Data Processing Agreement

Your clusters stay on your computers. The Glauco desktop app works with your clusters only on the computer where it runs. It never sends us anything about your clusters, contexts, kubeconfig files, credentials, resources or how you use the app. We never receive that data, so this agreement does not need to cover it.

• You are the controller, and we are the processor, for the personal data that you and your team put into Glauco licensing: the email addresses of your seats, the records of the installs on each seat, and the audit log of your license.
• We are the controller for our own data about you as a customer: the license holder or team admin email we use for the contract, purchase and billing records, sign-in to the account pages, update checks, support email and the contact form. The privacy policy covers that data, not this agreement.
• Stripe, and Sold through Link, LLC as merchant of record, process payments as independent controllers, not as our subprocessors.

• Subject matter: managing your Glauco license: its seats, the installs on each seat, and the record of changes to them.
• Nature: we receive, store, show, change and delete this data on the license server. Glauco sends it when a person activates an install, during its daily license check and when the license is removed from the app. Your team admin sees and changes it in the account at glauco.app/account.
• Purpose: to check that each install has a valid seat, to enforce the limits of your plan, to let your team admin manage seats and installs, and to keep a record of who changed what. We also count active installs by app version and operating system, and we use these counts only to know which versions and systems to support.
• Duration: while your license exists, and after it ends until the data is deleted under "Deletion and return" below.

The data subjects are:

• the people to whom you give a seat, such as your employees and contractors
• your team admins and the other people who make changes to your license

The personal data is:

• per seat: the email address, and when the seat was claimed or released
• per install: an install id, which is a random number the app creates and not a hardware fingerprint; a label, by default "Mac (macOS)", "Windows PC" or "Linux PC" and never the computer's name, unless the person changes it; the app version; the type of operating system; the time of the last license check; when the install was removed; and the end date of an offline license file if one was issued
• the audit log: what happened to the license, who did it and when, with details such as the email address of a released seat or the label of a removed install

We do not store IP addresses with this data. There are no special categories of personal data, such as health data.

We process the data only on your documented instructions. Your instructions are this agreement, the terms, and what your team admins do in the account. If we must process the data for another reason because EU or Dutch law requires it, we tell you first, unless that law forbids it. If we think an instruction breaks the GDPR, we tell you.

Only the people at Koode who need the data to run the license service and to give support can see it. They are bound by confidentiality. We do not sell the data or use it for advertising.

We take these measures, as Article 32 of the GDPR requires:

• Encryption in transit: traffic from the internet to the license server and the account pages is encrypted with HTTPS. The license server cannot be reached directly from the internet: its only way in is a Cloudflare Tunnel, and a network policy lets only that tunnel reach it.
• Admin access: Koode staff sign in to the admin dashboard with passkeys only, never with passwords. Access is by invitation only, and each role gets only the permissions it needs. The admin session cookie is sent over HTTPS only.
• Customer access: people sign in to the account with a one-time code or link sent to their email address. The license server limits each answer to the licenses of that email address. Team admins see the seats and installs of their license; seat holders see only their own seat. The account pages reach the license server with a service token, of which the license server stores only a hash.
• Backups: the database archives its changes continuously and makes a full backup every day, to Cloudflare R2. We can restore it to any point in the last 30 days. The key for the backups can only read and write that one bucket.
• Data minimisation: the license server does not write license keys, license tokens or email addresses to its logs, and it does not store IP addresses. It counts requests per IP address in memory, only to stop abuse.
• Retention: a daily job deletes the data when its retention period ends (see "Deletion and return").
• Accountability: every change to a license, its seats and its installs goes into the audit log, with who made it and when.

You give us general permission to use these subprocessors. Each one is bound by a data processing agreement with the same data protection duties as this agreement.

Stripe is not a subprocessor: it processes payments as an independent controller (see "Who does what"). Our bookkeeping in Moneybird holds only monthly sales totals, no personal data of your team.

The license server and its database run in the European Union. Cloudflare and Google have US parent companies and may process the data outside the European Economic Area. For those transfers, they use the EU-US Data Privacy Framework and the EU Standard Contractual Clauses, as shown in the table. We do not transfer the data outside the European Economic Area in any other way.

Before we add or replace a subprocessor, we tell the license holder by email and update this page, at least 14 days before the change applies. When we must replace a subprocessor sooner, for security or because it stops its service, we tell you as soon as we can and at the latest when the change applies. You can object by email within 14 days of our notice, for a reasonable data protection reason. We then try to find a solution with you. If we cannot, you can end your license by cancelling it. We do not tell you in advance when we stop using a subprocessor.

• Your team admins can see, release and remove seats and installs themselves, in the account.
• If a person asks us directly to exercise their rights about this data, we send the request on to you and do not answer it ourselves, unless you ask us to.
• For any other request, such as access to the audit log or a copy of the data, write to support@glauco.app. We help you without undue delay.
• We also help you, with the information we have, with security, breach notifications, data protection impact assessments and prior consultation, as Articles 32 to 36 of the GDPR require.

If we become aware of a personal data breach that affects this data, we tell the license holder by email without undue delay, and at most 48 hours after we become aware of it. We tell you what we know: what happened, which data and how many people it affects, the likely consequences, and what we do about it. We send more details as we learn them.

• A released seat or removed install: deleted 1 year after its removal.
• The audit log: each entry is deleted after 2 years.
• When your license ends: 1 year later, its seats and installs are deleted and the license record is anonymised. We keep only what Dutch bookkeeping law requires, for 7 years, without the data of your team.
• Deleted data stays in the database backups until they expire, about 30 days later.
• If you want a copy of the data, or want it deleted sooner, write to support@glauco.app before or after your license ends.

On request, we give you the information you need to show that we meet this agreement, such as a description of our security measures and our subprocessors. Enterprise customers can also audit us on site, or have an independent auditor do it, at their own cost, at most once a year and with at least 30 days' notice. The auditor must keep what they learn confidential.

This agreement is part of the terms for every paid license and binds you and us from the moment you buy. You do not need to sign it. If you need a signed copy, ask support@glauco.app for a countersigned PDF.

If this agreement and the terms differ about personal data, this agreement applies. The limits of liability and the law and courts in the terms also apply to this agreement. We may change it in the same way as the terms.