Skip to main content

§Legal

Privacy policy

Last updated: 25 October 2026

1. Controller

The controller within the meaning of the GDPR is Kim Daniel Geisthardt, Kim Daniel Geisthardt Web Development, Dörffelstraße 12, 08527 Plauen, Germany, phone +49 3741 4685939, email: support@envbay.com.

We have not appointed a data protection officer because this is not legally required. The controller named above is the contact for all data protection questions.

2. This website

This website is static. It uses no advertising, no external fonts or scripts and no third-party analytics services; we measure reach anonymously with our own counter on our own server (see “Reach measurement” below). We set only one cookie on this website, and only when you explicitly choose the language with the language switch: the cookie “envbay-lang” with the value “de” or “en”. It is valid for one year and for our sites (envbay.com, docs.envbay.com and the shop my.envbay.com). It is sent to our server so that the home page and the shop appear in the language you chose. Your colour scheme setting (light or dark) is stored by your browser locally in so-called localStorage; this information does not leave your device. Both are technically necessary to display the site as you wish (§ 25(2) no. 2 TDDDG), and you can delete them at any time in your browser settings. Without your explicit choice we set no cookie; the language then follows your browser setting.

The web server and the CDN or proxy in front of it process technical connection data (IP address, time, requested page, amount of data transferred, status code, user agent) to deliver the site and keep it secure. We keep these server logs for 14 days and then delete them. Legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation, defence against attacks and error analysis).

The website is hosted by a hosting provider in the EU (data centre in the EU). Cloudflare is placed in front of it as CDN, DNS service and protection against attacks (see sections 6 and 7).

Reach measurement

To understand which pages are read and how visitors find us, we count page views of our sites (envbay.com and docs.envbay.com) with the open-source software GoatCounter. It runs on our own server in the EU; the data goes to no service provider, and no data processing agreement is involved.

Type of data: when a page is opened, a small script loaded from our own domain sends our server the page path (without the query part of the address), the page title, the referring page (without its query part) and, if present in the address, the campaign parameters utm_source, utm_campaign and ref. From your browser’s user agent the server derives only the browser and operating system (for example “Firefox 139, Windows 11”) and does not store the user agent itself. Only aggregated counters are stored (for example “page X: 12 views this hour”, “browser Y: 3 views on this day”), which cannot be linked to one another or to individual visitors.

What does not happen: the counter sets no cookies and neither stores nor reads anything on your device beyond the page address, the page title and the referring page. We do not collect screen size, language, time zone or other device characteristics, build no fingerprint, do not recognise visitors (no sessions, no visitor ID) and do not determine a country. Your IP address is not passed on to the counter; it is processed only as described above to deliver the page. Visits from browsers that send “Do Not Track” or “Global Privacy Control” are not counted.

Retention: we delete the counters automatically after 400 days. Visits recognised as automated programs (bots) do not enter the statistics; we keep the path and user agent of such visits for at most 30 days for error analysis.

Legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to understand how our website is used, to improve content and to assess the effect of our publications. Because no information is stored on your device and only the page details named above are read, we do not ask for consent for this (§ 25 TDDDG).

Objection: you can object to reach measurement at any time (Art. 21 GDPR). The simplest way is to turn on “Do Not Track” or “Global Privacy Control” in your browser; your visit is then not counted, without anything being stored for this. You can also block the address /_c/count with a content blocker or write to us at support@envbay.com.

3. Shop and customer account (my.envbay.com)

Ordering, the customer account and billing run through our shop at my.envbay.com (software Paymenter). When you order, we process the data you enter (name, company if applicable, billing address, email address, VAT ID if applicable, chosen plan and term, order and invoice data, payment status) to conclude and perform the contract (Art. 6(1)(b) GDPR) and to meet tax and commercial retention duties (Art. 6(1)(c) GDPR).

The shop sets a session cookie and a security cookie (CSRF protection) that are technically necessary for login and the order process (§ 25(2) no. 2 TDDDG). We do not use tracking or marketing cookies.

Payment is handled by PayPal. If you choose PayPal as the payment method, we transmit the data required for the payment (name, email address, amount, order reference) to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. We do not receive your payment data (for example account or card numbers). PayPal also processes your data as an independent controller under its own privacy policy. Further payment methods (expected to be Stripe) may be added later; we will then update this policy.

