# Privacy policy

> What personal data Lampwick collects about its customers and website visitors, why, on what legal basis, how long we keep it, and your rights under the GDPR.

Lampwick is a service of NIO Media. This policy explains what personal data we process when you visit lampwick.dev, create an account, are invited to a team, pay for a plan, use the iOS app or view a public status page.

Lampwick has two roles under the GDPR:

- **Controller** for the data about you as our customer or visitor: your account, your team membership, billing, security logs and the website. This policy covers that data.
- **Processor** for the monitoring data your apps send us (errors, logs, requests, browser errors, app users). That data often contains personal data of your own users. You decide what you send and why; we process it only on your instructions, under our [Data processing agreement](/legal/dpa/). If you are an end user of an app that uses Lampwick, contact that app's operator first.

## Who we are

NIO Media is the trade name of Niels Oosterhoff, sole proprietorship (eenmanszaak) registered with the Netherlands Chamber of Commerce under number 69855773.

| | |
|---|---|
| Controller | NIO Media |
| Address | Roomweg 68, 7523 BR Enschede, the Netherlands |
| Chamber of Commerce (KvK) | 69855773 |
| VAT | NL002409406B60 |
| Privacy contact | [info@niomedia.nl](mailto:info@niomedia.nl), or the [contact form](/contact/) (topic "Privacy") |

## What we collect, why, and for how long

The retention periods below are what the software does today. Where a row says "until deleted", the data goes when you delete your account, or the team it belongs to, whichever comes first. Database backups keep it for about 30 more days (see [Backups](#backups)).

### Your account

| Data | Purpose | Legal basis | Kept |
|---|---|---|---|
| Email address, password (stored only as an Argon2 hash), account creation date | Create and run your account, log you in | Contract (art. 6(1)(b)) | Until deleted |
| Two-factor secret and recovery codes | Optional second login factor | Contract (art. 6(1)(b)) | Until you turn 2FA off or delete your account |
| Team name, team membership and role (owner or member) | Share projects with your team | Contract (art. 6(1)(b)) | Until deleted |
| GitHub or Google account id, verified email address and GitHub login name | Only if you choose "Continue with GitHub" or "Continue with Google" | Contract (art. 6(1)(b)) | Until you disconnect the provider or delete your account |
| Accounts that never confirm their email address | Signup | Contract (art. 6(1)(b)) | Deleted automatically after 7 days |
| API tokens (stored only as a hash), connected apps (OAuth grants for MCP clients) | API and MCP access you set up | Contract (art. 6(1)(b)) | Until you revoke them, they expire, or you delete your account. OAuth access tokens last 1 hour, refresh tokens 60 days |

When you log in with GitHub we ask for the `user:email` scope only; with Google, `openid email`. We don't receive your password at those providers. GitHub and Google process your login as independent controllers under their own privacy policies.

**What you must provide.** An email address and a password (or a GitHub or Google login) are needed to create an account; billing details are needed for a paid plan. Without them we can't provide the service. Everything else is optional.

**No automated decisions.** We make no decisions about you based solely on automated processing that have legal or similarly significant effects (art. 22 GDPR). Plan limits are applied by the software, but they follow from the plan you chose.

### If you are invited to a team

When a team owner invites you, we store your email address, the team, the role and who invited you, so we can send you the invitation and let you join. The owner gave us your address; the legal basis is the team's legitimate interest in adding colleagues (art. 6(1)(f)). A pending invitation is kept until it is accepted or revoked, or the team is deleted. The link in the email works for 7 days.

