Privacy at Buskeeper

1. Who is the controller

The controller for the data described in this policy is:

Privacy contact: support@buskeeper.dev. We have not appointed a data protection officer because our processing does not meet the mandatory designation threshold. Privacy requests are handled by the team responsible for the product.

2. Scope

This policy covers the buskeeper.dev and docs.buskeeper.dev websites, the closed-beta contact path, and the local Buskeeper software. It does not describe a live hosted service: hosted team workspaces and paid plans are not yet offered.

3. What we collect

Contact requests

If you email us or use the closed-beta request form, we receive the information you choose to send: your name, work email, company or project, role, the workflow you are coordinating, how you run agents, the handoff you want to track, and your stated interest. The website form composes an email in your own mail client; it does not submit the form to our server.

Website and server logs

Our hosting infrastructure may record standard technical data such as IP address, user agent, requested URL, timestamp, response status, and a security-relevant request identifier. We use this data to operate the site, prevent abuse, and investigate incidents.

Local workspace data

When you run Buskeeper locally, items, events, lane tokens, attachments, and configuration are stored on your machine or infrastructure. Ngonart OÜ does not receive that data. You are the controller for your workspace content and decide who can access it.

Payments (when paid plans launch)

Paid hosted plans are not currently offered. When billing launches, payments will be processed by Stripe. We expect to receive billing identifiers, plan and subscription status, invoice and tax metadata, and limited customer contact details. We do not intend to receive or store full payment-card numbers; card data is handled by Stripe as the payment processor.

4. Why we process data and on what basis

• Responding to your request and taking steps before a contract — Article 6(1)(b) GDPR, or your consent where we ask for it.
• Operating, securing, and improving the website and local software — our legitimate interests under Article 6(1)(f) GDPR in providing a safe and reliable product.
• Complying with legal obligations — Article 6(1)(c) GDPR, including tax, accounting, and security requirements when billing is live.
• Optional communications — your consent under Article 6(1)(a) GDPR, which you can withdraw at any time.

5. How we use the data

• To answer preview-access, technical, and commercial questions.
• To understand which workflows and acceptance tests are most relevant.
• To keep a record of the conversation and any follow-up you agree to.
• To protect the site and the service from abuse, fraud, and security incidents.
• To issue invoices, calculate VAT, and manage subscriptions when paid plans launch.

We do not sell personal data. We do not use the website for advertising profiles or cross-site tracking.

6. Sharing and processors

We share data only where needed to run the site and the business, with providers acting on our instructions. These may include a hosting provider, an email provider, and — when paid plans launch — Stripe for payment processing and tax calculation. We may also disclose data where required by law or to establish, exercise, or defend legal claims.

We do not publish customer logos, testimonials, or usage statistics without permission.

7. International transfers

We aim to keep processing within the European Economic Area. If a provider processes data outside the EEA, we will use an appropriate transfer mechanism, such as an adequacy decision or the European Commission's Standard Contractual Clauses, and apply supplementary safeguards where required.

8. Retention

• Contact requests: kept for as long as needed to handle the conversation and any agreed follow-up, then reviewed and deleted or anonymised.
• Server logs: kept for a short operational period set by the hosting configuration, unless needed for a specific security investigation.
• Billing records: retained for the period required by Estonian accounting and tax law once paid plans are live.
• Local workspace data: retained and deleted by you, under your own retention settings.

9. Security

We use access controls, least privilege, encrypted transport for public endpoints, and a small data surface. The local product stores the event log in SQLite on your machine and binds to loopback by default. No system is perfectly secure; report a suspected issue to support@buskeeper.dev.

10. Your rights

If you are in the EEA or the UK, you have the right to access, rectify, erase, restrict, or object to processing, and to data portability. Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

Email support@buskeeper.dev to exercise a right. We may need to verify your identity. You also have the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, or to your local supervisory authority.

11. Cookies and similar technologies

The marketing and documentation sites do not set advertising cookies or run third-party analytics. The local Buskeeper web interface uses browser storage for functional preferences such as the selected light or dark theme. A future hosted service will publish a cookie notice before launch if it uses additional cookies or similar technologies.

12. Children

Buskeeper is a developer and business tool. It is not directed to children, and we do not knowingly collect personal data from children. Contact us if you believe a child has provided personal data.

13. Changes

We may update this policy as the product and hosting model change. The version and date at the top will change with material revisions. If a change requires consent, we will ask for it separately.

14. Contact

Questions, requests, or complaints: support@buskeeper.dev.