Privacy policy
Version 1Effective 6 Nov 2026
Privacy policy
The German version is binding.
1. Controller
Lukas Fend, 6020 Innsbruck, Austria, info@fend.software. No data protection officer is appointed.
2. Processing, purposes and legal bases
| Area | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Website, hosting | IP address, browser data, logs | Operation and security | Art. 6(1)(f) |
| Account and sign-in (SSO) | Name, email, credentials, second factors, sessions, devices | Providing the account | Art. 6(1)(b) |
| Organizations and access | Memberships, roles, invitations, logs | Access management, traceability | Art. 6(1)(b), (f) |
| Access requests, contact form | Name, email, organization, message | Handling the request | Art. 6(1)(b), (f) |
| Support tickets | Contact data, content, attachments | Handling requests | Art. 6(1)(b), (f) |
| Email delivery | Email, delivery status | Account messages | Art. 6(1)(b), (f) |
| Statistics with self-hosted Umami | Anonymised usage data, no cookies | Reach and improvement | Art. 6(1)(f) |
| Status checks | Technical measurements | Availability | Art. 6(1)(f) |
| Backups | Copies of the above | Recovery | Art. 6(1)(f) |
Please do not enter special categories of data such as health data. The service is not intended for them.
Support for other organizations: If another organization runs its own support workspace, it is the controller and the operator is its processor.
3. Recipients
- Hetzner Online GmbH, Germany: servers, object storage, backups
- Brevo (Sendinblue SAS), France: email delivery
- Cloudflare, Inc., USA: DNS
Where required, processors are bound by agreements under Art. 28 GDPR.
4. Retention
| Data | Period |
|---|---|
| Security log (sign-in) | 13 months |
| Other audit log | 24 months |
| IP addresses, user agents | 90 days, then truncated or removed |
| Known devices | 180 days since last use |
| Contact requests | 30 days after successful forwarding |
| Support tickets | 36 months after closure |
| Deletion records | 6 months |
| Status data | 14 days raw, 400 days aggregated |
Account data is kept until the account is deleted.
5. Cookies and local storage
We only use storage that is technically necessary or that you asked for.
| Area | Name | Purpose | Lifetime |
|---|---|---|---|
| fend.software | NEXT_LOCALE | Chosen language | 1 year |
| all | fend-theme (local) | Chosen theme | persistent |
| fend.software | Preview cookies, __Host-fend.preview | Admin preview | session or 10 minutes |
| fend.software | Status cache (session) | Status display | session |
| app.fend.software | Session cookie | Sign-in | per session |
| app.fend.software | fend_ctx | Last organization | 90 days |
| id.fend.software | Session, __Host-fend.2fa_challenge, __Host-fend.did, __Host-fend.enroll_skip | Sign-in, second factor, known device | session; second factor 10 minutes; known device 180 days |
Umami sets no cookies and only reads the setting umami.disabled.
6. Your rights
You have the right to access, rectification, erasure, restriction, portability and objection. You can export and delete your data in your account or ask by email.
Complaints: Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb.gv.at.
7. Minimum age
Accounts are intended for people aged 14 or older.
8. Changes
The current and earlier versions are available in the version history.
Last changed: Initial version