Skip to content
DockCrate
Sign inStart free

Privacy policy

How DockCrate collects, uses and protects personal data, and the rights you have over it.

Last updated

Who we are

DockCrate is operated by BufferSol Technologies LLC, 447 W Broadway, 2nd Floor Suite #1964, New York, NY 10013, United States. This policy explains what personal data we handle when you visit dockcrate.buffersoltech.com, create an account or use the service.

For account and billing data we are the controller. For data we read from your Microsoft tenant, such as device and group identifiers, you are the controller and we are your processor. The data processing addendum covers that second case.

Data we collect

We collect only what we need to run the service.

  • Account data: your work email address and name from your Microsoft Entra account. We accept work and school accounts only and reject personal Microsoft accounts. We do not store your Microsoft password.
  • Tenant data: the Entra tenant ID of each tenant you connect, and the settings you choose for it.
  • Packaging data: the apps, versions, deployment rings, schedules and results you configure, including rollbacks and pauses.
  • Microsoft Graph data: through three application permissions (DeviceManagementApps.ReadWrite.All, DeviceManagementManagedDevices.Read.All and Group.Read.All) granted in your own tenant, we publish apps, read the group list and read managed devices. We read device counts nightly for billing and keep device identifiers only as long as needed to show install status.
  • Audit log: who did what and when in your workspace, with IP address.
  • Organization data: workspace name, members, roles, webhook settings and API keys (API keys are stored hashed).
  • Billing data: your plan and subscription status. Card details go straight to Stripe and never touch our servers.
  • Technical data: IP address, browser type and request logs, kept briefly for security, abuse prevention and debugging.

We never store customer secrets such as tenant passwords or client secrets. We do not sell personal data and we do not use your data for advertising or to train models. Installers that you upload are only published to your own tenant and are never redistributed to anyone else.

How we use it and our legal bases

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases under the GDPR and UK GDPR.

  • Contract: to create your account, run packaging and updates in your tenant and bill you.
  • Legitimate interests: to secure the service, prevent abuse, and keep records that let us fix problems.
  • Legal obligation: to keep tax and accounting records.
  • Consent: for optional communications, which you can withdraw at any time.

Who we share data with

We share data only with the subprocessors listed on our subprocessors page, and only to provide the service. We may also disclose data if a valid legal request requires it, and we will tell you first unless the law forbids it.

Retention

  • Account and organization data is kept while your account is open.
  • Packaging history, device status and audit log entries are kept for the history period of your plan, then deleted.
  • After you delete your account we remove your data within 30 days, except billing records we must keep by law, which are kept for the period the law requires.
  • Server logs are kept for up to 30 days.
  • Backups roll off within 35 days after deletion.

Account deletion and data export

You can export or delete your data yourself. In the app, open Settings, then Account. You can also use the API: GET /api/account/export returns a copy of your data, and DELETE /api/account permanently deletes your account and workspace.

Your rights under GDPR and UK GDPR

You can ask us to access, correct, delete, restrict or port your personal data, and you can object to processing based on legitimate interests. Most of these you can do from Settings. For anything else, email us. You also have the right to complain to your data protection authority.

California rights under CCPA and CPRA

If you live in California you can ask what personal information we hold, ask us to delete or correct it, and ask us to stop selling or sharing it. We do not sell or share personal information for cross context advertising. We will not discriminate against you for using these rights.

International transfers

Our subprocessors are mainly in the United States. When we transfer personal data from the EEA, UK or Switzerland, we rely on the EU Standard Contractual Clauses and the UK addendum, and on the EU US Data Privacy Framework where a provider is certified.

Security

We encrypt data in transit and at rest and limit access to people who need it. See the security page for details. No system is perfectly secure, and we will notify you of a breach that affects you as the law requires.

Children

DockCrate is not directed at children under 16 and we do not knowingly collect their data.

Changes to this policy

If we make a material change we will email account owners at least 14 days before it takes effect.

Contact

Questions or requests: contact@buffersoltech.com. For general help, write to contact@buffersoltech.com.