Privacy notice

This notice explains how IT-Trail GmbH processes personal data when you use the IT-Trail platform ("the Platform"): the central account you sign in with, the consent records the Platform keeps for you, and the management of subscriptions, credits and licences for the applications listed in section 3. It is written to meet Articles 13 and 14 of the General Data Protection Regulation (GDPR).

1. Controller

IT-Trail GmbH
Schärdinger Straße 15
4061 Pasching
Austria
E-mail: office@ittrail.at
Telephone: +43 732 99 71 89

Our full legal notice is at https://auth.ittrail.cloud/legal/imprint. For every question about this notice and for exercising your rights, write to office@ittrail.at.

2. What this notice covers, and what it does not

The Platform is the shared layer under several applications. This notice covers what the Platform processes: your account, how you sign in, what you have consented to, and what you pay. What an application does with your data inside it — the content you create there, the features you use — is described in that application's own privacy notice, which the application links to and which the Platform shows you before you use the application for the first time. Where the same legal entity operates both, both notices apply side by side.

3. The applications

• the applications reachable from the Platform's start page at https://auth.ittrail.cloud.

4. What we process, why, and on which legal basis

4.1 Your account

Data: e-mail address, first and last name, a password hash (never the password), the language you use, whether your e-mail address is verified, second factors you set up (an authenticator secret or passkey public key, never a private key), the identity providers you have linked and the identifier they gave us, the time of registration, and which applications you have signed in to.

Purpose and legal basis: to create and operate the account you asked for and sign you in to the applications — performance of a contract, Art. 6(1)(b) GDPR. Second factors, e-mail verification and the record of which applications you use also serve the security of the account and of the Platform — our legitimate interest, Art. 6(1)(f) GDPR.

4.2 Sign-in through an identity provider

If you sign in through an external identity provider (for example a Google or Microsoft account), the provider sends us your name, e-mail address and a stable identifier, and we store the link so you can sign in the same way again. The provider learns that you signed in to the Platform. Legal basis: performance of a contract, Art. 6(1)(b) GDPR — you chose this way of signing in and can unlink it in your account settings. What the provider itself processes is described in its own privacy notice.

4.3 Sessions and security

Data: session identifiers, the IP address and browser identification of each session, the time of the last activity, and sign-in events (successful sign-ins, failed attempts, password resets, sign-outs).

Purpose and legal basis: to keep you signed in, to let you see and end your sessions on other devices, to detect and block credential-stuffing and other attacks, and to be able to investigate a security incident — our legitimate interest in the security of the Platform, Art. 6(1)(f) GDPR, and our legal obligation to protect the data we hold, Art. 6(1)(c) in conjunction with Art. 32 GDPR.

4.4 Consent records

Data: which documents (these platform terms and the documents of each application) you accepted or declined, which version, when, in which language, and the IP address and browser identification at that moment.

Purpose and legal basis: to be able to show that a contract was concluded on the terms shown to you and that a consent was given or refused — our legal obligation to demonstrate consent, Art. 7(1) GDPR, and our legitimate interest in being able to prove what was agreed, Art. 6(1)(f) GDPR. These records are kept for as long as the account exists and for the limitation period afterwards (section 7).

4.5 Subscriptions, credits and licences

Data: which plan of which application you are on, its billing period, its start, renewal and end dates, whether it is cancelled or paused, your credit balance and its history, the licence keys issued to you and their validity, the identifier the payment provider assigned to you, and the invoices issued to you.

Purpose and legal basis: to provide and bill what you subscribed to — performance of a contract, Art. 6(1)(b) GDPR. Invoices and the records behind them are also kept to meet accounting and tax law — legal obligation, Art. 6(1)(c) GDPR.

4.6 Payment

Payment is taken by Stripe. Card numbers, bank details and other payment credentials are entered on the payment provider's own pages and are held by it; we never see or store your full card number. We receive from the provider what we need to know that a payment happened: the amount, the currency, the last digits and type of the payment method, the billing name and address you entered, any VAT number you entered, and the provider's identifiers for the customer, the subscription and the payment. Stripe acts as a payment service provider; the contract for the subscription is with us. Legal basis: performance of a contract, Art. 6(1)(b) GDPR, and accounting and tax law, Art. 6(1)(c) GDPR. The payment provider's own privacy notice describes what it processes.

4.7 E-mail we send you

Data: your e-mail address and name, the message sent, when it was sent and whether it was delivered.

Purpose and legal basis: the Platform sends you the messages the account and the contract require — e-mail verification, password reset, and notices about a subscription starting, renewing, changing, failing to be paid or ending, about credits bought and about licences issued and expiring. These are contractual notices, not advertising, and are sent under Art. 6(1)(b) GDPR. We keep a record of what was sent so the same notice is not sent twice and so we can show that it was sent — legitimate interest, Art. 6(1)(f) GDPR. We send no marketing e-mail from the Platform without a separate consent you can withdraw at any time, Art. 6(1)(a) GDPR.

