Privacy Notice

Last updated: December 17, 2025

Terms of ServicePrivacy NoticeCookie PolicyAcceptable UseReport AbuseSecurityDPASubprocessors

1. What this notice covers

This notice describes how Thecodebase Limited processes personal data when you:

  • Visit our site,
  • Create/manage an account,
  • Use the Service,
  • Contact support or sales.

It does not cover third-party websites or services that have their own privacy notices.

2. Roles: controller vs processor

For account/admin data (signup, billing, communications), we are typically the controller.

For Customer Content (traffic/data you route), we typically act as a processor/service provider on your instructions, as described in the DPA.

3. Data we collect

A) Account & contact data

Name, email, organization, login credentials (hashed), support messages, and preferences.

B) Billing data

Billing address, tax info, and payment status. Payment card details are handled by Stripe.

C) Service telemetry & security data

Approximate location (derived from IP), device/app version, authentication events, rate-limit/abuse signals, and operational metrics.

D) Tunnel/traffic-related data

Default option (privacy-forward): We do not persist tunnel payload contents. We may transiently process traffic to route it.

When you enable features: If you enable request inspection, logging, or debugging, we may store the event data you configure (headers, paths, metadata, and—if you choose—body samples) for the retention period you select.

4. How we use personal data

We use personal data to:

  • Provide and secure the Service (authentication, routing, abuse prevention),
  • Operate accounts and billing,
  • Respond to support requests,
  • Improve reliability and performance,
  • Comply with legal obligations and enforce policies.

5. Legal bases (UK/EU style)

Where GDPR/UK GDPR applies, we rely on:

  • Contract: to provide the Service,
  • Legitimate interests: security, fraud/abuse prevention, product improvement,
  • Consent: for optional cookies/marketing where required,
  • Legal obligation: tax, compliance, lawful requests.

6. Sharing and disclosures

We may share data with:

  • Service providers (hosting, monitoring, support tools, payment processing),
  • Law enforcement/regulators when legally required,
  • Business transfers (merger/acquisition),
  • You/your admins (account administration).

7. International transfers

If data is transferred outside the UK/EU/EEA, we use appropriate safeguards (e.g., SCCs/UK Addendum) where required.

8. Data retention

We keep personal data only as long as necessary for:

  • Providing the Service,
  • Legitimate business needs (security logs),
  • Legal obligations.

Log data is generally retained for 30 days unless configured otherwise.

9. Your rights

Depending on your location, you may have rights to access, correct, delete, object, restrict processing, portability, and withdraw consent.
Contact: [email protected]

10. Security

We use administrative, technical, and organizational measures to protect data. See Security & Compliance for an overview.

11. Children

The Service is not intended for children under 13 (or higher age where required by law).

12. Changes

We may update this notice and will revise the effective date.