Codebahn privacy & data

Hackerman AB is the data controller for the personal data described in this policy. For Customer Data hosted on the Service (repository content, issues, CI artifacts), we act as a data processor on behalf of the organisation that owns the data.

Email address Authentication, notifications, billing Contract performance (Art. 6(1)(b))

Display name, username Identification within the Service Contract performance

Organisation name Invoicing Contract performance

IP addresses (in server logs) Security, abuse prevention, debugging Legitimate interest (Art. 6(1)(f))

Your answer to “What brought you here?” during onboarding, and optionally what prompted you to look

Words you give us for publication, with a description you write or approve

Issues, pull requests, comments Hosting the Service Contract performance

Compute-minute consumption Billing, quota enforcement Contract performance

IP addresses (in server logs) Security, abuse prevention, debugging Legitimate interest (Art. 6(1)(f))

We do not use personal data for advertising or profiling.

Server logs containing IP addresses are retained for 30 days, then deleted.

Build logs 90 days after the job finishes (up to 365 days until 15 December 2026)

Customer Data (after cancellation) 30 days read-only; deleted from live systems within 90 days after termination

Billing records 7 years (Swedish Bokforingslag, BFL)

Personal accounts (no subscription) Until you delete the account or 12 months of inactivity

Customer Data does not leave the EU/EEA.

Primary infrastructure Scaleway (Iliad Group) fr-par (Paris, France)

Backups Hetzner Online GmbH fsn1 (Falkenstein, Germany)

Corporate email is handled by Proton Mail (Geneva, Switzerland), which is covered by an EU adequacy decision.

The full list of sub-processors and service providers is published at codebahn.net/docs/subprocessors and is kept current.

For organisations that require a DPA under GDPR Article 28, our Data Processing Agreement is published and applies automatically to all customers.

Erasure (Art. 17). Request deletion of your personal data, subject to legal retention requirements (see section 6).

Access (Art. 15). Request a copy of your personal data.

Rectification (Art. 16). Correct inaccurate personal data.

Erasure (Art. 17). Request deletion of your personal data, subject to legal retention requirements (see section 6).

Restriction (Art. 18). Request restriction of processing in certain circumstances.

Portability (Art. 20). Receive your personal data in a structured, machine-readable format.

Objection (Art. 21). Object to processing based on legitimate interest.

We do not sell personal data.