Privacy Policy

1. Introduction

UnboundBytes ("we", "us", "our") operates the UnboundBytes multi-tenant control plane ("Service"). We are committed to protecting your privacy and being transparent about the limited data we collect. This Privacy Policy explains what we collect, how we use it, and the choices you have.

2. Information We Collect

Account Information

When you create an account we collect your email address (via OIDC-based magic-link authentication) and your display name. We do not store passwords — authentication is passwordless.

Billing Information

Payment processing is handled by our third-party processor, Paddle, who acts as the merchant of record. Paddle collects and stores your payment method, billing address, and tax identifier directly; we receive only subscription status, plan, and a redacted billing history for account management. We never see your full card number.

Tenant and Device Data

When you install the UnboundBytes agent on your infrastructure, we collect device metadata (hostname, OS version, architecture) and connectivity information (connection status, heartbeat timestamps) strictly to operate the Service. Tenant configuration data (deployments, app definitions, secrets) is stored in Cloudflare D1 and Durable Object storage, with tenant-level isolation. Agent configurations and secrets are encrypted and only decrypted on your infrastructure.

Usage Data

We collect limited usage data to operate and improve the Service: request metadata (endpoint, HTTP status, latency), error reports, and aggregated feature-usage counts. This data does not include the content of your deployed applications or the data those applications process.

Logs and Security Events

We log authentication events, API requests, and security-relevant events (failed logins, rate-limit events, HMAC validation failures) for up to 90 days to support incident response and fraud prevention.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service.
• Authenticate your identity and secure your account.
• Process billing and manage your subscription (via Paddle).
• Send transactional emails (login links, security alerts, billing receipts).
• Monitor Service health and diagnose technical issues.
• Comply with legal obligations.

We do not sell your personal information. We do not use your data for advertising, and we do not share it with third parties for marketing.

4. Data Storage and Security

Your account data is stored on Cloudflare's global network using Durable Objects and D1, with tenant-level isolation. Secrets managed on your behalf (agent keys, deployment credentials) are stored in HashiCorp Vault and encrypted at rest. Your own application data remains on your own infrastructure — UnboundBytes does not store or process the application data that flows through the software you deploy.

We implement industry-standard security measures including TLS 1.2+ in transit, HMAC-SHA256 request signing, short-lived JWT authentication, rate limiting, and OWASP Top 10 mitigations.

5. Data Retention

We retain your account data for as long as your account is active. When you close your account, we delete your personal data within 30 days, except where we are required to retain specific records for legal, tax, or fraud-prevention purposes. Aggregated, anonymized analytics may be retained indefinitely. Backup data follows the retention schedule of your billing tier (7–90 days depending on plan).

6. Sub-Processors

We use the following sub-processors to operate the Service:

• Cloudflare, Inc. — Infrastructure, CDN, edge compute, and storage (D1, Durable Objects, R2).
• Paddle.com Market Ltd. — Payment processing, subscription management, and tax compliance (merchant of record).
• HashiCorp, Inc. — Vault secrets management (self-hosted on our infrastructure; listed for transparency).
• Amazon Web Services, Inc. (SES) — Transactional email delivery.

Each sub-processor has its own privacy practices. An up-to-date sub-processor list is available in our Data Processing Agreement.

7. International Transfers

UnboundBytes operates globally via Cloudflare's edge network. Your data may be processed in the United States, European Union, or other jurisdictions where our sub-processors operate. Where applicable, we rely on the EU Standard Contractual Clauses (SCCs) or equivalent legal mechanisms for cross-border data transfers.

8. Your Rights

Depending on your jurisdiction (for example, the EU under GDPR or California under CCPA), you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data (subject to legal obligations).
• Export your data in a machine-readable format.
• Withdraw consent for data processing where applicable.
• Object to certain processing or lodge a complaint with your local data-protection authority.

To exercise any of these rights, contact us at legal@unboundbytes.com. We respond to verified requests within 30 days.

9. Cookies

We use a small number of strictly necessary cookies (primarily a session cookie to keep you logged in). This cookie is HttpOnly, Secure, and SameSite=Strict. We do not use third-party tracking cookies or advertising cookies. See our Cookie Policy for details.

10. Children's Privacy

The Service is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify account holders of material changes via email. The "Last updated" date at the top of this page indicates when the policy was last revised.

12. Contact Us

For questions about this Privacy Policy or our data practices, contact UnboundBytes at legal@unboundbytes.com.