Privacy Policy

Privacy is the product at Polfence, so this policy is short and honest. The data controller is Polfence sp. z o.o., ul. Szafarnia 11/F8, 80-755 Gdańsk, Poland (KRS 0001250652). Questions: sales@polfence.com.

What we collect, and why

Account data

Email address, name, password (stored as a bcrypt hash — we cannot read it), optional two-factor secrets, and your session preferences. Legal basis: performance of the contract.

Billing data

Country, account type, company name and VAT number where applicable, plan, and invoices. We validate EU VAT numbers against the European Commission's VIES service. Card details never reach us — online payments are processed by Revolut Bank UAB acting as payment provider. Legal basis: contract and our legal obligations (tax and accounting law requires us to keep invoices, in Poland generally for 5 years).

Service data

The hostnames you create, the IP addresses you point them at, update history (including the source IP of each update call — that is how dynamic DNS works), reachability probes if you enable monitoring, and security logs such as sign-in events. Legal bases: contract, and our legitimate interest in keeping the platform secure and abuse-free.

What we do not do

• No advertising trackers, no analytics cookies, no profiling.
• The only cookie we set is the session cookie that keeps you signed in.
• We do not sell or share personal data for marketing.
• We do not inspect the content of traffic inside your networks — Secure Connect and Polfence Connect are end-to-end encrypted.

Where your data lives

Everything is hosted in the European Union with Scaleway SAS (France; data centres in Paris and Amsterdam). Transactional email is sent through Scaleway's EU service. We transfer no personal data outside the EU/EEA. Note that DNS is a public system: the hostname-to-IP mappings you choose to publish are, by design, publicly resolvable.

Processors

• Scaleway SAS — hosting, databases, transactional email (EU).
• Revolut — payment processing for online payments.

Retention

• Account and service data: for the life of your account.
• Reachability probe history: 30 days.
• Invoices and billing records: as required by Polish law.
• Deleting your account removes your hostnames from DNS immediately and erases personal data not subject to statutory retention.

Your rights

Under the GDPR you can request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. Write to sales@polfence.com and we will respond within one month. You may also complain to a supervisory authority — in Poland the President of the Personal Data Protection Office (UODO), or the authority in your own country.