Privacy policy

This privacy policy explains what personal data is processed when you visit this website, use the contact form, or use the Octbase web application, for what purposes it is processed, and what rights you have. As the controller is based in Switzerland, we process personal data primarily in accordance with the revised Swiss Federal Act on Data Protection (revFADP, in force since 1 September 2023) and its Data Protection Ordinance (DPO). Where the EU General Data Protection Regulation (GDPR) additionally applies — in particular to visitors in the EU/EEA — we also comply with it; the GDPR legal bases cited below apply only where the GDPR is applicable. Unlike the GDPR, the revFADP does not require a separate statutory basis for each processing activity by a private controller, but binds it to the principles of lawfulness, good faith, proportionality, purpose limitation, transparency and data security (Art. 6 revFADP).

1. Controller

Lars Frasseck - Web- & Musik-Produktion
Renggerstrasse 49
8038 Zürich
Switzerland

For all privacy-related requests, contact: hello@octbase.io

2. Scope

This policy covers the website octbase.io and Octbase instances we host and operate for clients. Where an Octbase instance is operated for a client organization, that organization is the controller for the data its users enter, and we act as a processor on its behalf.

3. Visiting the website (server logs)

When you access this website, the web server technically requires and temporarily processes connection data: your IP address (stored only in shortened form: for IPv4 the last number is set to 0, for IPv6 only the first 48 bits are kept), date and time of the request, the requested resource, the HTTP status, the browser identifier (user agent) and other technical request headers (such as the referring page and preferred language). This data is used solely to deliver the website reliably, to defend against abuse (e.g. rate limiting), and to diagnose technical faults. We process this connection data on the basis of our overriding interest in the secure and stable operation of the service (Art. 31(1) revFADP; where the GDPR applies, Art. 6(1)(f) GDPR).

Log data is not merged with other data sources, is not used to build profiles, and is deleted automatically after 14 days. This website uses no analytics, tracking or advertising services, and loads no resources from third-party servers.

4. Contact form

If you use the contact form, we process the details you enter (name, email address and your message, and optionally company and team size) exclusively to handle your inquiry. This data is transmitted to us by email and is not stored in a database on the web server. We process it to take steps at your request prior to entering into a contract and on the basis of our legitimate interest in answering your inquiry (where the GDPR applies, Art. 6(1)(b) and (f) GDPR).

You receive an automatic confirmation email to the address you provided. To prevent abuse, form submissions are rate-limited per IP address; the IP address is held in memory only for this purpose and is not stored permanently. Correspondence is kept for as long as needed to handle your inquiry and any resulting business relationship, and is then deleted.

5. Using the Octbase application

If you sign in to an Octbase instance that we operate for your organization, your organization is the controller for the following data and decides on the purposes and legal basis of its processing (see section 2). We process it on the organization's behalf, as its processor, to provide the service under our contract with it:

• User account: email address, display name, password (stored only as a salted hash, never in plain text), role, account status, last login time and, if you upload one, a profile photo (visible to you, to members of the projects you belong to, and to the instance's administrators). If you enable two-factor authentication, its secret is stored encrypted and its recovery codes only as hashes.
• Work content: projects, tasks, comments, pages and attachments you create, linked to your account.
• Security audit log: sign-ins (including failed attempts) and sign-outs, administrative actions and other security-relevant events (e.g. two-factor changes, exports, deletions), recorded with IP address and browser identifier. The IP address is kept in full for at most 7 days and then shortened (for IPv4 the last number is set to 0, for IPv6 only the first 48 bits are kept); the browser identifier is kept for the log's whole retention period.
• Activity feed: project-level actions (e.g. “task moved”) together with your user ID, for team transparency.
• Notifications and email delivery: in-app notifications about tasks (which quote task titles); your email address is used to send invitations, password-reset links, account notices (e.g. a welcome email or when your email address is changed) and task notifications. An email about a changed task contains its title, the name of the person who changed it and what changed.
• Preferences: your language, theme, vocabulary and notification settings are saved to your account so they apply on every device.
• Repository connections: if a Git repository (GitHub, GitLab or Bitbucket) is connected, its access token is stored encrypted, and branch and pull-request data is exchanged with that provider.
• Server logs: the instance's web server and the application log requests (shortened IP address, requested URL, browser identifier) for security and troubleshooting; the web application firewall also records requests it blocks or flags, and requests the application refuses, including their content. These logs store the IP address only in shortened form, never in full.

