GDPR at Verne Software: roles, deletion, where the data is

We do not sell personal data and show no advertising. We do not use your end users' data for our own purposes.

The DPA comes with Pro and above. The Free plan does not include one. If your use needs a signed processing agreement, that is the plan to pick.

The full list, with the safeguard for each, is on /subprocessors.

The data is hosted in France. Verne Software is established in Serbia, for which the European Commission has not adopted an adequacy decision. When we access customer data from Serbia, that is a transfer to a third country.

For customers with a DPA, the transfer is covered by the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914: Module Two where you are a controller, Module Three where you are a processor. The clauses are governed by French law, and disputes under them go to the courts of France. For UK and Swiss transfers the DPA adds the UK Addendum (version B1.0) and the Swiss changes. Read the details in the DPA summary.

• Gate: email address and preferred language. Anything else is custom metadata that you choose to send. Passwords are kept only as hashes.
• Sessions and security: session identifiers, IP addresses, user agents and the time of authentication events.
• Passepartout (Telegram): Telegram user ID, username, first name and profile photo link.
• Activity records: for each calendar month, the identifiers of end users who signed in (that is how monthly active users are counted).
• Audit log: identifiers, not email addresses. See /security.
• Payloads: the content of webhooks and scheduled jobs you submit. We do not inspect it.

We do not intend to process special categories of data. The DPA asks you not to put them in identity attributes, metadata or payloads.

Through the API. DELETE /v1/gate/identities/{id} deletes an end user and ends their sessions, and your endpoints receive an identity.deleted webhook. You can also list, read and update identities and revoke sessions, so you can answer an access or correction request without writing to us.

Automatically. Four rules, per project, all off until you switch them on: delete unconfirmed accounts, remind people to confirm their email, remove roles when their deadline passes, and delete inactive accounts (up to 120 months). Deletion always follows a warning email that was actually sent; if the warning cannot be delivered for 72 hours, the person is left as they are. Telegram accounts have no email address, so they are never touched unless you allow deletion without a warning. The detail is in GDPR and automatic account deletion.

What stays after you delete a person, and for how long:

When an account is closed, at the customer's request or under the Terms, we delete the customer's data within 30 days. That covers the account and its projects, API keys, scheduled and delayed jobs and their history, queued webhook events, outgoing emails waiting to be sent, Telegram sign-in settings and the bot token, activity records, automatic-deletion rules and the log of their actions, and the audit log; the identities, credentials and sessions of the customer's end users; the webhook applications, endpoints, messages and delivery attempts; and the cached records and analytics rows.

After deleting, we check every one of those places again and record the date and the number of items found before and after. The record holds no personal data. If you ask, we confirm the deletion in writing, with the date, and say that the check found nothing left.

Today a person at Verne Software runs the deletion by hand, with a script. There is no button for it yet.

Scaleway, which sends our email, keeps its own delivery records (recipient address, subject, status) while our sending domain is active. When a customer leaves, we ask Scaleway to delete that customer's records and keep its written confirmation with our deletion record. See subprocessors.

Left out of the deletion: encrypted backups, which expire on their own (no later than 35 days after they were made; they are not restored except to recover the platform, and if one is restored, the deletion is repeated for everyone who left since it was made); reverse-proxy access logs, which expire within 14 days; application and monitoring logs, kept on a rolling basis on our own servers; payment and invoice records and our correspondence with you, kept as the law requires.

• Read and list every end user through the API at any time.
• A file with the whole set of users including password hashes is not available through the API, deliberately. The account owner writes to support@vernesoft.com from the account's address, with a public key made with age. We send the file, encrypted to that key, within 7 days of confirming the request, and delete our copy within 7 days. The export is recorded in the audit log. Details: Exporting your users.
• If one of your end users writes to us, we pass the request to you. We cannot decide it for you.

For the data we hold as controller, you can ask for a copy, correction, deletion, restriction or a portable form, object to processing based on our legitimate interests, and withdraw consent. Write to support@vernesoft.com from your account's address. We may ask you to prove who you are, and we answer within one month.

You may complain to a data protection authority: the one in the country where you live or work, the Information Commissioner in the UK, or the Commissioner for Information of Public Importance and Personal Data Protection in Serbia (poverenik.rs). For data we process for a customer, Annex I.C of the DPA names the authority. We would like to hear from you first.

We have not appointed a data protection officer. Write to support@vernesoft.com, or by post to the address above.