Data Processing Statement
In the interest of transparency and GDPR compliance, this page explains how the The Beanstalks Project handles and processes your personal information on pagekite.net.
This is a living document and will be updated with new information as our services evolve. The last updated was May 25, 2018.
You may also be interested in our Terms of Service and Privacy Policy.
The pagekite.net Website
Our website uses cookies when you log in to your account.
Our website generates standard access- and error logs, which are kept for operational reasons. These logs include IP addresses and information about your web browser and operating system version. They are kept for a maximum of 3 months, and then automatically deleted.
We do not use any 3rd party service for website analytics and do not use cookies for tracking purposes.
Old information (logs) may persist for an additional month in secondary system backups.
Your Account Details
Your account details; your name, e-mail address and any custom text you have requested we include on your invoices are all visible on your account page. Note that we do not require our users provide us with real names or custom text, this option is a convenience which allows us to compose friendlier e-mails and make sure your receipts contain the information you need for your own accounting purposes.
You can edit or redact information from there at any time. You are welcome to use a pseudonym or alias. You can also delete your account at any time by using the unsubscribe option on that page.
The changes made on this page have immediate effect within all live PageKite infrastructure; however old information may remain present in secondary locations, such as:
- The internal system audit log
- PDF renderings of receipts
- E-mail archives
- System backups
For tax compliance reasons, receipts and other financial records are stored for 7 years in encrypted off-line storage. This data is automatically deleted from our live (on-line) systems after 3 months.
Data Transmitted Over PageKite Relays
We do not routinely log or store any of the content transmitted over the PageKite relay infrastructure.
Exceptions to this will be made only temporarily, if necessary to troubleshoot and diagnose system failures, or to comply with legal requirements such as a subpoena. In practice, as of May 2018, this has never happened - we have never had cause to inspect our customers' traffic. However, we reserve the right to do so if it becomes necessary for operational or legal reasons. We encourage all of our customers to make use of end-to-end TLS encryption whenever possible to limit their exposure in these rare cases.
For operational reasons, our relays keep logs of the following meta-data for up to 7 days:
- Dates, times, bytes transmitted and connection speed for each request
- Kite names, protocols and ports for each connection made
- Partial IP addresses (the last 2 octets)
No backups are kept of relay logs.
Relay servers have no access to Account Details, even the protocol used to authenticate tunnel connections uses a zero-knowledge scheme so the shared kite secret is never revealed to the relay server itself.
Third Parties: Payment Processors
We delegate payment processing to Dalpay and PayPal. Their privacy policies may be found on their respective websites.
When a payment is made, our payment processors forward to us the information required for us to validate and process your order. This includes most of the information you have provided them with during the payment process, except for credit card details which we never see.
This information is in turn used to provide you with a receipt and update your account quotas.
For tax compliance reasons, receipts and other financial records are stored for 7 years in encrypted off-line storage. This data is automatically deleted from our live (on-line) systems after 3 months.
Third Parties: Hosting Providers
PageKite rents world-wide computing and network capacity from of a variety of different providers, including:
Most of these servers are relay servers which have access to very little personal information and are configured to delete all local logs after only a few days have passed (see above). The exception is our web server and account database servers, which also have the public roles of API and DNS servers. These servers are hosted with Linode and Linode also makes backups of live system data on our behalf.
In all cases, the services provided by these Third Parties to PageKite are content agnostic server capacity, public IP addresses and network bandwidth. We do not grant these providers any access to information about individual customers, although by nature of the services they provide, they do store such data on our behalf.
For reasons of system uptime and availability (we want our servers to restart automatically without human interaction), our server disks are not currently encrypted. We are investigating ways to improve upon this.
We would consider it a breach of trust and a breach of contract if any of these providers were to access our server disks and extract private information about our customers.
Support
Links
The Beanstalks Project ehf.