Client instances are operated separately, one instance per client, and are not shared between customers.

6. Cookies and local storage

This website sets no cookies; it only stores your language choice in your browser's local storage. The Octbase application uses only strictly necessary cookies and local browser storage:

• refresh_token (HttpOnly cookie): keeps your session alive and expires automatically. Strictly necessary.
• refresh_present (cookie): records only that a session exists, without any personal content. Strictly necessary.
• localStorage: display and view preferences (e.g. interface scale, keyboard shortcuts, recently opened projects), which stay on your device. Language, theme and vocabulary are also saved to your account (see section 5).

Because only strictly necessary cookies are used, no consent banner is required.

7. Recipients and hosting

Personal data is never sold and is not shared with third parties for advertising purposes. Data is disclosed to third parties only where this is necessary to operate the service or where we are legally obliged to do so.

Our customers' Octbase instances are hosted on servers in Switzerland. This website and demo.octbase.io, which serves the user guide, are hosted on servers in Germany (EU). Emails (contact-form delivery, confirmations, application notifications) are delivered via an email provider located in Germany (EU), acting as our processor under a data processing agreement. If your organization connects a Git provider (GitHub, GitLab or Bitbucket), the data needed to create branches and pull requests is transmitted to that provider, which your organization chooses and which may process it outside Switzerland and the EU (e.g. in the USA).

8. Retention periods

• Account data: until the account is deleted.
• Security audit log and activity feed: 365 days by default, then purged automatically. IP addresses in the security audit log: in full for at most 7 days, then shortened until the entry is purged.
• Expired sessions and password-reset links: removed automatically. Invitations: removed 30 days after they expire or are accepted. Read notifications: removed once they are more than 180 days old, counted from when they were created; unread ones are kept until they are read or until the account, or the task, project or page they refer to, is deleted.
• Website server logs: 14 days. Contact correspondence: deleted as soon as it is no longer required for the purposes described above.
• Logs of the application's web server and web application firewall: 14 days, IP addresses only in shortened form. Application server logs: up to 7 days, IP addresses only in shortened form. Backups of the application database and attachments: up to 14 days, so deleted data can remain in a backup until it expires.
• End of a contract: the instance's data remains available for export for 30 days, then the instance is deleted; a final safety copy of its database and attachments is kept for another 30 days and then deleted.

9. Your rights

Under the revFADP you have the right to information about whether and how we process your personal data (Art. 25 revFADP), to have inaccurate data corrected (Art. 32 revFADP), to request that data be deleted or its processing restricted, to object to a processing, and to receive personal data you have provided in a common electronic format (data portability, Art. 28 revFADP). Where the GDPR applies, you additionally have the rights to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21), and — where processing rests on consent — to withdraw it at any time with effect for the future. To exercise these rights, contact the address given in section 1.

Right to object: where we process personal data on the basis of our overriding or legitimate interest — for example the server logs of this website — you may object to that processing at any time on grounds relating to your particular situation (where the GDPR applies, Art. 21 GDPR).

If your request concerns data in an Octbase instance operated for your organization, please contact your organization as the controller; requests about such data that reach us are forwarded to it.

You also have the right to lodge a complaint with a supervisory authority — in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the data protection authority of your member state.

When an Octbase account is deleted, its personal details (name, email address, profile photo and sign-in data) are erased or anonymized; work content the user created, including attachments and text they wrote, remains available to their organization, attributed to “Deleted user”. Security audit log entries, including the IP address (shortened after 7 days) and the browser identifier, are kept until the retention period in section 8 expires.

10. Data security

All connections to the website and the application are encrypted with TLS. Passwords are stored only as salted hashes. Access to production systems is restricted and security-relevant actions are logged. These technical and organizational measures follow the data-security requirements of Art. 8 revFADP and its Ordinance (and Art. 32 GDPR where applicable).

11. Changes to this policy

We may update this privacy policy when the service or the legal situation changes. The version published here is the current one; the date at the top indicates the last revision.