Version 1.2 · locale en
· machine-readable: JSON
This policy explains what personal data the AtlasEye license server and customer portal (license.cdnglobal.eu) process, why, and your rights. It covers only the data described below. For everything your own AtlasEye installation processes, see §2 ("Self-hosted installations — who is responsible for what").
Controller: CDNCORE, LDA (trading as "cdnCore"), a private limited company (sociedade por quotas) registered in Portugal under NIPC 518440826 (VAT PT518440826), with registered office at Parkurbis, Parque de Ciência e Tecnologia da Covilhã, 6200-865 Covilhã, Portugal.
Privacy contact: privacy@cdnglobal.eu.
AtlasEye runs on your own infrastructure. All data your installation processes — the user accounts and login records of your staff, audit trails, monitored-device data, syslog messages and the IP addresses they contain, and web-analytics data about visitors to your websites — is stored exclusively on your systems and is never transmitted to us. For that data, you (our customer) are the sole data controller and must provide your own privacy notice to your users and website visitors. We have no access to it and act as neither controller nor processor for it; no data processing agreement (Art. 28 GDPR) is required with us for your use of the software. Air-gapped installations transmit nothing to us at all — for them, only §2.4 (portal account, if you create one) and §2.5 (billing/sales contact) can apply.
| Data | Purpose | Legal basis (Art. 6(1)) |
|---|---|---|
| Licence key | Identify the licence being activated/verified | (b) contract |
| Hardware fingerprint — a SHA-256 hash of the host machine-id, a random installation UUID, and the primary network interface's MAC address; only the hash is transmitted, never the inputs | Enforce activation limits and one-trial-per-machine; recognise the same installation | (b) contract; (f) legitimate interest (licence enforcement) |
| Installed product version, container-image digest, integrity-manifest hash (sent with each licence check, roughly every 6 hours) and version sent with update polls (roughly hourly) | Serve correct updates; detect tampered installations | (b) contract; (f) legitimate interest |
| EULA version accepted + acceptance timestamp (recorded per activation) | Evidence that the licence agreement was accepted for this installation | (f) legitimate interest (establishment of legal claims) |
| A watermark identifier deterministically derived from your licence key and customer id (not stored as data; embedded in your installation's UI to trace leaked screenshots) | Licence enforcement | (f) legitimate interest |
Your installation's public IP address necessarily reaches our infrastructure whenever it contacts the license server; it appears only in short-lived server access logs (§5) and is not stored in the licence database.
A trial can be requested anonymously. If you choose to provide a profile, we process the details you submit — email, first/last name, company, VAT number, phone, country, address — for pre-contractual steps, invoicing, and tax compliance (Art. 6(1)(b), (c)).
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, password (stored only as a strong adaptive hash), first/last name, company, country | Account creation, authentication, account management | (b) contract |
| Email-verification and password-reset tokens (single-use; verification tokens expire after 48 hours, reset tokens after 2 hours; cleared on use) | Account security | (b) contract |
| Optional two-factor-authentication secret (encrypted) | Account security, at your choice | (b) contract |
| Last-login timestamp | Account security | (f) legitimate interest |
| IP address at the time of security-relevant account actions (data export, deletion request, profile/security changes) and administrative actions | Recorded in our append-only audit log to evidence who performed the action, investigate abuse, and demonstrate compliance with data-subject requests | (f) legitimate interest; (c) legal obligation |
| Support messages you send via the portal contact form (your email and message content) | Answering your request | (b) contract; (f) legitimate interest |
When billing is enabled and you purchase a paid plan: your email address, chosen plan, and billing cycle are shared with Stripe to create the checkout session; Stripe returns your email, the name you entered at checkout, and subscription/transaction references, which we store against your licence (Art. 6(1)(b); fraud-prevention signals under (f)). Invoices and receipts are generated and hosted by Stripe. Full card or bank details never touch our servers. Where billing is disabled on this deployment, no data is sent to Stripe.
Where we obtain data from someone other than you (Art. 14): we may receive your business-contact details from Stripe (when a purchase is made for your organisation), from your employer or colleague (when they register a trial or purchase on your organisation's behalf), or record them ourselves during sales contact. In these cases the data is limited to business-contact details (name, email, company, billing address) and licence entitlements; this policy is linked from every account and licence email we send.
We do not sell personal data and do not share it with anyone else, except where required by law.
