OSMPrivacy policy
Which personal data we keep when you use our website, your OSM account and OSM Connect, why, for how long, and what you can do about it.
Who is responsible
[company name], [postal address]. For anything about your personal data, write to privacy@osm-os.com.
What we keep, why, and for how long
| What for | Which data | Legal basis | How long |
|---|---|---|---|
| Your account and signing in | email address, password (only as a hash), second factors, language, time zone, sign-in history (IP address, browser) | contract (Art. 6(1)(b) GDPR); for security, legitimate interests (Art. 6(1)(f)) | while the account exists; sign-in history 30 days |
| OSM Connect | your servers' IDs and public keys, names, versions and status; a server's address, encrypted, unless you turn sharing it off; requests to link a server (IP address, approximate place) | contract | while a server is linked, then 400 days |
| Payments and invoices | the payment provider's references, your plan, invoice records | contract; for invoices, legal obligation (Art. 6(1)(c)) | invoices 10 years |
| Emails we send you | your address, which message, whether it was delivered | contract; for security notices, legitimate interests | 30 days; an address that bounces, 2 years |
| Security, and stopping misuse | IP addresses, requests, security events | legitimate interests | IP addresses 14 to 30 days; security events 1 year |
| Requests you send us: about your data, misuse, a lost second factor, help | what you write, and how we checked who you are | legal obligation; legitimate interests | 3 years after the request is closed |
| The website, downloads, and updates for OSM servers | IP addresses in the web servers' logs | legitimate interests | 14 days |
| Update reports, from servers whose owner turned them on | the report: which release, versions and parts, and how the update went (no personal data); your server's IP address, only in memory, never stored | legitimate interests | reports 90 days, then only daily totals |
[the lawyer's text: the legal bases in detail, and the legitimate interests we rely on]
Who receives it
Service providers who work for us, each under a data processing agreement: the hosting of our servers, our backup store and log store, our DNS provider (your servers' IDs are in DNS records), the hosting of the relay, our email providers and the host of our status page. Our payment provider takes your payment details; for its own payment duties it is responsible itself. We name each provider on request.
Outside the EU
[the lawyer's text: which providers may handle data outside the EU (for example a payment provider in the United States, or a relay outside the EU), and the safeguard for each: the EU-US Data Privacy Framework or standard contractual clauses]
What your server sends us
A server with OSM Connect turned on reports to us every 15 minutes: its OSM version, whether its connection to the relay is up, and the result of its own test. It also sends its address, so that you can open it from your account, unless you turn off Show this server's address in my OSM account in Settings > OSM Connect on the server (it is on at first); we keep that address encrypted.
If you turn on Report how updates go on your server, it sends us a short report after each update: the release and its channel, the versions, the kind of processor, and whether the update worked or at which step it stopped. We keep it without your server's address or anything else that could point to you, so that a bad release can be stopped before it reaches other servers.
The relay and its logs
The OSM Connect relay is in [the relay's country]. It keeps logs for 7 days, to stop misuse and attacks: which server was visited, when, and from which IP address. It cannot read what you do on your server, and it never logs a server's secret address.
Cookies
The website sets none. The account site sets two, both strictly necessary for signing in:
__Host-osm-session and __Host-csrf. More on the
Cookies page.
Your rights
You may ask for a copy of your data, have it corrected or deleted, have its use restricted, take it with you, and object to how we use it.
- Download your data at any time: Your data, in your account.
- Delete your account at any time: Delete account, in your account.
- For anything else, write to privacy@osm-os.com from your account's address. We answer within one month.
Complaints
You can complain to a data protection authority, for example the one where you live.
[the lawyer's text: the authority responsible for us, and its address]
No automated decisions
We make no automated decisions that have a legal effect on you.
Backups
Our backups keep data for up to 6 months, encrypted. Data you delete leaves them within that time.
Approximate places
The approximate place we show for an IP address (a country and a town) comes from DB-IP's city database, under the Creative Commons Attribution 4.0 licence: IP Geolocation by DB-IP.
Changes to this policy
Each version is dated:
- [date]: the first version.