Privacy policy

Courtesy translation — the German version is legally binding.
Information pursuant to Art. 13/14 GDPR on the processing of personal data when using the website and the Neptun API.

1. Controller

rubberduck software · Christian Möllerherm
41747 Viersen, Germany
Email: ahoi@rubberduck-software.com

2. Hosting

This website and the API are hosted with IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, on servers within the EU. IONOS processes data on our behalf on the basis of a data processing agreement (Art. 28 GDPR). The legal basis is our legitimate interest in providing our service securely and efficiently (Art. 6 (1) (f) GDPR).

3. Server log files

When the website and the API are accessed, information transmitted by your browser or client is recorded automatically: IP address, date and time, requested URL/endpoint, HTTP status code, volume of data transferred, referrer and user agent. This data serves secure operation, abuse and error prevention, and capacity planning (Art. 6 (1) (f) GDPR). It is deleted or anonymised after 14 days at the latest, unless a longer period is required to investigate a specific incident.

4. API use, API keys & quotas

An API key is issued for using the Neptun API. To perform the contract and for billing (Art. 6 (1) (b) GDPR) we process: the contact/customer email address assigned to the key, the plan and scope booked, and usage counters (number and type of endpoints called).

5. Contacting us

If you contact us by email, we process your details in order to handle the enquiry (Art. 6 (1) (b) or (f) GDPR). The data is deleted as soon as it is no longer required and no statutory retention obligations apply.

6. Payment processing (Stripe)

Paid plans are processed via Stripe (Stripe Payments Europe, Ltd., Ireland; for payments possibly Stripe, Inc., USA) as payment provider and merchant of record. On purchase, the data required for payment (e.g. email, payment method, invoicing data) is transmitted directly to Stripe and processed there under Stripe's own responsibility; Stripe also handles the tax side. The legal basis is performance of the contract (Art. 6 (1) (b) GDPR). Any transfer to the USA takes place on the basis of the EU standard contractual clauses or the EU-US Data Privacy Framework. Details: stripe.com/privacy.

7. Cookies

The website sets no tracking or marketing cookies. For basic functions (e.g. language choice), technically necessary local storage (localStorage) may be used in the browser; no consent is required for this (§ 25 (2) TDDDG).

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Please contact the address given above.

You also have the right to lodge a complaint with a supervisory authority, in particular the one responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Postfach 20 04 44, 40102 Düsseldorf, Germany.

9. Data security

Transmission is encrypted via TLS/HTTPS. We take appropriate technical and organisational measures to protect your data against loss and unauthorised access.

10. Changes

We adapt this privacy policy whenever changes to our processing or to the legal situation require it.