This document describes what KLEPON's website and licensing API actually do with personal data today — it is not an aspirational policy, and it has not been reviewed by a lawyer. Sections markedUnresolved below identify facts this document cannot state yet — a placeholder has deliberately not been invented to fill them.
1. Scope
This policy covers KLEPON as a product: the marketing website you are reading now (klepon.systems), and the licensing API and account/license data behind it.
It does not yet cover the Revit plugin itself. What the plugin installs, what it writes to your machine, and whether it transmits any Revit model or project data have not been verified and are not described here. This section will be updated once that review happens.
2. Who we are
Unresolved — needs LQ-01. "KLEPON" is currently a product/trading name, not a registered legal entity. This section is missing the legal entity name and form, registered address, and company registration / VAT number that a data controller must be identified by. These have not been decided and are not invented here.
Contact for privacy requests: support@klepon.systems
3. What data we collect
The marketing site itself has no forms, no accounts, and no analytics — it does not collect any personal data on its own. Personal data is collected once you create an account with the licensing API:
| Data | Where it's stored | Why |
|---|
| Email address (used as your login/username) | Postgres, AspNetUsers table | Account identification, login |
| Password | Postgres, hashed (never stored in plain text) | Authentication |
| Refresh token | Postgres, SHA-256 hashed (never stored raw) | Keeping you signed in without re-entering your password |
| License status, license key, issue/expiry dates | Postgres, Licenses table | Enforcing and support-tracking your license |
| IP address | Held only in server memory for rate limiting, never written to the database or logs | Blocking brute-force login attempts |
We do not collect names, phone numbers, payment details, or any usage/analytics data.
4. Cookies and similar technologies
The marketing site is a static Astro site and sets no cookies of its own — no analytics or tracking scripts run anywhere on it.
The licensing API's browser-based Admin Portal (staff only) sets a session cookie (HttpOnly, SameSite=Strict, 8-hour sliding expiry), and its form pages set a standard antiforgery cookie. Neither is set for regular website visitors or plugin users.
Our position is that these are strictly-necessary cookies and that no consent banner is required for them — but that is an engineering assessment, not a confirmed legal conclusion.
5. Legal basis for processing
This is engineering's draft classification for internal/legal review, not a final legal determination:
- Performance of a contract — creating your account, authenticating you, and issuing/validating your license, since these are necessary to provide the service you signed up for.
- Legal obligation — the self-service data export and account deletion features exist because GDPR requires offering them (Articles 15 and 17), not because the service needs them to function.
- Legitimate interest — IP-based rate limiting and account lockout exist to protect accounts from credential-stuffing and brute-force attacks. This classification, along with backups and internal admin-tool access, is still a draft pending an actual documented balancing test.
6. Hosting and data location
Marketing website
This site is hosted on Vercel, which receives visitor IP addresses and request logs as part of normal web hosting and content delivery.
Unresolved. Whether Vercel's handling of this data requires a data processing agreement, and whether it is processed or stored outside the EU, has not yet been confirmed with legal. We are not asserting either way — see Vercel listed as a sub-processor in Section 11.
Licensing API and database
- The API and its Postgres database run on a single Hetzner Cloud VPS in Falkenstein, Germany (EU) — no other hosting region is used for these.
- The database is self-hosted on that VPS (Docker, bound to
localhost only, not exposed to the internet directly). No third-party managed-database provider has access to the data. - The API is reachable over HTTPS at
api.klepon.systems, TLS-terminated by Caddy on the same VPS. - DNS is managed through Combell, which only ever sees DNS queries for the domain, never account data.
- No personal data processed by the API or database leaves the EU as part of normal operation.
7. Backups
- The VPS runs a nightly automated backup (
pg_dump, gzip) with 7-day retention, stored on the same VPS in Germany. - A second copy is sent nightly to a Hetzner Storage Box in Falkenstein, Germany — the same provider and country as the server itself. Its contents are encrypted before it leaves the server, so the storage service cannot read what is in it. Retention is the same 7-day window.
- Both copies are in Germany. No backup of this database is held outside the EU.
- Because both are bounded to 7 days, a deleted account's data does not persist in backups beyond that window.
8. Your rights
You can exercise the following directly through the API — both are authenticated HTTP calls, with no separate user interface today:
- Right to access (export your data):
GET /api/auth/me/export, authenticated as yourself. Returns your email, account status, and your license and session (refresh token) records. - Right to erasure (delete your account):
DELETE /api/auth/me, authenticated as yourself. Permanently deletes your account, license, and session records from the live database immediately, with no confirmation step and no undo (see Section 7 for the backup caveat). - Right to rectification (e.g. correcting your email): not currently self-service — contact us using the details in Section 2.
There is no cost to exercising these rights. If you cannot use the API directly, contact us using the details in Section 2 and we will action the request manually.
9. Data retention
- Account, license, and session data is kept for as long as your account exists.
- There is no automatic deletion of inactive accounts or expired licenses today — data is retained until you delete your account yourself, or ask us to.
- See Section 7 for how long deleted data can persist in backups.
10. Security measures
- Passwords are never stored or logged in plain text.
- Refresh tokens are stored as SHA-256 hashes, not the raw token.
- All traffic to the API and website is encrypted in transit (TLS/HTTPS).
- Login is rate-limited by IP and accounts lock out after repeated failed attempts.
- The VPS only allows key-based SSH access from an administrative account; root login and password authentication are disabled.
11. Sub-processors / third parties
- Vercel — hosts and serves this marketing website; receives visitor IP addresses and request logs. Whether a data processing agreement is required is unresolved (see Section 6).
- Hetzner Online GmbH — infrastructure hosting for the API, database, and backups (Germany).
- Combell — DNS resolution for
api.klepon.systems (Belgium).
No other third party has access to account or license data. No AI assistant, including tools used by developers to build and maintain this codebase, is granted access to the production system or to real user data.
12. Children's data
KLEPON is professional engineering software and is not directed at, or knowingly used by, children.
13. Governing law and jurisdiction
Unresolved — needs LQ-02. The governing law, jurisdiction, and whether a DPO or Art. 27 representative is required have not been determined, and follow from the entity question in Section 2. The hosting location (Germany) is not necessarily the same as the entity's jurisdiction of establishment, so it is not used as a stand-in here.
14. Changes to this policy
This document is updated whenever what the website or API actually does changes.
- 2026-08-12 — Scope widened from the licensing API alone to the KLEPON product (website + API); Vercel added as a disclosed sub-processor for the website.
- 2026-08-11 — Off-site backup destination established (Section 7).
- 2026-08-07 — Privacy contact moved to a dedicated address.