Privacy Policy

01In short

• Opfield is self-hosted. For an installation on your own servers we never see your servers, containers, databases or the people who use it.
• Installations send the license server only what licensing needs: an installation ID, its name, its Opfield version and the time of each check.
• If you connect an installation to your account, the account portal can show you its machine state and container logs. It fetches them when you open them and does not keep them.
• With managed cloud we run your installation on our servers, so its data is stored with us. We handle it only to run the service for you.
• We collect the minimum to run your account and payments, sell nothing and run no ad trackers.

02What we collect

Account. Your email address; your sign-in sessions with browser, device type and approximate location from the IP address; the public keys of your passkeys; your authenticator secret, stored encrypted; recovery codes, stored only as hashes. We never get your passkey's private key.

Purchases. Invoices with plan, amount, token and network, and the public blockchain data of each payment: the paying address and transaction. We do not collect card numbers or bank details.

Installations. For each installation that contacts the license server: a random installation ID, the name you gave it, its Opfield version, its plan and key, when it registered, and the time of each license check, kept as daily counts. Requests carry an IP address, which our servers log.

Connected installations. When you connect an installation to your account (managed cloud installations are connected automatically), we keep the connection's ID, when it was last online and the installation's Opfield version. When you open an installation's state or logs in the portal, the portal asks the installation for its machine state (CPU, memory, disk, services) and the recent log lines of its containers, shows them to you and does not store them.

Managed cloud. For each cloud installation: its name, plan, region, IP address and address name, the history of operations on it (setup, reboots, backups, restores, plan changes, deletion) and its backups. The virtual machine and its backups hold whatever you and your users put into Opfield. For that data you decide what is collected and why; we store and process it only on your behalf, to run the installation. If you need a data processing agreement, write to us.

Contact form. Your name, email, company, server count, what you are interested in and your message when you write to us.

Website. opfield.dev uses no analytics or advertising cookies. Your browser stores your theme and language choice locally; that never leaves your device.

03Why we use it

• To run your account, issue and renew keys and keep them working, and to run, back up and restore your managed cloud installations: performing our contract with you.
• To keep accounts secure and detect fraud and license abuse, including abuse of the offline allowance: our legitimate interest.
• To keep records of payments: our legal obligation.
• To answer you when you write to us.

We send email that relates to your account: sign-in codes, renewal reminders, receipts and notices about your keys. You choose which reminders you get in your account settings. We do not send marketing email without your consent.

04Who we share it with

The account portal and the license server run on servers we operate ourselves, in Europe. Beyond that, only the providers that run parts of the service for us see your data, under contracts that limit them to that work:

• invoise.me, which processes crypto payments;
• Cloudflare, which carries traffic to our websites and services, delivers our email and serves the DNS names of managed cloud installations;
• the hosting provider we rent the servers for managed cloud installations from.

Payments made on a public blockchain are public by nature: anyone can see the transaction, though not that it was for Opfield. We disclose data to authorities only when the law requires it.

05How long we keep it

• Account data: while the account exists, then deleted within 30 days.
• Contact form messages: 2 years, then deleted.
• Invoices and payment records: for as long as tax and accounting law requires, up to 10 years.
• Installation records: while the installation keeps contacting the license server, then 12 months.
• Managed cloud installations: while they exist. After you delete one, its newest backup is kept for 3 days (Standard) or 7 days (Extended) and then deleted for good; the record of the installation and its operations stays with your account.
• Machine state and logs of connected installations: not stored.
• Server logs with IP addresses: 30 days.
• Records of suspensions for abuse or fraud: as long as needed to prevent repeat abuse.

06Your rights

You can ask for a copy of your data, correct it, have it deleted, restrict or object to how we use it, and take it to another provider. Most of it you can see and change in your account; for the rest write to [email protected]. We answer within 30 days.

Deleting your account deletes your personal data, except payment records we must keep by law. If you think we handle your data wrongly, you can complain to your data protection authority.

07Security

Data travels encrypted. Authenticator secrets are encrypted at rest; recovery codes and key material are stored only as hashes. Staff access to accounts is limited, and every staff change to an account or key is recorded with a reason. Each managed cloud installation runs in its own virtual machine, kept apart from the others on the network, and its backups are stored on separate servers.

08International transfers

Some of our servers and some of the providers above are outside the European Economic Area. Where data leaves it, we rely on adequacy decisions or standard contractual clauses.

09Changes to this policy

We will email you before material changes apply. The date at the top shows the current version.

10Contact

Write to [email protected] about anything in this document. The operator is Alexandr Slavinschii, Republic of Moldova, [email protected].