# Privacy Policy | DashCaddy

DashCaddy Legal

# Privacy Policy

Effective and last updated: July 31, 2026

This GDPR-aware policy describes DashCaddy v1.0. It is not legal advice and may be refined following professional review.

## 1. Controller and contact

Sami Ahmed, operator of DashCaddy, controls personal data collected for subscriptions, licensing, and operation. Contact privacy@sami-ahmed.net. DashCaddy has no separate Data Protection Officer; this is the privacy contact.

## 2. Data collected

### Account, login, and billing

- Email address for login, license delivery, support, billing, and essential notices.
- Subscription status, Stripe customer/session IDs, product, payment status, dates, and refunds. We do not receive or store full card numbers or security codes.

### License and server metadata

- License key, tier, activation/expiry dates, and machine/host metadata embedded in or associated with the license.
- Connection metadata needed to validate and secure licenses, such as IP address, timestamp, host/machine identifier, version, and request outcome.
- The key containing machine metadata is stored locally in `data/credentials.json` and on the operator’s license server.

### Optional Tailscale data

Only if enabled, DashCaddy sends coordination API requests and may process Tailscale device IDs, tailnet/user IDs, names/status, and minted device or pre-auth keys. Keys are stored only as needed for the configured integration or share flow. Tailscale independently processes data under its terms.

### Support

We collect messages and diagnostics you voluntarily provide. Do not send passwords, private keys, or unrelated personal data.

## 3. Data not intentionally collected

The hosted licensing service does not intentionally collect proxied content, DNS query history, injected credentials, or card details. Credentials and local configuration remain customer-controlled unless deliberately provided for support. v1.0 makes no automated decisions with legal or similarly significant effects.

## 4. Purposes and GDPR lawful bases

- Contract: licenses, authentication, optional features, billing/refunds, and support.
- Legitimate interests: per-host enforcement, fraud/abuse prevention, security, troubleshooting, and proportionate product improvement.
- Legal obligation: required transaction/tax records and valid legal requests.
- Consent: optional marketing and integrations where consent is appropriate. Consent may be withdrawn without affecting earlier lawful processing.

## 5. Sharing and processors

We do not sell personal data. Necessary disclosures are to:

- Stripe for Checkout, billing, fraud prevention, receipts, and refunds. Card data goes directly to Stripe.
- Tailscale only when you configure/use the integration, for coordination and device/key operations.
- Our email delivery provider for login, license, billing, security, and support email; it receives the address and message content.

We may disclose data when legally required, to protect rights/safety, or in a business transfer with safeguards. We do not otherwise share personal data except as described in this policy.

## 6. International transfers

Processors may handle data outside your country. Where GDPR applies, we will use a legally recognized transfer mechanism where one is required, such as an adequacy decision or Standard Contractual Clauses. Contact us for information about safeguards applicable to your data.

## 7. Retention

- License keys and host metadata: life of subscription plus 30 days after cancellation, then deleted or irreversibly anonymized unless law requires longer.
- Billing records: as required for tax, accounting, chargebacks, and fraud prevention.
- Connection/security logs: normally no more than 30 days unless an incident requires preservation.
- Support records: while active and normally up to 12 months afterward.
- Optional Tailscale keys: until expired, used/revoked, share removal, or integration disablement, subject to Tailscale retention.

Backups may retain deleted data for a limited rotation and are restored only for disaster recovery.

## 8. Security

We use reasonable safeguards and data minimization, but no system is completely secure. DashCaddy does not claim SOC 2, HIPAA, PCI-DSS, or another audited certification. Stripe Checkout processes cards; card data never touches DashCaddy servers.

## 9. GDPR and other privacy rights

Depending on location, you may request access, correction, deletion, restriction, objection, withdrawal of consent, and data portability in a structured machine-readable format, and complain to your supervisory authority. Email privacy@sami-ahmed.net with “Privacy Request.” We may verify identity. We aim to respond within 30 days (one month), explain lawful extensions/refusals, and normally charge no fee. Without a central account, we search using identifiers you provide.

## 10. Children, cookies, and marketing

DashCaddy is not directed to children under 16. Checkout/login may use strictly necessary cookies. We request consent before non-essential analytics/marketing cookies where required. Marketing email is optional and includes unsubscribe.

## 11. Changes and contact

Revisions will show a new date, with reasonable notice for material changes. Questions and rights requests: privacy@sami-ahmed.net.