— GDPR Compliant · EU Data Residency
Last updated: February 25, 2026 · Effective: February 25, 2026
Obtura (“we,” “our,” or “us”) is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our platform and services. As a European company, we are fully compliant with the General Data Protection Regulation (EU) 2016/679 (“GDPR”).
The data controller responsible for your personal data is:
As a data controller, we determine the purposes and means of processing your personal data and are responsible for ensuring it is handled lawfully, fairly, and transparently.
We collect and process the following categories of personal data:
When you register for Obtura, we collect: full name, email address, company name, job title, and password (stored as a cryptographic hash). This data is necessary to create and manage your account.
For paid subscriptions, we collect billing address, VAT number (for EU business customers), and payment method details. Payment card data is processed exclusively by our PCI-DSS compliant payment processor and is never stored on Obtura systems.
To provide our services and improve performance, we collect: deployment logs, application metrics, infrastructure events, error reports, API request metadata, and feature usage statistics. This data is used exclusively to operate and improve your deployments.
We automatically collect IP addresses, browser type and version, operating system, referring URLs, and session timestamps for security and service continuity purposes. IP addresses are anonymized after 30 days.
If you contact our support team, we retain records of correspondence, including emails and support tickets, to resolve your issue and improve our services.
Your application code, environment variables, and any data processed by applications you deploy on Obtura remain your property. We process this data solely as a data processor on your behalf, subject to a Data Processing Agreement (DPA) available upon request.
Under GDPR Article 6, we rely on the following legal bases to process your personal data:
| Processing Activity | Legal Basis |
|---|---|
| Account creation and management | Contract performance (Art. 6(1)(b)) |
| Providing deployment services | Contract performance (Art. 6(1)(b)) |
| Billing and payment processing | Contract performance (Art. 6(1)(b)) |
| Legal and tax compliance | Legal obligation (Art. 6(1)(c)) |
| Security monitoring and fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Product analytics and improvement | Legitimate interest (Art. 6(1)(f)) |
| Marketing communications | Consent (Art. 6(1)(a)) |
| Cookies (non-essential) | Consent (Art. 6(1)(a)) |
Where we rely on legitimate interests, we have conducted a Legitimate Interests Assessment (LIA) and determined that our interests do not override your fundamental rights. You may request a copy of our LIA by contacting us.
We use your personal data for the following purposes:
We will never sell your personal data to third parties, use it for advertising purposes, or process it in ways incompatible with the purposes described above.
All Obtura customer data is stored exclusively within the European Union.
Our infrastructure is hosted in EU-based data centers. Your data does not leave the European Economic Area (EEA).
All primary infrastructure — including databases, object storage, and compute resources — is located in EU data centers (Frankfurt, Germany and Amsterdam, Netherlands).
In the limited cases where we engage sub-processors that may operate outside the EEA (e.g., email delivery providers), we ensure appropriate safeguards are in place, including:
A full list of our sub-processors and their processing locations is available upon request at alexserbwork@gmail.com.
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:
| Data Category | Retention Period |
|---|---|
| Account data | Duration of account + 30 days after deletion request |
| Billing records | 7 years (Romanian/EU tax law requirement) |
| Deployment logs | 90 days (configurable in your account settings) |
| Application metrics | 13 months rolling window |
| Security & audit logs | 12 months |
| Support correspondence | 3 years from ticket closure |
| IP addresses (raw) | 30 days, then anonymized |
| Marketing consent records | 3 years from last interaction or until withdrawn |
Upon account deletion, we will delete or anonymize all personal data within 30 days, except where retention is required by law (e.g., billing records).
As a data subject under GDPR, you have the following rights. We will respond to all verified requests within 30 days (extendable to 3 months for complex requests, with notice).
Request a copy of all personal data we hold about you, along with information about how it is processed.
Request correction of inaccurate or incomplete personal data we hold about you.
Request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.
Request that we restrict processing of your personal data in certain circumstances.
Receive your personal data in a structured, machine-readable format (JSON/CSV) and transfer it to another controller.
Object to processing based on legitimate interests, including profiling. You may also opt out of direct marketing at any time.
Withdraw consent at any time where processing is consent-based, without affecting prior lawful processing.
Lodge a complaint with the Romanian supervisory authority (ANSPDCP) or your local EU data protection authority.
To exercise any of these rights, submit a request to alexserbwork@gmail.com. We may need to verify your identity before processing your request. There is no charge for exercising your rights.
You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) at www.dataprotection.ro, or with the supervisory authority in your EU member state.
We use cookies and similar tracking technologies on our website and platform. We categorize these as follows:
These cookies are required for the platform to function and cannot be disabled. They include session authentication tokens, CSRF protection tokens, and load balancer routing cookies. No consent is required for these cookies.
These cookies remember your preferences (e.g., theme settings, language) to improve your experience. They require your consent.
We use privacy-respecting analytics (hosted in the EU) to understand how our platform is used. These cookies collect anonymized, aggregated data and require your consent. We do not use Google Analytics or other US-based tracking services.
You can manage your cookie preferences through our cookie consent banner or your browser settings. Note that disabling functional cookies may affect platform usability.
We engage trusted third-party service providers to operate our platform. All sub-processors are contractually bound to process data only on our instructions and in compliance with GDPR. Key categories of sub-processors include:
We will notify you of any material changes to our sub-processors at least 30 days in advance. The complete, up-to-date list of sub-processors is available at alexserbwork@gmail.com.
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, or damage:
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware, in accordance with GDPR Article 33.
Obtura's services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately at alexserbwork@gmail.com and we will delete the data promptly.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:
Your continued use of Obtura after changes take effect constitutes acceptance of the updated policy. If you do not agree, you may close your account at any time.
For any questions, requests, or concerns regarding this Privacy Policy or our data practices, please contact us:
General Privacy Inquiries
Data Protection Officer
If you are unsatisfied with our response, you have the right to lodge a complaint with the Romanian supervisory authority: