Privacy Policy

The controller of the personal data described in this policy is CodeNet Sp. z o.o., a limited liability company established in Poland. You can reach us at [email protected].

This policy covers telo.cloud, console.telo.cloud and accounts.telo.run.

We are the controller for everything listed in this policy. For personal data inside the content a customer puts into Telo Cloud, we are a processor acting for that customer.

The apps you deploy run on your own infrastructure, and the data they handle does not pass through Telo Cloud.

This website uses no cookies, no advertising, no trackers that follow you to other sites and no forms. It loads one resource from outside telo.cloud: the script of our page-view statistics, from analytics.codenet.pl, an instance of Plausible that we run ourselves.

For each page you view and each link you follow out of the site, the statistics record the address of the page, the address of the page that led you to it, your browser, your operating system, the kind of device and the country, and where it can be told the region and the city, your IP address belongs to. To count visitors, your IP address and user agent are combined with a random value that is replaced every day into a number that cannot be turned back into either and cannot connect one day’s visits to the next. Neither your IP address nor your user agent is stored, and nothing is kept in your browser.

The server log records the time, the method, the host, the path without its query string, the status, the duration and the size of the response. It records no IP address, no user agent, no referrer and no other header. Your IP address is processed only in transit, to deliver the response.

For your Telo account we process:

• your e-mail address, which identifies you and receives your sign-in links;
• your name;
• your sessions: their time, IP address and user agent;
• the authorizations you grant to apps and devices;
• invitations;
• security events in the audit log: the action, its time, the IP address and the user agent.

Rate-limit counters are keyed by hashes.

For an organization we process:

• its name, members, roles and groups;
• invitations, with the invitee’s e-mail address;
• a billing profile, if one is provided: legal name, invoice e-mail address, address and tax ID.

This data is visible to the organization’s members and administrators.

In the console we process:

• your session: your name, e-mail address and tokens, stored encrypted;
• projects and the roles in them;
• apps, environments and configuration;
• secrets and cluster credentials, stored encrypted and never displayed;
• the deployment history, including who triggered each deployment;
• an audit log, including IP address and user agent.

We send transactional e-mail only: sign-in links, invitations, e-mail address changes, ownership transfers, member removals, data exports and account deletions. We send no marketing e-mail and use no tracking pixels.

Correspondence you send us is kept in order to answer it.

No payments are taken today. When billing launches, payments are processed by Stripe: card data goes to Stripe and is never stored by us, and the billing profile is shared with Stripe to create the customer record and invoices.

We use strictly necessary cookies only, for which no consent is required. There are no analytics or advertising cookies.

• accounts.telo.run: an account session cookie, kept for up to 30 days and ended after 14 days without use;
• accounts.telo.run: __Host-accounts_sign_in, which binds a sign-in link to the browser that asked for it;
• accounts.telo.run: __Host-accounts_invite, which holds an invitation while you sign in, for 1 hour;
• accounts.telo.run: __Host-accounts_pending, which remembers the app you are signing in to so you return to it, for 1 hour;
• console.telo.cloud: __Host-sid, the console session, for up to 30 days;
• console.telo.cloud: __Host-telo-login, while a sign-in is in progress, for 10 minutes;
• telo.cloud sets none.

• Performing our contract with you (Article 6(1)(b) GDPR): the account, the organization, the console and service e-mail.
• Our legitimate interests (Article 6(1)(f) GDPR): security, abuse prevention, rate limiting, audit trails, operational logs, statistics of how the website is used, legal claims and answering inquiries.
• A legal obligation (Article 6(1)(c) GDPR): accounting and tax records, once invoices exist.

We do no consent-based processing, no marketing, no profiling and no automated decision-making, and we do not sell personal data.

We use processors under contract: an infrastructure hosting provider, an e-mail delivery provider and, once billing is live, Stripe. The current list is available on request. Data is also seen by the members of your organizations, and by authorities where the law requires it.

Where a provider processes personal data outside the European Economic Area, the transfer relies on an adequacy decision or on Standard Contractual Clauses. A copy is available on request.

• The website’s statistics: without a time limit; they hold nothing that identifies a visitor.
• Sign-in links: 10 minutes.
• The console’s sign-in state: 10 minutes.
• Sessions: up to 30 days, ended after 14 days without use.
• Invitations: they expire after 7 days; accepted and revoked ones are kept 90 days.
• Data export links: 24 hours.
• The console’s audit log: 365 days.
• The account audit log: for the life of the organization; after an account is deleted its entries remain without the name, IP address and user agent.
• A deleted organization: 30 days, then it is permanently deleted with its audit entries and its encryption key.
• Account deletion: immediate.
• Deleted projects, apps and environments: removed by a background job; they cannot be restored.
• Operational logs and backups: a limited period.
• Billing records: for as long as tax law requires.

You have the right to access, rectification, erasure, restriction of processing, data portability and objection.

In your Telo account you can manage your profile and sessions, export your data and delete your account yourself. For any other request write to [email protected]; we answer within one month.

You can lodge a complaint with the President of the Personal Data Protection Office (UODO) in Warsaw, or with your local supervisory authority.

An e-mail address is required to have an account. A billing profile is required only for paid plans.

• Connections are protected with TLS.
• Secrets, cluster credentials and the tokens your console session holds are encrypted at rest with AES-256-GCM under per-organization keys.
• Sign-in, invitation and export tokens are stored only as hashes.
• Tenants are isolated from one another.
• Security-relevant actions are recorded in an audit log.

The service is not directed at anyone under 18.

Changes to this policy are published on this page with a new date. We announce material changes by e-mail.

Questions about this policy or your data: [email protected].