PaSiCC.org

Provisional privacy policy

This is a translation; the German text is binding.

1. Who is responsible

Responsible for the processing of personal data on pasicc.org ("PaSiCC") is Bento Software UG (haftungsbeschränkt), Hessestr. 12, 32049 Herford, Germany ("we"). You reach us as given in our imprint (https://bentosoftware.com/contact.html). We have not appointed a data protection officer.

2. In short

  1. We process your data to run PaSiCC for you: your account, what you create and share, and what keeps PaSiCC safe and working.
  2. No tracking, no advertising, no analytics services; the pages load nothing from other sites (images you link in your own descriptions excepted).
  3. We don't sell your data and don't use your content to train AI models. Administrators of PaSiCC can't read your nodes through PaSiCC.
  4. You can export your data at any time and delete your account.

3. Visiting the site

  1. Server log: each request is logged with the time, your address shortened to its network (the last part left out), the page or interface path, your browser and the answer's status, without cookies or the secrets of mailed links. Purpose: finding errors and attacks. It is kept at most 90 days (as files 14 days).
  2. Limits against abuse: your connection's address (for IPv6 its network) and how often it used the login, registration, password and error report requests are kept only in the server's memory, for at most two hours, to limit password guessing and mass sign-ups.
  3. Error reports: when an error happens in the page, the page reports the message, where in the program it happened, the page's address (without node ids), browser and operating system, the page's version and, if you are logged in, your account. They are kept until 30 days after the error last occurred.
  4. Legal basis: our legitimate interest in a secure and working service (Art. 6(1)(f) GDPR).

4. Your account

  1. Registering: username, email address and password (stored only as a secure hash, never readable), the answer to the arithmetic question (not stored), the version of the terms of use you accept, and your settings (page language, recognized languages, energy levels and others). Your email address is confirmed by a mailed link; an account whose address isn't confirmed within 24 hours is deleted.
  2. Waiting list: while the registration is full, your username and email address, until your account is ready or you leave the list.
  3. Invitation codes: which account took a code, until its address is confirmed; then the code is deleted.
  4. Logins: for each login the browser and system, the IP address (unless you turn that off in your profile), when it was made and last used. A login ends 30 days after its last use, at the latest after a year, or when you log out.
  5. Changing your username or address: your old username stays reserved for 30 days (with only a hash of your email address) and is shown to your friends until they dismiss the notice; a new address waits for its link.
  6. Licenses and use: your license and when you last used PaSiCC. An account with a free beta or trial license is deleted after a time without use, with warning mails before.
  7. Blocks: if an administrator blocks your username or your account (terms of use, section 6): the reason, until when, and for an account block your address in lower case, so it can't register again while the block lasts.
  8. Feedback: what you write to us with "Feedback…" and our answers, with the page's version, your browser and system; kept until we delete it or your account is deleted.
  9. Legal basis: the contract of use with you (Art. 6(1)(b) GDPR); the blocks and the reserved usernames also our legitimate interest in enforcing the terms of use and in protecting other users (Art. 6(1)(f) GDPR).

5. What you create and share

  1. Your nodes (titles, attributes, descriptions), their links, your favorites and recently visited nodes, your contexts, friends and shares.
  2. Who sees it: you, and those you share it with, with the permission you give. Your username (and your public handle) is shown to your friends and to those who share with you.
  3. Legal basis: the contract of use (Art. 6(1)(b) GDPR). Don't store data of other people in PaSiCC unless you may.

6. Emails

We send emails about your account: confirming your address, resetting your password, changes of your account, warnings before a deletion or the end of a license, notices about changes of the terms of use and answers to your feedback. They are sent through Mailjet (Sinch Mailjet SAS, France) as our processor. We send no newsletters.

7. In your browser

PaSiCC stores only what it needs to work, without asking (it is strictly necessary, § 25(2) TDDDG): a cookie with the page language you chose (only if you choose one, 400 days), your login in the browser's local storage (removed when you log out), and how you set up the view and some marks for the current tab. The full list is below.

8. Hosting and backups

PaSiCC runs on a server of IP-Projects in Germany. The database is backed up every night, encrypted, to a second place in Germany; backups are kept up to six months (seven daily, four weekly, six monthly copies), so deleted data disappears from them within that time. Only those running PaSiCC have access to the server and the backups, for its operation (for example to restore a backup); they don't look at your content otherwise.

9. Recipients

Your data goes to nobody else except the processors named above (hosting, Mailjet), each bound by a contract to process it only for us, and to authorities where the law obliges us. Your data is processed in the European Union.

10. How long

As given above for each kind of data. When you delete your account, it is removed 30 days later with the nodes only you own (until then you can restore it); its username then stays reserved for others as long as its license sets, with only a hash of your email address. Backups follow within six months (section 8).

11. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or its processing restricted (Art. 18), to receive it in a usable format (Art. 20; the export in your profile gives you everything you own), and to object to processing based on our legitimate interest (Art. 21). Write to us as given in our imprint. You may also complain to a data protection authority, for us the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).

12. Changes

We change this policy when PaSiCC or the law changes; the current version is always on this page.

This privacy policy is provisional: a final one replaces it as soon as it is settled.

What PaSiCC stores in your browser

  • pasicc_lang: a cookie with your choice of the page language, only if you choose one (kept 400 days); it lets the server deliver the page in that language right away.
  • pasicc_token: your login (in the browser's local storage), removed when you log out.
  • pasicc_app_reload: marks the one automatic reload when PaSiCC was updated while the page was open (only for this tab, removed afterwards).
  • pasicc_version_reload: the version PaSiCC reloaded for when it was updated while the page was open, so that happens only once (only for this tab, removed afterwards).
  • pasicc_context: the context the task list is limited to in this tab (only for this tab, gone when it is closed).
  • pasicc_favorites_row: whether the favorites row is shown (only for this tab, gone when it is closed).
  • pasicc_background, pasicc_todo_*, pasicc_sibling_mode: how you set up the view (background, task list, siblings), only in this browser.