Who is responsible
The data controller for this website and the Tindra Managed service is Blendbyte GmbH, Friedrichstr. 155, 10117 Berlin, Germany. Contact: hi@tindra.sh.
If you use Tindra Managed to process personal data from your own users, that processing is governed separately by our Data Processing Agreement, where you are the controller and we are the processor.
What we collect and why
Website visitors. Our servers record standard access logs (IP address, browser, pages requested, referrer, timestamp). We use these solely to operate and secure the website. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security and service reliability).
We use Fathom Analytics to understand how visitors use this website. Fathom is a privacy-first, cookieless analytics tool. It does not track individual users, does not set cookies, and does not collect personal data. Page view counts and referrers are aggregated and anonymized before being sent to Fathom's servers. We do not use advertising trackers on this website.
Account holders. When you sign up, we collect your name, email address, and company name. We use this to provide the service, send transactional emails (receipts, trial and billing notifications), and respond to support requests. Legal basis: Art. 6(1)(b) GDPR (contract performance).
Billing. Payment processing is handled by Paddle, who act as merchant of record. We do not receive or store your payment card details. Paddle processes payment data as an independent controller under their own privacy policy. We retain billing records (invoices, subscription history) for 10 years to comply with German tax law (Art. 6(1)(c) GDPR).
Service data. Telemetry, error events, and performance data you send via the SDK may contain personal data. We process this data on your behalf as a data processor. See our DPA for details.
Cookies and local storage
This website does not set tracking or advertising cookies. We store your theme preference (dark/light mode) in your browser's local storage. This is a functional preference, not used for tracking, and is never sent to our servers.
The Tindra Managed dashboard uses a session cookie for authentication. This cookie is strictly necessary and expires when you log out or when your session times out.
Who we share data with
We share personal data only with the processors necessary to operate the service: our EU-based hosting infrastructure and Paddle for payment processing. We do not sell personal data or share it with advertisers. We may disclose data if required by law or valid legal process; we will notify you unless prohibited from doing so.
How long we keep data
- Access logs: deleted after 90 days.
- Account data (name, email, settings): retained for the duration of your account, plus up to 30 days after closure to allow data export, then deleted. Note: where your email address appears on invoices, it is retained as part of billing records (see below).
- Service data (telemetry): as described in the DPA. Deleted from live systems within 5 business days of account termination and from backups within 90 days.
- Billing records (invoices, subscription history): 10 years, as required by German commercial and tax law (HGB § 257, AO § 147).
Your rights
Under GDPR, you have the right to access, correct, or delete your personal data; to restrict or object to processing; and to receive your data in a portable format. To exercise any of these rights, write to hi@tindra.sh. We will respond within 30 days.
Where processing is based on legitimate interest (Art. 6(1)(f)), you may object at any time and we will cease processing unless we have compelling legitimate grounds that override your interests.
Automated decision-making
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects (GDPR Art. 22). Account suspension for non-payment or policy violations involves human review.
Supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for Blendbyte GmbH is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (datenschutz-berlin.de).
Changes
We may update this policy from time to time. Material changes will be notified by email to account holders at least 30 days before they take effect. The current version is always available at this URL.