4.8 Technical logs

Data: the IP address, the requested address, the time, the browser identification and the result of each request to the Platform, and error diagnostics.

Purpose and legal basis: to operate the Platform, to find and fix faults, and to detect abuse — legitimate interest, Art. 6(1)(f) GDPR. Logs are kept for a short, fixed period (section 7) and are not used to build profiles.

5. Who receives your data

We use service providers who process data on our behalf under contracts that meet Art. 28 GDPR ("processors"). They may only process the data for our purposes and on our instructions:

• Hosting and infrastructure providers that run the servers, databases and networks the Platform is operated on.
• Stripe, for the payment data in section 4.6.
• E-mail delivery providers that carry the messages in section 4.7.
• Identity providers, only when you choose to sign in through one (section 4.2), and only the data that sign-in requires; they act as independent controllers.

Beyond that, we disclose personal data only where the law requires it — to a court or authority with a lawful demand — or where you have asked us to. We do not sell personal data and we do not share it with advertisers.

6. Transfers outside the European Economic Area

We operate the Platform in the European Economic Area. Where a service provider named above processes data outside the EEA, or in a country without an adequacy decision of the European Commission, the transfer rests on the Commission's standard contractual clauses (Art. 46(2)(c) GDPR) together with supplementary measures where needed, or on an adequacy decision. You can ask us for a copy of the safeguards in place.

7. How long we keep data

• Account data: for as long as the account exists. When you delete the account (or we end it), the account and everything under section 4.1 to 4.3 is deleted within 30 days, except where a subscription or invoice requires longer.
• Consent records: for as long as the account exists and for 3 years afterwards, the general limitation period for claims arising from the contract; longer where a specific claim is pending.
• Subscriptions, invoices and payment records: for the period accounting and tax law prescribes at our registered seat — typically 7 years from the end of the year in which the invoice was issued — and no longer.
• E-mail delivery records: 12 months.
• Technical logs: 30 days, unless an incident requires a specific log to be kept longer.
• Security event logs (sign-ins, failed attempts): 90 days.

8. Cookies and local storage

The Platform sets only the cookies it needs to work: a session cookie that keeps you signed in, a cookie that carries the state of a sign-in in progress so it cannot be tampered with, and a cookie that remembers the language and sign-in method you last used. They are strictly necessary for a service you asked for (Art. 5(3) ePrivacy Directive) and need no consent. We set no analytics, advertising or tracking cookies and load no third-party scripts on the Platform's pages.

9. Your rights

You have the right, under the conditions of Articles 15 to 22 GDPR, to:

• access the personal data we hold about you, and receive a copy;
• rectify data that is inaccurate or incomplete — most of it you can edit yourself in your account settings;
• erasure — you can delete your account yourself in your account settings at https://auth.ittrail.cloud/realms/saas-stack/account/?referrer=admin-portal-app&referrer_uri=https%3A%2F%2Fauth.ittrail.cloud%2F, which deletes everything except what section 7 requires us to keep;
• restriction of processing, in the cases the GDPR provides for;
• data portability — you can download your account data from your account settings in a machine-readable format;
• object to processing based on our legitimate interests (Art. 21 GDPR), on grounds relating to your particular situation; and to object at any time to any direct marketing;
• withdraw a consent you have given, with effect for the future, without affecting the lawfulness of processing before the withdrawal.

To exercise a right, write to office@ittrail.at. We may ask you to confirm your identity — usually by writing from the e-mail address on the account.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. The authority competent for us is the data protection authority of the state in which we have our registered seat (see the legal notice).

10. Security

Passwords are stored only as salted hashes. Every connection to the Platform is encrypted in transit. Payment credentials never reach our systems. Secrets that the Platform must keep — for example an application's mail-server credentials or its signing keys — are encrypted at rest. Access to production data is restricted to the people who operate the Platform and is logged.

11. No automated decision-making

We make no decisions about you that are based solely on automated processing and that produce legal effects or similarly significantly affect you (Art. 22 GDPR). A subscription that is suspended after a failed payment is the consequence of a rule you agreed to in the platform terms, and you can always reach a person about it.

12. Obligation to provide data

You do not have to give us any data. But an account cannot exist without an e-mail address and a means of signing in, and a paid plan cannot be provided without the payment data in section 4.6, so those are required to use the Platform and the paid parts of the applications.

13. Changes to this notice

We will change this notice when the Platform, our providers or the law change. The current version is always at https://auth.ittrail.cloud/legal/privacy. Where a change materially affects how we process your data, we tell you by e-mail or on the Platform before it takes effect.