Privacy Policy & GDPR

Effective Date: August 12, 2025

1. Introduction

   Welcome to Enkryptify (“we”, “our”, “us”). We are committed to protecting your personal data and handling it with due care. This Privacy Policy explains what data we collect, how we use it, and how we protect your rights, in accordance with the General Data Protection Regulation (“GDPR”).

   We apply appropriate technical and organizational measures and conduct regular system testing to maintain the confidentiality, integrity, and availability of personal data.

2. When and why we process personal data

   Enkryptify may process personal data when:

   • The processing is necessary for the performance of a contract or to take pre-contractual steps at the user's request.
   • The processing is necessary to comply with a legal obligation.
   • The processing is necessary for the purposes of a legitimate interest. In such cases, we always make a careful balance between our interest and the protection of your privacy.
   • The user has given consent. By using our systems, the customer confirms that all affected parties have been informed and have given their consent to the registration of their relevant data. Consent may be withdrawn at any time, without affecting the lawfulness of the processing prior to withdrawal.

3. Data we collect

   When you create an account, we collect personal information such as your name, email address and profile picture. We also collect team and project names, solely to provide our services.

   Our platform processes secrets (such as API keys, tokens, and environment variables) that you add. These remain strictly confidential and are only used to deliver our services.

   We also collect anonymized usage data (such as browser type, operating system, and visited pages) to improve our services.

4. Data retention

   We store personal data for as long as you maintain an account with Enkryptify. Once your account is deleted, your personal data will be removed following the terms of use. Anonymous analytics data is kept indefinitely for internal improvement purposes.

5. Data sharing and subprocessors

   Enkryptify may share personal data with carefully selected processors who provide services on our behalf, including:

   • Fly.io (backend hosting)
   • Vercel (frontend hosting)
   • AWS RDS (database, with encryption at rest and in transit)
   • Clerk (authentication)
   • Resend (transactional emails)
   • Upstash (caching, rate limiting)
   • PostHog (analytics, without personal or sensitive data)
   • Sentry (error and performance monitoring)
   • BetterStack (logging)
   • Aikido Security (software security)

   Enkryptify and these external processors are bound by the GDPR and process personal data only under our instructions. If data is processed outside the EEA, we ensure an equivalent level of protection as required by GDPR.

6. Third-party integrations

   Our platform can integrate with third-party services. If these integrations require access to secrets, this will only happen with your explicit consent. Examples include integrations with GitHub, Google Cloud, AWS, and Azure.

   Enkryptify's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Your rights

   As a user, you have the right to:

   • Access your personal data and obtain additional information regarding the processing.
   • Rectify inaccurate or incomplete data.
   • Erase your personal data.
   • Restrict processing in certain cases.
   • Port your personal data to another controller, where technically possible.

   You can exercise these rights by sending a request to contact@enkryptify.com, accompanied by a copy of the front side of your ID card.

   If you believe your data is being processed unlawfully, you can contact the Data Protection Authority (Rue de la Presse 35, 1000 Brussels, commission@privacycommission.be, +32 2 274 48 00).

8. Cookies and local storage

   We use cookies and local storage to remember preferences such as language settings, themes and access tokens. You can manage these via your browser settings.

9. Children's privacy

   Our services are intended for users aged 18 and over. We do not knowingly collect data from children under 18.

10. Data controller

    The controller of your personal data is Enkryptify, registered in Hoogveldstraat 50, 700 Tongeren-Borgloon, Belgium, company number 1014.079.174. This means Enkryptify determines the purposes and means of the processing and is your point of contact for privacy matters (contact@enkryptify.com).

11. Changes to this policy

    We reserve the right to amend this policy. For significant changes, we will notify you via email and on our website.