Privacy Policy
Last updated: October 11, 2026
Introduction
Protecting your personal data is of particular importance to us. We process your data exclusively on the basis of legal provisions (GDPR, Austrian DSG, TKG 2003). This privacy policy informs you about the key aspects of data processing on our platform WebBase (webbase.dev).
Data Controller
Anton Alpha GmbH Maurer Lange Gasse 64/3 1230 Vienna, Austria Email: office@anton-alpha.com
Data We Collect
Account Data
During registration, we collect: email address, display name (optional), authentication provider (email/password or Google OAuth). This data is required to provide the service.
Payment Data
For paid subscriptions, we process payment data through our payment provider Stripe. We only store the Stripe Customer ID and Subscription ID. Credit card data is never stored on our servers — it is processed directly by Stripe in a PCI-DSS compliant manner.
Project Data
When you create projects, we store: project name, type, subdomain, files (in Git repositories), build logs, and deployment status. Environment variables are stored encrypted with AES-256-GCM.
API Keys
API keys are stored exclusively as SHA-256 hashes. The plaintext key is shown only once at creation and is never stored by us afterwards.
Log Data
We log actions in audit logs including: timestamp, user ID, action, IP address, and result. These logs serve security and traceability purposes and are automatically deleted after 90 days.
Access logs of hosted websites
When a website hosted on WebBase is visited, our web server technically logs: time, requested address (without URL parameters), status code, amount of data transferred, IP address, browser identifier (user agent) and referring page (referrer). Country, device type, browser and operating system are derived from these. To count unique visitors, a daily changing, non-reversible hash is created; the key for it is deleted after two days at the latest. The operators of the respective website see these statistics with a truncated IP address; only the platform administration sees the full IP address (for abuse prevention). No cookies are set and no tracking scripts are embedded. Individual requests are deleted after 30 days, anonymous daily totals after 13 months.
Legal Basis
- Contract Performance (Art. 6(1)(b) GDPR): Processing to provide our service, including account creation, project management, and billing.
- Consent (Art. 6(1)(a) GDPR): Google OAuth sign-in is based on your explicit consent.
- Legitimate interest (Art. 6(1)(f) GDPR): Audit logging, access logs of hosted websites and security measures to protect our platform and users.
Third Parties and Data Transfers
Google Firebase (Authentication & Firestore): Identity management and database. Processing based on EU Standard Contractual Clauses (SCCs). Privacy Policy: https://firebase.google.com/support/privacy
Stripe (Payment Processing): PCI-DSS certified payment processing. Data transfer to the USA based on EU SCCs. Privacy Policy: https://stripe.com/privacy
Gitea (Git Repositories): Self-hosted on our own infrastructure in the EU (Google Cloud, region europe-west3, Frankfurt). No data transfer to third parties.
Google Cloud Platform: Hosting infrastructure in the EU (europe-west3). Processing based on EU Standard Contractual Clauses.
Cookies and Tracking
We use only technically necessary cookies for Firebase authentication (session management). We do not use any analytics, tracking, or advertising cookies. There is no third-party tracking. Visitor statistics for hosted websites are based solely on server-side access logs (see "Access logs of hosted websites"), not on cookies.
Data Security
We protect your data with: TLS encryption (HTTPS) for all connections, AES-256-GCM encryption for environment variables, SHA-256 hashing for API keys, comprehensive audit logging of all actions, and access control through Firebase Security Rules.
Your Rights
Under the GDPR, you have the following rights:
- Access to your stored data (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure of your data (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing (Art. 21 GDPR)
To exercise your rights, please contact office@anton-alpha.com.
Retention Periods
Account data is stored until the account is deleted. Audit logs are automatically deleted after 90 days. Access logs of hosted websites are deleted after 30 days, anonymous daily totals derived from them after 13 months. Payment data is subject to statutory retention periods (7 years). Project data is stored until deleted by the user.
Supervisory Authority
You have the right to lodge a complaint with the competent supervisory authority:
Austrian Data Protection Authority (Datenschutzbehoerde)
Barichgasse 40-42, 1030 Vienna, Austria
https://www.dsb.gv.atChanges
We reserve the right to update this privacy policy to reflect changes in legal requirements or modifications to our service. The current version is always available on this page.