Privacy policy

1. Controller

NORDIC BYTE LTD, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom, company number 16978110. Contact for privacy matters: hello@nordicbyte.co.uk.

2. Two roles

For account data (name, email, password hash, organisation, billing contact, audit logs, support messages) we are the controller.

For the data your devices send and everything you store in your organisation (telemetry, locations, dashboards, users you invite) you are the controller and we are your processor: we only process it to provide the service and on your instructions. The data processing terms in section 9 apply.

3. What we collect and why

• Account and login data: to create and secure your account (contract). Includes IP address and user agent of logins and security events, kept in the audit log.
• Billing data: name, email, billing address and tax id; card details are collected and stored by Stripe, never by us (contract and legal obligation).
• Usage of the platform (devices, messages, storage): to apply plan limits and bill overage (contract).
• Support messages: to answer you (legitimate interest).
• Technical logs: to keep the service secure and available (legitimate interest), kept for 30 days.

4. What we do not do

We do not sell personal data, we do not run advertising, and we do not use third-party analytics or tracking cookies on the platform. The only storage in your browser is the session token and your preferences (language, theme).

5. Sub-processors and hosting

Data stays in the European Union or the United Kingdom. Where a sub-processor transfers data outside, it is covered by the UK International Data Transfer Agreement or the EU Standard Contractual Clauses.

• Hetzner Online GmbH (Germany): servers and backups, located in the European Union (Finland).
• Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc.: subscription payments, invoices and the customer portal.
• Google LLC and GitHub, Inc.: only if you choose to sign in with those accounts (OAuth); we receive your name and email.
• Email delivery for notifications runs on our own servers in the EU.

6. Retention

• Account data: while the account exists and 90 days after termination.
• Audit and security logs: 12 months.
• Billing records: 6 years (UK tax law).
• Device telemetry: according to the plan, at most 3 years; see the Data retention policy.

7. Your rights

You can access, correct, export and delete your personal data, object to or restrict processing, and withdraw consent where it applies. Write to hello@nordicbyte.co.uk; we answer within one month. You can complain to the Information Commissioner's Office (ico.org.uk) or, in Spain, to the Agencia Española de Protección de Datos (aepd.es).

8. Security

Transport is encrypted (TLS 1.2+), passwords are hashed, device access uses per-device tokens, organisations are isolated, access is role-based and audited, and backups are taken daily. Optional two-factor authentication is available for every user.

9. Data processing terms (processor)

When we process data on your behalf we: process it only on your documented instructions; keep it confidential; apply the security measures above; use only the sub-processors listed here and tell you 30 days before adding one (you may object); help you answer data-subject requests and security incidents, notifying you of a personal data breach without undue delay; delete or return the data at the end of the contract; and provide the information needed to show compliance. A signed DPA is available on request.

10. Changes

We will announce material changes to this policy by email and on the platform at least 30 days in advance.