Privacy Policy
Last updated: 2026-10-02
This policy explains how Individual Entrepreneur - (identification code 0000, Not provided, Georgia) processes personal data in ReleaseDesk Cloud at example.com. Contact for privacy requests: privacy@releasedesk.dev.
We follow the Georgian Law on Personal Data Protection and, for people in the European Economic Area and the United Kingdom, the GDPR.
1. Our two roles
- Controller for account and billing data about the people who sign up for the Service.
- Processor for data about our customers' end users (testers and app users) that customers collect through their own apps and download pages. In that case the customer is the controller and our Data Processing Addendum applies.
2. Data we process as controller
| Data | Purpose | Legal basis |
|---|---|---|
| GitHub login, name, email, avatar, organisation and team membership | Sign-in, access control, team sync | Contract |
| Organisation details, roles, invitations | Operating the Service | Contract |
| Billing contact, company name, tax ID, subscription status (received from Paddle; we never see card numbers) | Billing, accounting, tax | Contract, legal obligation |
| Audit log entries (who did what, when, from which IP) | Security and accountability | Legitimate interest |
| Server logs (IP address, user agent, URL) | Security, abuse prevention, debugging; kept 30 days | Legitimate interest |
| Support emails | Answering your request | Contract, legitimate interest |
3. Data we process as processor
For our customers' distribution features we process: tester names and email addresses, device identifiers (stored as a hash), app version and platform of update checks, download counts, and the country derived from an IP address at request time (the IP address itself is not stored with statistics). Statistics are kept for the retention period of the customer's plan (30 days on Free, up to 400 days on paid plans) and then deleted.
4. Cookies
We use only essential cookies: a session cookie for signed-in users and a cookie remembering your theme (stored locally in your browser). We do not use advertising or analytics cookies, so no consent banner is shown. If this changes, we will update this policy and ask for consent where required.
We use Cloudflare Turnstile in invisible mode to help protect sign-in from bots. Turnstile processes browser and connection signals for this purpose. For details about Cloudflare's processing, see its Turnstile Privacy Addendum.
5. Sub-processors and recipients
| Recipient | Purpose | Location |
|---|---|---|
| Amazon Web Services | Application hosting | EU |
| Cloudflare, Inc. (R2) | Build and file storage | EU jurisdiction setting |
| Paddle.com Market Limited | Payments, tax, invoicing (independent controller for payment data) | UK / EU |
| GitHub, Inc. | Sign-in (OAuth) | US |
| Email delivery provider | Transactional email | EU |
We do not sell personal data. We may disclose data if required by law.
6. International transfers
Primary data is stored in the EU. Where a recipient is outside the EEA (for example GitHub), transfers rely on an adequacy decision or Standard Contractual Clauses.
7. Retention
Account data is kept while the account exists and deleted within 30 days after you delete your organisation or account, except invoice and tax records, which are kept for the period required by law. Logs are kept 30 days. Backups are overwritten within 35 days.
8. Your rights
You can request access, correction, deletion, restriction, portability, and object to processing based on legitimate interest, and withdraw consent where applicable. Email privacy@releasedesk.dev; we reply within 30 days. If you are an end user of one of our customers, contact that customer first. You may also complain to the Personal Data Protection Service of Georgia or to your local supervisory authority.
9. Security
Data is encrypted in transit, access is limited and logged, API tokens are stored hashed, and update feeds are signed. No system is perfectly secure; we will notify affected customers and authorities of breaches as the law requires.
10. Children
The Service is for businesses and is not directed at children.
11. Changes
We will post changes here and notify customers of material changes by email or in the dashboard.