### Sessions and security logs

| Data | Purpose | Legal basis | Kept |
|---|---|---|---|
| Session cookie (a random id; we store only its hash) | Keep you logged in | Contract (art. 6(1)(b)) | 30 days, or until you log out |
| Audit log: who did what (logins, 2FA changes, token changes, team and project changes), with the IP address and the channel (web, API, MCP, app) | Security, and to let team owners see who changed what | Legitimate interest in securing accounts and teams (art. 6(1)(f)) | 365 days |
| IP address in rate limiting and account lockout counters | Stop password guessing and abuse | Legitimate interest (art. 6(1)(f)) | In memory only, minutes to hours; never written to the database |
| Mail throttle: a hash of the email address, the kind of mail and the time | Limit how many mails one address gets | Legitimate interest (art. 6(1)(f)) | 2 days |
| Web server access logs: IP address, time, URL and user agent of every request, including ingest and status pages | Operate and secure the service | Legitimate interest (art. 6(1)(f)) | Up to 14 days |
| Application logs, which can contain email addresses (for example of failed mails or account actions) | Find and fix errors | Legitimate interest (art. 6(1)(f)) | Up to 14 days |

Team owners can see the IP addresses in their team's audit log; members can't. When an account is deleted, its own audit log goes with it, but team audit entries keep the email address and IP address of whoever made a change, so the team's history stays readable for the rest of the 365 days.

### Billing

| Data | Purpose | Legal basis | Kept |
|---|---|---|---|
| Plan, subscription status, billing interval, renewal date, Stripe customer and subscription ids, monthly event counts | Run your subscription and enforce plan limits | Contract (art. 6(1)(b)) | Until the team is deleted; monthly usage counts 13 months |
| Company name, billing email, billing address, VAT id, payment method | Payment and invoices | Contract and legal obligation (art. 6(1)(b) and (c)) | You enter them in Lampwick or Stripe; we pass them to Stripe, which stores them. We don't keep a copy |
| Invoices | Tax and bookkeeping | Legal obligation (art. 6(1)(c)) | 7 years (art. 52 of the Dutch General Tax Act, AWR), by us and by Stripe, also after you delete your account |

Payments go through Stripe. Lampwick never sees your full card details: the payment form on the **Billing** page is Stripe's own (Stripe.js). Stripe acts as an independent controller for payment processing and fraud prevention ([Stripe privacy policy](https://stripe.com/privacy)).

### Emails and notifications

| Data | Purpose | Legal basis | Kept |
|---|---|---|---|
| Your email address and the content of service mails: verification, password reset, invitations, alerts, usage and retention notices | Run the service you signed up for | Contract (art. 6(1)(b)) | Alert mails leave our queue within a day; alerts themselves are kept 30 days |
| iOS app: device name, platform, Apple push token | Send push notifications for your projects | Contract (art. 6(1)(b)) | Until you log out in the app, remove the device, or delete your account |

We send no newsletters or marketing mail. You can turn alert mails off on **Account & security**.

### Support

If you email us, we use your message and email address to answer you, based on our legitimate interest in helping customers (art. 6(1)(f)), or on the contract when it is about your account. We keep support mail for 2 years after the last message, except where it is part of our tax records, which we keep for 7 years.

| Data | Purpose | Legal basis | Kept |
|---|---|---|---|
| Contact form: your name, email address, company (optional), topic and message | Answering you | Legitimate interest in answering questions (art. 6(1)(f)), or steps you ask for before a contract (art. 6(1)(b)) | Like support mail: 2 years after the last message. Lampwick stores nothing: the form sends your message to our inbox by email |
| Contact form: your IP address | Limit how many messages one network can send | Legitimate interest (art. 6(1)(f)) | In memory only, 1 hour; never written to the database |

The [contact form](/contact/) sends you no email; we answer from our inbox. Our logs record only the topic and length of a message, never its text or your address.

### Public status pages

Status pages set no cookies and run no scripts. When you view one, your IP address is used in memory to limit requests (300 per 5 minutes) and appears in the web server access logs above. We use it for nothing else.

### The website

The marketing website (lampwick.dev, the docs and these pages) sets no cookies, uses no analytics or tracking, and loads nothing from third parties. The theme toggle doesn't store anything.

## Cookies

| Cookie | Set by | Purpose | Lifetime |
|---|---|---|---|
| `__Host-lampwick_session` | The app, after you log in | Keeps you logged in | 30 days (10 minutes during the 2FA step) |
| `__Host-lampwick_oauth` | The app, during "Continue with GitHub/Google" | Protects the login flow (state, PKCE, nonce) | 10 minutes |
| `lw_hostchecks_notice` | The app, when you dismiss a notice | Remembers that you closed it | 1 year |
| `__stripe_mid`, `__stripe_sid` | Stripe.js, only on a team's **Billing** page, for owners | Fraud prevention for payments; Stripe.js also contacts `m.stripe.network` | 1 year and 30 minutes |

The Lampwick cookies are strictly necessary or functional for a service you asked for, so they need no consent under the Dutch Telecommunications Act (art. 11.7a Tw). Public status pages and the website set no cookies.

