Privacy Policy

This policy applies to ratelkey.com, including its analytics, and to the services operated by RatelKey: the account and sign-in service, the relay, and the update service. It states the personal data RatelKey processes, the purposes and legal bases for that processing, the retention periods applied, and the rights available to data subjects.

It does not apply to the contents of a Burrow operated by a customer, which are addressed in section 03. This policy is to be read together with the Terms of Service.

RatelKey is the controller of the personal data listed in section 02. Contact details are given in section 13.

A Burrow is installed and operated by the customer on their own infrastructure. Where the contents of a Burrow include personal data, the operator of that Burrow is the controller of it. RatelKey is neither controller nor processor of that data and does not receive it. Section 03 applies.

RatelKey collects and processes the following:

• Account data. Email address, username, password hash (Argon2id), profile image (a selected preset or an image you upload), and email confirmation status.

• Passkey data. Where a passkey is registered, its public key, credential identifier and device label. The private key remains on your device and is not transmitted to RatelKey.

• Two-factor data. Where an authenticator app is enabled, its secret, stored encrypted, and your recovery codes, stored as hashes.

• Linked sign-in identity. Where you sign in with GitHub, the GitHub user ID, username and email address that GitHub provides. The access token GitHub issues is used once to read these and is not stored.

• Session data. For each session, the originating IP address and user agent, the time of creation and the time of expiry.

• Sign-in history. For each sign-in attempt, the source IP address, the outcome, and the reason for failure.

• Burrow registration data. For each Burrow claimed by an Account, its identifier, the addresses it reports (its local network address, its relay address and any custom domain), and the Accounts holding membership of it with their roles.

• Feedback. Where you send feedback from a Burrow, the message, the kind of page it was sent from, and the Burrow’s version, recorded with your Account and the Burrow.

• Service records. Actions performed against RatelKey services, including claiming a Burrow, entering a Burrow, signing out and membership changes, recorded with the Account and source IP address responsible.

• Email records. Recipient address, message type and delivery outcome.

• Website usage data. When you visit ratelkey.com: the pages viewed, how far each was scrolled, clicks on marked links and buttons, time on page, the referring site, and campaign tags in the address. Your IP address and browser details are used at the time of the visit to derive a country, a device type and a visitor identifier that changes daily and cannot be reversed; the IP address and browser details themselves are not stored. Where a visit leads to registering an Account, the visit is marked as having done so; the visit is not linked to the Account.

The website usage data is collected by RatelKey’s own analytics and is not shared with any third party. RatelKey does not use advertising, third-party analytics or third-party tracking on ratelkey.com. RatelKey does not carry out profiling or automated decision-making producing legal or similarly significant effects.

Secrets, projects, environments, machine registrations and the audit trail of a Burrow are stored in that Burrow’s database, on infrastructure operated by the customer. They are not transmitted to RatelKey and RatelKey holds no copy of them.

Values are encrypted under a key-encryption key held by the Burrow: generated by the Burrow and kept in its data directory, or supplied to it through its environment. RatelKey does not receive that key and cannot decrypt, produce or restore the data protected by it.

Where a Burrow is reached through the relay, connections are encrypted to the Burrow and terminated there, under a certificate whose private key the Burrow generates and does not transmit to RatelKey. RatelKey does not have access to the contents of relayed connections and does not record them.

RatelKey cannot respond to a request from a data subject, a supervisory authority or a court for the contents of a Burrow, and will direct such a request to the operator of that Burrow.

• Performance of a contract (Article 6(1)(b) GDPR) for Account data, passkey data, two-factor data, a linked sign-in identity, session data and Burrow registration data.

• Legitimate interests (Article 6(1)(f) GDPR) for sign-in history, service records, email records and rate limiting, where the interest pursued is the security and continued operation of the Service; for feedback, where it is improving the Service at your request; and for website usage data, where it is understanding how ratelkey.com is used. A balancing assessment has been carried out and is available on request.

• Legal obligation (Article 6(1)(c) GDPR) where retention or disclosure is required by law.

RatelKey does not rely on consent for any processing described in this policy. You may object to processing based on legitimate interests in accordance with section 10.

RatelKey processes the data listed in section 02 in order to:

• Authenticate you, including through a passkey, an authenticator app or GitHub where you have set these up.

• Respond to a Burrow’s validation of your session.

• Present your active sessions and allow you to revoke them.

• Send service email, including address confirmation and password reset.

• Read and act on feedback you send.

• Understand how ratelkey.com is used, in aggregate.

• Detect, investigate and prevent abuse, and apply rate limits.

• Route connections through the relay where it is used.

• Comply with legal obligations and respond to lawful requests.

RatelKey does not sell personal data, does not disclose it for advertising purposes, and does not use it to train machine learning models.

RatelKey engages third parties in providing the Service. Each is identified in the sub-processor register, together with its role, the purpose of the processing, the categories of personal data concerned, the location of processing and the applicable transfer mechanism.

A party listed in that register as a processor acts under a written agreement satisfying Article 28 GDPR and processes personal data only on RatelKey’s documented instructions. A party listed as an independent controller determines its own purposes and means under its own terms.

