Privacy Policy

1. Data controller

The data controller responsible for the processing of your personal data under the European General Data Protection Regulation (Regulation (EU) 2016/679 - "GDPR") is:

GRAHMUR OÜ
Incorporated in Tallinn, Republic of Estonia (European Union)
Email for privacy inquiries: privacy@claspine.com · dpo@claspine.com
Website: https://claspine.com

2. Scope and self-hosted deployments

It is important to distinguish between GRAHMUR OÜ as a software provider and your operation of applications built on Claspine:

• Marketing website & Claspine Atlas: This Policy governs information collected through claspine.com, our license checkout pipelines, and our managed cloud control plane (console.claspine.com, api.claspine.com).
• Self-hosted Claspine deployments: When you deploy Claspine to your own cloud infrastructure (AWS, Azure, GCP, or on-premises), Claspine contains zero telemetry, phone-home mechanisms, or secret exfiltration back to GRAHMUR OÜ. You are the sole Data Controller of your end-user data, domain records, and customer records stored in your databases.

3. Information we collect

We collect and process personal data only to the extent necessary to provide our software, process transactions, and maintain our cloud infrastructure:

4. No AI model training on customer code or data

Strict developer data commitment: GRAHMUR OÜ does NOT use your proprietary codebase, repository contents, API payloads, prompts sent through Claspine Atlas multi-provider routing, or Agent Shield scan results to train, fine-tune, or evaluate public or proprietary artificial intelligence or machine learning models.

Prompts and completions processed through Claspine's LLM module flow strictly between your deployment and your configured upstream model providers (e.g. Anthropic, OpenAI, AWS Bedrock, Google Vertex AI) using your own provider credentials.

5. Legal bases for processing (GDPR)

We process your personal data in strict compliance with Article 6 of the GDPR under the following legal bases:

• Performance of a Contract (Art. 6(1)(b) GDPR): Necessary to grant software licenses, grant GitHub repository access, authenticate cloud console sessions, and deliver software updates.
• Compliance with Legal Obligations (Art. 6(1)(c) GDPR): Necessary to retain accounting records, compute applicable VAT, and comply with commercial statutory recordkeeping under Estonian and EU tax law.
• Legitimate Interests (Art. 6(1)(f) GDPR): Necessary to defend against software piracy, prevent brute-force attacks on our APIs, enforce agent spending limits, and maintain high service availability.
• Consent (Art. 6(1)(a) GDPR): For sending optional developer newsletters or release digests, which you may opt out of at any time via the unsubscribe link.

6. Third-party sub-processors

We work with trusted infrastructure and service providers who adhere to rigorous security standards. All international data transfers to non-EU entities are safeguarded by EU Standard Contractual Clauses (SCCs) or adequacy decisions:

• Stripe Inc. (USA / Ireland) — Payment processing and tax computation. PCI-DSS Level 1 certified.
• GitHub / Microsoft (USA / EU) — Source code repository hosting, artifact distribution, and team access management.
• Microsoft Azure (India / USA) — Claspine Atlas hosting: API servers and managed PostgreSQL database in Central India, Azure Key Vault in East US (United States), console and website hosting in East US 2.
• Google Firebase Authentication (Google LLC, USA) — Sign-in to the Claspine Atlas console.
• Plausible Analytics (EU) — Privacy-first, cookieless website usage metrics. Data is hosted exclusively within the EU.
• Transactional Email Services — Delivery of receipt confirmations, security alerts, and repository invites.

7. Security controls & secret protection

We apply enterprise-grade security controls across our platform and systems:

• Encryption: All HTTP traffic is protected by TLS (version 1.2 or higher) in transit. Storage volumes and database records are encrypted at rest with AES-256.
• Secret encryption: In Claspine Atlas, user vault secrets are encrypted with AES-256-GCM under a master key held in Azure Key Vault. Envelope encryption, with a per-secret data key wrapped by an Azure Key Vault key that never leaves Key Vault, is supported and is being enabled.
• Fail-closed audit logging: Mutating administrative actions produce tamper-evident, hash-chained audit trails where credentials, bearer tokens, and passwords are automatically redacted prior to persistence.
• Zero secret storage for third-party LLMs: Customer-supplied model provider keys are held in encrypted vaults and accessed only at runtime via short-lived credentials.

8. Data retention

• Account data: Retained for the duration of your active license maintenance and cloud subscription, plus 90 days following account closure.
• Financial and tax records: Invoices, purchase timestamps, and transaction metadata are retained for seven (7) years in accordance with Estonian commercial accounting legislation.
• Messages sent by Claspine Atlas customers: The full recipient address and the content are kept only until the message is accepted by the customer’s provider or has failed, and at most 72 hours; the masked history is kept for 30 days by default and deleted with the project.
• Security and access logs: Server access logs and rate-limiting counters are rotated and deleted automatically within thirty (30) to ninety (90) days.

9. Your rights under GDPR

If you reside in the European Economic Area (EEA), United Kingdom, or Switzerland, you are entitled to exercise the following data protection rights:

• Right of Access (Art. 15 GDPR): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete personal information.
• Right to Erasure (Art. 17 GDPR): Request deletion of your personal data where retention is no longer legally mandated.
• Right to Restrict Processing (Art. 18 GDPR): Request restriction of processing under certain contested circumstances.
• Right to Data Portability (Art. 20 GDPR): Request a structured, machine-readable copy of your data.
• Right to Object (Art. 21 GDPR): Object to processing carried out under our legitimate interests.

To exercise any of these rights, email privacy@claspine.com with proof of identity. We respond to all verified requests within thirty (30) days without charge.

10. Contact and supervisory authority

For questions or complaints regarding this Privacy Policy or our data handling practices:

GRAHMUR OÜ
Data Protection Officer
Email: privacy@claspine.com · dpo@claspine.com
Postal: Tallinn, Harjumaa, Estonia

You also have the right to lodge a complaint with the supervisory authority in the European Union. In Estonia, the competent authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon):
Website: https://www.aki.ee · Email: info@aki.ee