Privacy Policy — Phaeton Licensing Portal

Effective date

This privacy policy is effective as of 1 April 2026.

Controller

The controller responsible for processing your personal data is:

Virtunet B.V.
Dullofsakker 44
5688VD Oirschot
The Netherlands
KvK: 95773444
Email: info@virtunet.nl

Data protection contact

Virtunet B.V. has not appointed a Data Protection Officer (DPO) as the company does not meet the thresholds requiring one under GDPR Art. 37. For all privacy-related inquiries, data subject requests, and complaints, contact us at:

Email: info@virtunet.nl

Data we collect

We collect and process the following personal data when you use the Phaeton Licensing Portal:

Email address — used for passwordless authentication (one-time sign-in codes) and to identify your portal account.
Hashed device fingerprints — cryptographic hashes of device identifiers (machine ID, MAC address, CPU serial) used to bind a license to a specific installation. We store only the hashes, not the raw identifiers.
Install ID — a randomly generated identifier for each Phaeton installation, used for license binding and heartbeat tracking.
IP address — processed transiently for rate limiting, abuse prevention, and security logging. Not stored long-term in our application database.
Session cookie — a strictly necessary HTTP-only session cookie (phaeton_portal_session) that maintains your authenticated session.
Terms acceptance timestamp — the date and time you accepted the personal-use terms, stored for legal compliance.

Purpose and legal basis

We process your data for the following purposes under the indicated legal bases (GDPR):

Providing the licensing service — authentication, entitlement management, license signing, and activation session handling. Legal basis: performance of a contract (Art. 6(1)(b)).
Security and abuse prevention — rate limiting, bot protection (Cloudflare Turnstile), duplicate-use detection, and audit logging. Legal basis: legitimate interest (Art. 6(1)(f)).
Heartbeat monitoring — periodic check-ins from licensed installations for visibility and stale-install detection. Legal basis: legitimate interest (Art. 6(1)(f)). Heartbeats never disable runtime functionality.
Terms acceptance records — recording your consent to the personal-use terms. Legal basis: legal obligation (Art. 6(1)(c)) and consent (Art. 6(1)(a)).

Data retention

Portal account data (email, entitlements, installation records) — retained for as long as your account is active and for a reasonable period afterward to support transfer and support workflows.
Authentication challenges — automatically expire after their short-lived TTL (minutes) and are not retained beyond that.
Session cookies — expire at the end of the session lifetime configured in the portal.
Heartbeat events — retained for the duration of the license relationship for audit and support purposes.
Audit logs (activation, transfer, deactivation events) — retained for at least 2 years for legal compliance and dispute resolution.

Third-party processors

We use the following third-party service providers who process data on our behalf:

Cloudflare, Inc. — hosting (Cloudflare Workers), CDN, DDoS protection, D1 database, and Turnstile bot protection. Cloudflare processes requests and IP addresses in transit. See Cloudflare Privacy Policy.
Resend, Inc. — email delivery for one-time sign-in codes. Resend processes your email address to deliver authentication messages. See Resend Privacy Policy.

We do not sell your data or share it with third parties for marketing purposes.

Cookies

The portal uses the following cookies:

phaeton_portal_session — a strictly necessary session cookie that keeps you signed in. It is HTTP-only, SameSite=Strict, and Secure in production. No consent is required for this cookie under the ePrivacy Directive because it is essential for the service to function.

Cloudflare Turnstile may set functional cookies for bot protection during sign-in and entitlement claim flows. These are security-functional and do not track you for advertising or analytics.

We do not use analytics cookies, advertising cookies, or third-party tracking cookies.

International transfers

Your data may be processed outside the European Economic Area by our third-party processors (Cloudflare and Resend, both US-based). These transfers are protected by appropriate safeguards including EU Standard Contractual Clauses and the EU-US Data Privacy Framework where applicable.

Your rights

Under the GDPR, you have the following rights regarding your personal data:

Right of access (Art. 15) — request a copy of the data we hold about you.
Right to rectification (Art. 16) — request correction of inaccurate data.
Right to erasure (Art. 17) — request deletion of your data, subject to legal retention obligations.
Right to restriction (Art. 18) — request that we limit processing of your data in certain circumstances.
Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
Right to object (Art. 21) — object to processing based on legitimate interest.

To exercise any of these rights, contact us at info@virtunet.nl. We will respond within 30 days.

You also have the right to lodge a complaint with the Dutch Data Protection Authority:

Autoriteit Persoonsgegevens
https://autoriteitpersoonsgegevens.nl

Children and minimum age

The Phaeton Licensing Portal is not intended for use by persons under the age of 16. Under the Dutch implementation of the GDPR (Uitvoeringswet AVG), the minimum age for providing digital consent is 16 years.

We do not knowingly collect personal data from children under 16. If you believe that a child under 16 has provided personal data through the portal, please contact us at info@virtunet.nl and we will take steps to delete that data promptly.

Changes to this policy

We may update this privacy policy to reflect changes in our practices or legal requirements. The effective date at the top of this page will be updated accordingly. We encourage you to review this policy periodically.