
• · restriction of processing under Art. 18 GDPR;
• · information about recipients under Art. 19 GDPR;
• · data portability under Art. 20 GDPR;
• · withdrawal of consent under Art. 7(3) GDPR; and
• · a complaint to a supervisory authority under Art. 77 GDPR.