Privacy Policy

UgurLabs UG (haftungsbeschränkt)
Fährstraße 217, 40221 Düsseldorf, Germany
Managing Director: Ugur Koc
Email: customer-care@ugurlabs.odoo.com

When you open this website, our hosting provider (Vercel Inc.) processes technically necessary data (IP address, time, page requested, user agent) in server logs in order to provide and secure the service (Art. 6(1)(f) GDPR). The application runs in EU data centers; a data processing agreement including the EU Standard Contractual Clauses is in place with Vercel.

This website uses only technically necessary session cookies for sign-in. No tracking or marketing cookies are set. See our Cookie Policy for details.

For reach measurement we use Vercel Web Analytics, a cookieless method that records only aggregated, anonymized page views (Art. 6(1)(f) GDPR). No cross-device profiles are built and no IP addresses are stored.

Sign-in is handled through our authentication provider, WorkOS, Inc. (AuthKit). You can sign in with a Microsoft work or school account, Google, Apple, a passkey, a one-time email link, or email and password. Whichever method you choose, we process the profile data it returns, in particular your display name and email address, together with the identifier WorkOS assigns to your account. Where you sign in with a Microsoft account, we additionally receive your Microsoft object ID and tenant ID. This data is required to provide the account (Art. 6(1)(b) GDPR).

WorkOS processes this sign-in data in the United States; the transfer is based on the EU Standard Contractual Clauses (see the subprocessor list below). Sessions are then maintained by a first-party, HTTP-only cookie set by LicenseMeter (see our Cookie Policy).

When an organization connects its Microsoft 365 tenant, LicenseMeter processes the following data of the tenant’s users on that organization’s behalf (Art. 28 GDPR): display name, UPN, account status, user type, creation date, license assignments, last sign-in timestamp and the last activity date per service. Mailbox, file or message content is never read; access is technically limited to read-only permissions.

If the organization additionally connects optional connectors, LicenseMeter processes, under the same engagement, the following data as well: member email addresses and product assignments from Adobe, Zoom, Atlassian and Salesforce; console member lists and daily API cost totals from OpenAI and Anthropic; and member lists pasted via CSV from ChatGPT and Claude.

The data is stored in a Postgres database in the EU (Frankfurt region) and is deleted immediately and in full when the workspace is disconnected. Where the organization connects its Microsoft tenant using its own application registration (“bring your own”), the credentials it supplies are stored encrypted (AES-256-GCM) and used solely for the read-only sync; they are never logged or disclosed. A data processing agreement (DPA) is provided to each organization before production use.

If an organization subscribes to a paid plan, our payment processor (Stripe) processes the data needed to bill it: contact and billing details, the selected plan, and payment information. This is necessary to perform the contract (Art. 6(1)(b) GDPR). We store the subscription status and invoice metadata; we do not store full card numbers. Stripe retains invoice and transaction data for the period required by statutory tax and commercial-law retention duties, even after a workspace is disconnected. Stripe is listed among the subprocessors below.

We engage the following subprocessors to process personal data on your behalf:

• ·Vercel Inc.: Application hosting and content delivery, EU (Frankfurt function region) (EU processing; SCCs for any support access from outside the EU).
• ·Supabase Inc.: Managed PostgreSQL database (primary data store), EU (AWS eu-central-1, Frankfurt) (EU processing; SCCs for any support access from outside the EU).
• ·Microsoft (Microsoft Ireland Operations Ltd. / Microsoft Corporation): Identity platform (sign-in, admin consent) and Microsoft Graph API, EU Data Boundary; US fallback (EU Standard Contractual Clauses (Microsoft Products and Services DPA)).
• ·WorkOS, Inc.: Authentication and user identity management (AuthKit sign-in), where enabled, US (EU Standard Contractual Clauses (WorkOS DPA)).
• ·Stripe (Stripe Payments Europe Ltd. / Stripe, Inc.): Billing and subscription management (for paid plans), EU and US (EU Standard Contractual Clauses (Stripe DPA); retains invoice data to meet statutory tax-retention duties).
• ·Resend Inc.: Transactional and notification email delivery, EU (Ireland region) (EU processing; SCCs where applicable).

The current list is part of the DPA.

To be distinguished from these are the source systems named in section 4 (Adobe, Zoom, Atlassian, Salesforce, OpenAI, Anthropic, and the lists pasted via CSV from ChatGPT and Claude): LicenseMeter reads data from them, on the organization’s behalf, on a read-only basis. They are data sources, not subprocessors of LicenseMeter; no personal data is shared with them beyond the authenticated read request.

Account and product data is stored for as long as the workspace is connected. On disconnect, all synchronized data is deleted; remaining copies in routine encrypted backups are overwritten within the backup rotation window (currently around seven days). Invoice and transaction data is retained by the payment processor for the statutory periods described in section 5. The hosting provider’s server logs are subject to that provider’s deletion periods.

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), as well as the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). For data we process on behalf of your organization, please contact your organization as the controller in the first instance.

Privacy questions: customer-care@ugurlabs.odoo.com