Developer platform privacy notice

1. Scope and controller

This notice covers developer accounts, projects, API credentials, browser sessions, API operations, billing, and notifications. It is separate from the consumer configurator privacy notice.

The controller is Martin Machava, IČO 06838928, DIČ CZ684876618, Nové sady 988/2, 602 00 Brno – Staré Brno, Czechia. Privacy requests may be sent to [email protected].

2. Data processed

We process Clerk identity references, verified email, display name, memberships, terms acceptance, billing country and checkout references, project settings, allowed origins, credential metadata, scopes, usage totals, operation status, request IDs, security records, ledger movements, notification state, and generated-artifact metadata.

Secret API keys and browser-session tokens are stored only as keyed digests and are shown only at creation. Application inputs are not placed in analytics or implicit URLs.

3. Purposes and legal bases

We process account, project, operation, and billing data because it is necessary to perform the developer-platform contract, including providing and securing the service, enforcing tenant isolation and limits, accounting for credits, handling payments, and delivering requested operational messages.

We process accounting and transaction records to comply with legal obligations. We process proportionate security, abuse-prevention, dispute, and legal-claim records on the basis of our legitimate interests in protecting the platform, users, and legal rights. Where consent is the applicable basis, it may be withdrawn without affecting processing already performed lawfully.

4. Processors

Processors include Clerk for identity, Stripe for payments, Resend for account notifications, and the production hosting provider for application processing, PostgreSQL, and private S3-compatible artifact storage.

5. Retention

Generated developer artifacts are retained for 30 days. Short-lived browser sessions expire at their configured deadline. Security, usage, webhook, billing, and immutable ledger records are retained only as long as necessary for service operation, accounting, fraud prevention, disputes, and applicable legal obligations.

6. Access, correction, and deletion

You may request access, correction, restriction, export where applicable, objection, or deletion. Account deletion does not erase records that must remain for accounting, security, legal claims, or immutable ledger integrity. We will explain retained categories and grounds.

7. International transfers and security

Some processors may handle data outside Czechia or the EEA under their applicable transfer safeguards. We use tenant ownership checks, scoped credentials, origin binding, no-store responses, append-only credit movements, bounded retention, and access controls; no system is risk-free.

8. Contact and complaints

Use the published KonfigurátorSPZ contact channel for privacy requests. You may also complain to the competent supervisory authority.