RatelKey maintains the register and will give at least 30 days’ notice, by email to the address associated with your Account or by notice in the dashboard, before engaging a new processor.

RatelKey does not disclose personal data to any other party except where required by law. Where RatelKey receives such a request, it will notify the data subject unless prohibited from doing so.

In the event of a merger, acquisition or transfer of assets, personal data may be transferred as part of that transaction. Data subjects will be notified before any change to this policy takes effect.

RatelKey services and the data listed in section 02 are hosted within the European Union. Where a processor operates outside the European Union or the European Economic Area, the transfer is made under an adequacy decision or under the European Commission’s Standard Contractual Clauses, with supplementary measures where required. The mechanism applying to each is stated in the sub-processor register.

The location of a Burrow is determined by the customer operating it. RatelKey has no involvement in that decision and effects no transfer of its contents.

• Account data is retained for the lifetime of the Account.

• Passkey data, two-factor data and a linked sign-in identity are retained until you remove them or delete the Account.

• Session data is deleted on expiry or revocation.

• Burrow registration data is retained while the Burrow remains claimed.

• Feedback is retained for the lifetime of the Account, and is deleted with it or with the Burrow.

• Sign-in history and service records are retained for 12 months.

• Email records are retained for 30 days.

• Website usage data is retained for 13 months. Aggregate figures derived from it, which contain no personal data, may be kept longer.

On deletion of an Account, the data listed above is permanently deleted within 30 days, subject to any legal obligation requiring continued retention.

Deletion of an Account does not affect a Burrow or its contents, which remain on the customer’s infrastructure.

RatelKey sets cookies only where they are strictly necessary to sign you in. RatelKey does not set advertising, analytics or tracking cookies, and no consent banner is presented.

• rk_bur_at carries the access token for the RatelKey sign-in service and your account pages.

• rk_bur_rt is used to renew an expired session. It is scoped to the sign-in path and is not transmitted with other requests.

• rk_bur_lc, rk_bur_cer_*, rk_bur_stepup and rk_oauth_state hold the state of a single step in progress: signing in, registering or using a passkey, confirming your identity again before a sensitive change, or signing in with GitHub. Each expires within ten minutes.

These cookies are set HttpOnly, so they cannot be read by scripts, and SameSite=Lax, so they are not transmitted on cross-site requests. In production they are set Secure and are transmitted only over HTTPS. Where you do not select the option to remain signed in, rk_bur_at and rk_bur_rt are session cookies and are discarded when the browser closes.

The following are kept in your browser’s storage rather than in cookies:

• In a Burrow’s dashboard, rk_burrow_session holds the session token for that Burrow, in local storage for the Burrow’s address. It is sent only to that Burrow, which checks it with the RatelKey sign-in service on each request, and is removed when you sign out. While you are signing in to or claiming a Burrow, rk_burrow_signin and rk_burrow_claim hold that step in session storage until it completes.

• On ratelkey.com, _rk_sid holds a random identifier for the current visit, in session storage. It is deleted when the tab is closed and is used only for the website usage data described in section 02.

Signing out revokes the session on the server in addition to clearing the cookies and stored token.

You have the right to:

• Obtain confirmation of processing and a copy of the personal data held about you (Article 15).

• Have inaccurate personal data rectified (Article 16).

• Have personal data erased (Article 17), which you may also effect by deleting your Account.

• Obtain restriction of processing (Article 18).

• Receive your personal data in a structured, machine-readable format (Article 20).

• Object to processing based on legitimate interests (Article 21).

• Lodge a complaint with a supervisory authority (Article 77).

Requests should be sent to the address in section 13 and will be answered within one month of receipt. That period may be extended by two further months where a request is complex, in which case you will be informed within the first month.

Where a request concerns data held in a Burrow, RatelKey will inform the requester that it holds no such data and will direct the request to the operator of that Burrow.

The supervisory authority in Denmark is Datatilsynet. You may also lodge a complaint with the supervisory authority in your country of residence.

Passwords are stored as Argon2id hashes and are not recoverable in plaintext. Sessions are opaque tokens with a limited lifetime, revocable by the Account holder, and are validated against the sign-in service on each request rather than accepted on the basis of the token alone.

Traffic between clients and RatelKey services is transmitted over TLS. Requests between RatelKey services are signed and subject to replay protection. Access to production systems is restricted to personnel who require it, and actions taken against Accounts are recorded.

Where a personal data breach is likely to result in a risk to the rights and freedoms of data subjects, RatelKey will notify the competent supervisory authority within 72 hours of becoming aware of it in accordance with Article 33 GDPR, and will notify affected data subjects without undue delay where the risk is high in accordance with Article 34.

The Service is intended for persons aged 18 and over and is not directed at children. RatelKey does not knowingly collect personal data from persons under 18. Where RatelKey becomes aware that such data has been collected, it will be deleted. Contact the address in section 13 to report an Account held by a child.

RatelKey may update this policy. Material changes will be notified by email to the address associated with your Account, or by notice in the dashboard, at least 30 days before they take effect. The effective date stated above reflects the current version.

For privacy enquiries, to exercise a right under section 10, or to report a vulnerability affecting the Service:

RatelKey
[email protected]
Terms of Service
ratelkey.com