Stashbase, s.r.o. (“Stashbase,” “we,” “our,” or “us”), a company registered in the Czech Republic under Company ID No. 29674492, values your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our developer-focused secrets management platform, including our website, applications, APIs, SDKs, and CLI tools (collectively, the “Services”).

1. Data Controller

For purposes of applicable data protection laws, Stashbase, s.r.o., Company ID No. 29674492, is the controller of personal data described in this Privacy Policy.

2. Information We Collect

a. Information You Provide

• Account details such as your name, email address, and organization information when you register.
• Payment information for subscription plans (processed securely by third-party payment providers).
• Communications with us, including support requests and feedback.

b. Information We Collect Automatically

• Usage data such as IP addresses, browser type, device information, and pages visited.
• Log data about your interactions with the Services for performance monitoring and troubleshooting.
• Cookies and similar technologies to improve your experience and track usage patterns.

Important: Secrets and sensitive credentials you store in the Services are encrypted and treated as confidential data. We do not intentionally access, read, or use these secrets except as necessary to provide, maintain, secure, troubleshoot, or comply with legal obligations relating to the Services. Secrets are not used for analytics or marketing purposes and are not disclosed to third parties except as required to provide the Services or comply with applicable law.

c. Information from Third Parties

• We may receive information about you from third-party services you connect with (e.g., OAuth providers) with your consent.

3. How We Use Your Information

• To provide, maintain, and improve the Services.
• To process payments and manage your account.
• To communicate important updates, support, and marketing information (you can opt-out of marketing).
• To monitor security and prevent fraud or abuse.
• To comply with legal obligations.

Legal Basis: We process personal data (i) to perform our contract with you, (ii) to comply with legal obligations, (iii) based on our legitimate interests (such as improving the Services and ensuring security), and (iv) with your consent where required (such as marketing).

4. Cookies and Tracking Technologies

Cookies and similar technologies may be used to provide authentication, remember preferences, improve functionality, analyze usage, and enhance the Services.

You can control cookies through your browser settings, but disabling them may affect functionality.

5. Data Security

We employ robust security measures including encryption, access controls, and regular audits to protect your data. However, no system is perfectly secure, so please protect your account credentials.

Important: All secrets and sensitive credentials you store in Stashbase are encrypted in transit and at rest. We do not intentionally access, read, or use these secrets except as necessary to provide, maintain, secure, troubleshoot, or comply with legal obligations relating to the Services. Your secrets remain private and confidential.

6. Data Retention

We retain your personal information as long as your account is active or as needed to provide you the Services. We may retain some information for legal or legitimate business purposes even after account closure.

7. Your Rights and Choices

Depending on your jurisdiction, you may have rights to:

• Access, correct, or delete your personal data.
• Restrict or object to certain processing.
• Receive a copy of your data in a portable format.
• Withdraw consent where applicable.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you may have additional rights regarding your personal data. Contact us at support@stashbase.dev to exercise these rights.

You also have the right to lodge a complaint with your local data protection authority if you believe your personal data has been processed in violation of applicable law.

8. Marketing Communications

We may send you emails about product updates, offers, or announcements. You can unsubscribe from marketing emails at any time by following the link in the email or contacting us.

9. International Transfers

Your personal data may be transferred outside the European Economic Area, including to the United States, where we or our service providers operate. Where required, such transfers are safeguarded by Standard Contractual Clauses (SCCs) or equivalent mechanisms.

10. Third-Party Services

We use trusted third-party providers for hosting, payment processing, analytics, and customer support. These providers process data as necessary to provide their services and are subject to applicable contractual, confidentiality, privacy, or security obligations.

These providers may include cloud hosting providers, payment processors, analytics providers, email providers, and customer support tools.

11. Changes to This Policy

We may update this Privacy Policy occasionally. We will notify you of material changes by posting an updated policy on our website or via email. Continued use of the Services after changes means you accept the updated policy.

12. Contact Us

For questions or concerns about your privacy, contact us at support@stashbase.dev.