Webdock · Updated 14 October 2026

Privacy notice

This notice explains how we process personal data on Webdock’s website and in its account, Studio, hosting, database and Mail services. Customer-operated websites and applications have their own controllers and privacy notices.

1. Controller and contact

Dominik Spitzli, trading as Spitzli Development, Emsoldstrasse 40, 26180 Rastede, Germany.

For privacy questions and requests concerning your data, contact: dominik@spitzli.dev. Legal notice.

We are the controller for our website, customer relationships, accounts and service administration. When we host or handle personal data for a customer, we act on their instructions under a data-processing agreement (Article 28 GDPR). This notice does not replace that agreement.

2. Data, purposes and legal bases

When you visit Webdock, we and our hosting providers process technical request data, including IP address, requested URL, time, browser and operating-system information, to deliver the site, diagnose errors and prevent misuse. This is based on our legitimate interest in secure, reliable operation (Article 6(1)(f) GDPR). Fonts are served locally.

For enquiries, contracts and billing, we process the contact, company, address, correspondence and contract details you provide. The bases are steps before or performance of a contract (Article 6(1)(b)), legal obligations such as accounting requirements (Article 6(1)(c)), and our legitimate interest in communicating with business contacts (Article 6(1)(f)).

For accounts and team access, we process names, email addresses, invitations, customer memberships, roles, password hashes, passkey public keys, configured second-factor data and sessions. Security-relevant actions are logged with the acting account, action and time. Data comes from you or the operator or administrator inviting you. The bases are contract performance for contracting users and our legitimate interests in managing authorised access and preventing misuse for team members.

The data required for account access and contracted services must be provided for us to supply them; optional profile information is voluntary. Where we ask for consent, processing is based on Article 6(1)(a) GDPR and you may withdraw it at any time with future effect. We do not sell personal data or make solely automated decisions with legal or similarly significant effects.

3. Projects, hosting and connected services

Depending on the services enabled, we process project content, files, database contents, domains, configuration, access credentials, deployment and usage data, and operational logs. Authorised team members see data according to their roles. Operators access it where needed to provide support, maintain the service or investigate security incidents. Customer content is processed on the customer’s instructions; service administration relies on contract performance and our legitimate security interests.

Optional Vercel and GitHub connections provide authorisation data and information about selected projects or repositories, deployments, domains, branches and commits. Enabled build and deployment workflows also process the source code, build artefacts and configuration needed for those workflows. Access is limited by the connected account’s permissions and the selected function. Disconnecting in Webdock and revoking access at the provider are separate actions.

4. Mail

Account invitations and security emails are sent through turboSMTP. When Mail is enabled for a customer, we process account and domain details, sender and recipient addresses, message contents and attachments, delivery events, usage and suppression records. Enabled incoming mail uses a separate Stalwart instance for that customer; outgoing-only service does not require one. Mailbox contents and forwarding are processed only for the enabled service.

For managed sending, the relay provider receives the account details needed for provisioning and the data needed to deliver messages. Customer-supplied relay accounts use the selected provider. Domain verification sends the domain name to Cloudflare’s DNS resolver. Configured customer webhooks receive delivery event data. Optional email open and click tracking is controlled by the customer administrator, who is responsible for the required recipient information and legal basis. It is separate from website analytics.

5. Cookies, preferences and planned analytics

Login and connection cookies maintain sessions and protect authentication flows. Authentication sessions normally expire after eight hours; the Vercel connection cookie lasts up to ten minutes. A language preference explicitly selected by you is stored in a cookie for up to one year; a selected colour theme remains in local storage until removed. These functions use Article 6(1)(b) or (f) GDPR and, where strictly necessary to provide a service you request, Section 25(2)(2) TDDDG. You can remove them through your browser settings; this may sign you out or reset preferences.

Plausible Analytics is planned for the public website but is not currently integrated. The intended setup measures website use without analytics cookies, advertising profiles or cross-site tracking. Before activation, we will update this notice with the actual hosting setup, recipients, data collected, retention and applicable legal basis, and obtain consent where required.

How Plausible processes visitor data.

6. Providers and international transfers

We use Vercel for web application hosting, Contabo for managed server, database and incoming-mail infrastructure, turboSMTP for email delivery, and Cloudflare for DNS services. GitHub and other customer-selected providers are involved when their integrations are enabled. Neon was the previous platform database provider; retained migration copies remain subject to the retention rules below until deleted. Providers receive only the data needed for their role. We also disclose data where legally required, for example to tax advisers or competent authorities.

Some providers process data outside the EU/EEA, including in the United States. An EU hosting region does not exclude international support or network processing. Where required, transfers rely on an applicable adequacy decision, such as the EU–US Data Privacy Framework for certified recipients, or EU standard contractual clauses and any necessary additional safeguards. You can request details and copies of the safeguards relevant to your service using the contact above.

7. Retention and deletion

We keep contact, account and contract data for as long as needed for the relationship, then delete it unless legal retention duties or unresolved claims require continued storage. Depending on the document, statutory retention periods are generally six, eight or ten years. Security and operational logs are retained for their diagnostic and security purpose; incident-related records may be retained until the matter is resolved. Backups and retained migration copies are removed as their recovery purpose and applicable retention duties end.

For the Mail API, cleanup is configured for message text and HTML after 30 days from a final outcome, metadata and events after 90 days, request logs and completed webhook attempts after 30 days, and processed or quarantined callbacks after seven days. Attachments are removed after a definitive sending outcome; content with an uncertain outcome after seven days. Active schedules and unresolved sending or duplicate-prevention records are retained while needed. Suppressions remain until removed. These periods do not govern mailbox storage, provider-side records or backups.

Suspending a service, archiving a customer or disconnecting an integration does not automatically delete stored data. Incoming-mail storage is retained on deactivation; deletion is a separate operation. Contact us to arrange deletion or export. Disconnecting Vercel removes its stored credential from the active database, but provider-side authorisations must also be revoked at Vercel.

8. Your rights

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction and data portability. You may object to processing based on legitimate interests for reasons relating to your situation; you can object to direct marketing at any time. You may withdraw consent without affecting the lawfulness of earlier processing. We may verify your identity to protect your data.

You can complain to a supervisory authority, including the authority where you live or work, or to the State Commissioner for Data Protection of Lower Saxony: www.lfd.niedersachsen.de.