Retention: because of legal obligations we keep invoices and accounting records for up to 8 years (§ 147 AO, § 257 HGB) and delete them afterwards. We delete your other account data after the contract ends once it is no longer needed and no retention duty applies.

4. Your Envbay instance

For each customer we run a separate, isolated instance on servers in the EU. We process account data and technical operating data (such as usage figures like storage and resource consumption, and logs) to provide the service (Art. 6(1)(b) GDPR). We keep server logs of the instance and the infrastructure for 14 days (Art. 6(1)(f) GDPR, operational security and error analysis).

We access the contents of your projects only if you ask us to (for example in a support case) or if this is necessary to avert an acute danger to operations.

Malware scan: as a security measure, an automated scanner on the host checks the files of customer projects for malware. The scan is machine-based; we do not read contents in the process. Only on a hit do we see the affected file and examine the case, in order to protect your instance and other customers. Legal basis is Art. 6(1)(f) GDPR (legitimate interest in the security of the platform and in preventing abuse) in conjunction with Art. 32 GDPR.

Backups: we back up your instance settings (accounts, settings, project list) daily in encrypted form on a separate storage in the EU and keep the last seven. We back up project data only if you set up a backup schedule in the project; the last three (Starter) or five (Team, Agency) backups per project are then kept. Older backups are deleted automatically. After the contract ends, we delete the backups no later than 30 days after the instance is shut down. Legal basis is Art. 6(1)(b) GDPR (performance of the contract) in conjunction with Art. 32 GDPR.

Free trial (Free plan): we back up trial instances locally on the same server only, not on the separate storage. After the trial ends we stop the instance; trial instances are deleted with all data and backups 14 days after the end, unless you switch to a paid plan. To remind you of the end of the trial we send emails to your account address (Art. 6(1)(b) GDPR).

If you process personal data of third parties in your instance, you are responsible for it and we act as your processor in that respect. On request to support@envbay.com we conclude a data processing agreement under Art. 28 GDPR with you. Please note that the instance is intended for development and staging, not for production use with real personal data.

We obtain certificates for project addresses from Let’s Encrypt. Only domain names are transmitted, no personal data. Under the rules of certificate transparency, certificates are publicly visible.

5. Support

We handle support requests by ticket or email. We process the content of the request and your contact data to answer you (Art. 6(1)(b) GDPR; for requests before a contract is concluded, Art. 6(1)(f) GDPR). We delete the data once the request is resolved and no retention duty applies.

6. Recipients and processors

We use the following service providers and, where required, have concluded contracts under Art. 28 GDPR with them:

  • Hosting provider with data centres in the EU: hosting of the servers and storage (processing on our behalf under Art. 28 GDPR). We will give you the name and address on request at support@envbay.com.
  • Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA: CDN, DNS and protection against attacks for our websites. Technical connection data (in particular the IP address) passes through Cloudflare systems.
  • PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg: payment processing (see section 3).
  • Let’s Encrypt (Internet Security Research Group): issuing TLS certificates; only domain names are transmitted.

We pass your data to other third parties only if we are legally obliged to (for example to tax authorities) or you have consented.

7. Transfers to third countries

Our servers are located in the EU. Cloudflare, Inc. is based in the USA. We base the transfer to Cloudflare on the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Cloudflare is certified under it) and, additionally, on standard contractual clauses under Art. 46(2)(c) GDPR. You can obtain a copy of the safeguards on request.

8. Your rights

Under Articles 15 to 21 GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and objection. Where we process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. You can withdraw any consent you have given at any time with effect for the future. To exercise your rights, an email to support@envbay.com is sufficient.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Saxon Data Protection and Transparency Commissioner (Sächsische Datenschutz- und Transparenzbeauftragte), Dresden (datenschutz.sachsen.de). You can also contact the supervisory authority at your place of residence.

9. Obligation to provide data, automated decisions

You must provide the details required to conclude the contract (name, address, email address); otherwise we cannot conclude the contract. There is no automated decision-making, including profiling, under Art. 22 GDPR.