## Who receives your data

We use these service providers. Those marked "processor" process data only on our behalf under a data processing agreement.

| Provider | Role | What they get | Location |
|---|---|---|---|
| Hetzner Online GmbH | Processor: servers, database, backups | All data in Lampwick | Germany (EU) |
| Lettermint | Processor: sending email | Your email address and the mail content, including messages you send with the contact form | EU (the Netherlands) |
| Stripe Payments Europe, Limited | Independent controller for payments; processor for parts of billing | Company name, email address, billing address, VAT id, payment details | Ireland, with transfers to the US |
| Apple (Apple Push Notification service) | Processor: push notifications to the iOS app | Push token and notification text: for issues the project name, issue number, error class and message; for alerts their title and body, such as monitor names, failure reasons and URL host and path | US |
| GitHub, Google | Independent controllers, only if you log in with them | The login itself | US |

Our source code is hosted on GitHub, and GitHub Actions builds and deploys it to our server. GitHub doesn't receive account, billing or monitoring data.

We don't sell personal data and don't share it with advertisers. We may disclose data when Dutch law or a court order requires it.

## Transfers outside the EU

Lampwick's servers and backups are in the EU. Data reaches the US only through Stripe (payments), Apple (push notifications, if you use the iOS app) and GitHub or Google (if you log in with them). For Apple we rely on the EU-US Data Privacy Framework; for the others on the Data Privacy Framework where the recipient is certified, and on the European Commission's Standard Contractual Clauses otherwise.

## Backups

The database is backed up every night. Local backups are kept for 7 days and off-site backups (Hetzner Object Storage, a different location in the EU) for 30 days. Data you delete therefore disappears from backups within about 30 days. We restore a backup only to recover from a failure.

## Security

We protect your data with:

- TLS for all traffic, with HSTS;
- passwords hashed with Argon2, and session ids, API tokens and email links stored only as hashes;
- 2FA secrets and alert channel webhook URLs encrypted at rest;
- rate limits and account lockout on logins;
- strict isolation between teams, and a team audit log;
- servers with automatic security updates, a firewall and SSH key-only access.

The [Data processing agreement](/legal/dpa/#security-measures) lists the measures in more detail.

If a breach puts your personal data at risk, we notify the Autoriteit Persoonsgegevens within 72 hours and tell you without undue delay when the risk to you is high (art. 33 and 34 GDPR).

## Your rights

You have the right to access, correct and delete your personal data, to restrict processing and to data portability. You can do much of it yourself:

- **Access and portability**: most of your data is available through the [API](/docs/api/), in JSON. You can also ask us by email for a full copy.
- **Correction**: change your details on **Account & security**, and billing details on the team's **Billing** page.
- **Deletion**: delete your account on **Account & security**. Teams where you are the only member are deleted with all their projects and data. If such a team still has a running subscription, cancel it first; you can delete once the paid period has ended. If you are the only owner of a team with other members, transfer ownership first.

**Right to object.** Where we process your data based on legitimate interest (security logs, the audit log, invitations, support), you can object at any time on grounds relating to your situation. We then stop, unless we have compelling legitimate grounds that override your interests, or need the data for legal claims.

For any request, email [info@niomedia.nl](mailto:info@niomedia.nl). We answer within one month (extendable by two months for complex requests, in which case we tell you). We may ask you to confirm your identity first.

You can file a complaint with the Dutch data protection authority, the [Autoriteit Persoonsgegevens](https://autoriteitpersoonsgegevens.nl), or with the authority in the EU country where you live or work. We'd appreciate the chance to help first.

## Changes

We update this policy when the service changes. For material changes we email everyone with an account at least 30 days in advance. The effective date at the top of this page shows the current version.