Our servers and database are located in the EEA. Two optional integrations can involve transfers outside the EEA when enabled on this deployment: Stripe (§2.5) and Cloudflare Turnstile (§3), both certified under the EU–US Data Privacy Framework and additionally bound by Standard Contractual Clauses (2021/914). No other transfers outside the EEA take place.
| Data | Retention |
|---|---|
| Active licence rows (licence key, plan, entitlements) | Lifetime of the licence; expired/revoked rows are reviewed and anonymised at least annually |
| Activations (fingerprint hash, timestamps, version data, EULA acceptance) | Same as the parent licence; acceptance records may be kept longer as evidence of contract (Art. 17(3)(e)) |
| Integrity/tamper strike records | Until cleared by an administrator following investigation |
| Portal accounts | Until you delete your account (§6); login credentials are deleted when the deletion is approved (target: within 30 days), the remaining profile is anonymised unless licences, invoices, or legal obligations require retention |
| Email verification / password-reset tokens | Single-use; expire after 48h / 2h and are cleared on use |
| Audit log (administrative and account security actions, incl. IP address and, for deletion requests, the requesting email) | Retained for the life of the service as security forensics and evidence that requests were honoured (Art. 17(3)(b), (e)) |
| Billing records (Stripe references, invoices) | As required by tax and accounting law (typically 10 years in Portugal) |
| Server access logs (connection IPs, requested URLs) | Kept for operational security and periodically purged; not aggregated, profiled, or shared |
| Support correspondence | For the duration of the customer relationship |
You can: access your data, rectify it, erase it, restrict or object to processing based on legitimate interest, and receive a portable copy (Art. 15–21 GDPR).
Self-service: from Portal → Profile you can download a machine-readable export of your account, profile, licences, and activation history at any time, and request account deletion from the same page. On a deletion request your login is disabled immediately and an operator confirms the deletion (normally within 30 days); a minimal audit record of the request (your email, timestamp, requesting IP) is retained as evidence that the request was honoured. Anything not covered by the export can be requested via privacy@cdnglobal.eu.
You may lodge a complaint with a supervisory authority — either the authority of your habitual residence or our lead authority, the Comissão Nacional de Proteção de Dados (CNPD), https://www.cnpd.pt.
Our license server automatically suspends an installation's licence verification when repeated integrity-check failures indicate tampering (after three consecutive failed checks), and automatically limits trial licences to one per machine (§2.2 fingerprint). These are the only automated decisions we take; no profiling for marketing or scoring occurs. If your installation is blocked you can obtain human review at any time via support@cdnglobal.eu — a person, not the system, decides whether the block is lifted (Art. 22(3) GDPR).
The customer portal sets only first-party cookies that are strictly
necessary or reflect your explicit choice: lsr_portal_session
(authenticated session; HttpOnly, SameSite=Lax, Secure in production), a
short-lived cookie used only during two-step login when you have enabled
2FA (expires after 5 minutes), and portal_lang (your chosen interface
language, set only when you pick a language). The admin console used by
our own staff sets an equivalent session cookie (lsr_admin_session).
None of these are used for tracking, and no consent banner is required for
them. When bot protection is enabled, the Cloudflare Turnstile widget
described in §3 runs on the sign-in/sign-up forms only and may store
technical client-side state solely for bot protection. Apart from that, we
use no third-party cookies, advertising trackers, or tracking pixels.
The license server runs as a non-root container with a strictly limited database account; passwords are stored only as strong adaptive hashes; two-factor secrets and other stored secrets are encrypted at rest; release manifests are signed with an Ed25519 key held outside the repository; images are vulnerability-scanned before release; access to production systems is restricted to authorised personnel. If a personal-data breach is likely to result in a risk to you, we will notify the competent authority within 72 hours and, where required, notify you directly (Art. 33–34 GDPR).
AtlasEye is a business tool. Our services are not directed at children and we do not knowingly collect personal data from anyone under 16. If you believe a minor has created a portal account, contact privacy@cdnglobal.eu and we will delete it.
We will publish changes to this policy at this address; material changes are announced to the account email of affected portal users. The version you are reading is shown in the title.
Questions and requests: privacy@cdnglobal.eu or by post to the controller's address in §1.
Version 1.2 — drafted 2026-07-24; effective upon publication on the license server.