1. Introduction
This Privacy Policy describes how Obsidian IT Consulting SRL ("we", "our", or "us") collects, uses, and protects your personal data when you create an account and use any of our products and services (collectively, the "Services").
Obsidian IT Consulting SRL is a company registered in Belgium and acts as the data controller. Some products process additional data needed for their specific features; where that is the case, it is described within that product or in its own privacy notice.
2. Information We Collect
2.1 Account Data
- Email address and display name, provided when you create an account
- Your password, stored only as a secure one-way hash
- Any API keys issued to you, stored only as a secure hash
2.2 Subscription & Billing Data
Payments are processed by our payment partner, Polar. We do not see or store your card details. We keep your subscription status, the plan you are on, and the customer and subscription identifiers needed to manage your subscription.
2.3 Technical Data
To keep the Services secure and working, we process basic technical data such as your IP address, request logs, and timestamps. This is used for security, abuse prevention, and troubleshooting.
2.4 Product-Specific Data
Individual products may process additional data to deliver their features (for example, reviews and reviewer email addresses for Review by XLens). That processing is described within the relevant product or in its own privacy notice.
3. How We Use Your Data
| Data Type | Purpose |
|---|---|
| Account data | Create and manage your account, authenticate you, and send important service notifications |
| Subscription & billing data | Process subscriptions and payments and give you access to paid features |
| Technical data & logs | Security, abuse prevention, rate limiting, and troubleshooting |
| Email address | Send transactional messages and, only if you opt in, product updates |
4. Data Sharing
4.1 We Do NOT:
- Sell your data to third parties
- Share data with advertising platforms
- Share data with data brokers
- Use data for personalized advertisements
4.2 We May Share Data With:
- Payment processing: Polar, to handle subscriptions and payments.
- Email delivery: Amazon SES, to send account and service emails.
- Hosting: Hetzner (Germany / EU), for infrastructure hosting.
- Legal authorities: if required by law or to protect our rights.
Individual products may rely on additional processors to deliver their features; these are listed in the relevant product's own privacy notice.
5. Data Security
- All data transmission uses HTTPS/TLS encryption
- Passwords and API keys are stored only as secure hashes
- Access to personal data is restricted on a need-to-know basis
- Server infrastructure is hosted in the EU (Hetzner, Germany)
6. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data | Until you delete your account |
| Billing records | As required by applicable tax and accounting law |
| Technical logs | A short rolling period for security and troubleshooting |
| Inactive accounts | Automatically deleted after 1 year of inactivity |
7. Your Rights
7.1 All Users
- Access: Request a copy of your data
- Deletion: Delete your account via the dashboard settings
- Export: Request a data export by contacting us
- Withdraw consent: Opt out of any marketing emails at any time
7.2 European Users (GDPR)
Under the General Data Protection Regulation (GDPR), you also have the right to:
- Rectification of inaccurate data
- Data portability
- Object to or restrict processing
- Lodge a complaint with a supervisory authority
Legal bases for processing: performance of our contract with you (providing the Services you signed up for), our legitimate interest (keeping the Services secure and preventing abuse), and your consent (for optional marketing emails).
7.3 California Users (CCPA)
- Right to know what data we collect
- Right to delete your data
- Right to opt-out of data sale (note: we do not sell data)
- Right to non-discrimination
8. Children's Privacy
The Services are not intended for users under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.
9. Third-Party Services
We rely on the following third-party providers to operate the Services:
- Polar: subscription and payment processing
- Amazon SES: email delivery
- Hetzner: infrastructure hosting (EU)
Individual products may integrate further third parties, described in their own privacy notices.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be communicated via:
- An updated "Last updated" date on this page
- Email notification for significant changes
11. Contact Us
For privacy-related questions or to exercise your rights, please contact us at:
- Email: al@obsidian-it.be
Data Controller:
Obsidian IT Consulting SRL
Belgium