Privacy Policy

1. Who is responsible

metikular GmbH, Alte Hedingerstrasse 25a, 8910 Affoltern am Albis, Switzerland, is responsible for the processing described here (controller under the Swiss Federal Act on Data Protection, nDSG/nFADP, and, where applicable, the EU General Data Protection Regulation, GDPR). Contact for all privacy questions: hello@metastic.ch.

For the content your organization stores in Inventory (servers, applications, todos, notes, names and emails of colleagues), your organization decides what is processed and why; for that content we act as its processor and use it only to provide the service.

2. What we process

• Account data: your email address, the organizations you belong to and your role, and sign-in times.
• Content: servers (names, providers, IP addresses, notes), applications, where they run, todos, assignees, notes and links, and a history of changes to todos (who did what, and when).
• Forge tokens and forge data: if an admin connects GitHub, GitLab, Forgejo or Gitea, we store the access token encrypted (AES-256-GCM, with a key kept only on the server, outside the database), and only the last four characters in readable form. With it we read the open pull requests, issues and CI status of the repositories you link, including titles, labels, links and the user names of authors and assignees, and keep a copy so the pages load quickly. We never write to your forge. Deleting a connection deletes the token immediately.
• Dependency data: when you upload a lockfile or manifest, it is parsed and then discarded; the file itself is not kept. We store the package names, versions and the file path.
• Billing data (once billing is live): Stripe processes name, billing address, VAT ID and payment details. We receive and store only the Stripe customer and subscription IDs, the plan and the subscription status. We never see full card numbers.
• Technical data: IP address, time, requested path and status code in server logs, kept for at most 30 days for security and debugging. We do not log query strings, tokens or email contents.
• Error diagnostics: when the app hits an internal error, a technical report (error message, program stack, the kind of page, the HTTP method and status, the software version) is sent to our own error tracker, which runs on our own server at Hetzner in Germany. Before it leaves the app, the report is stripped of email addresses, IP addresses, cookies, sign-in and API tokens, full addresses (URLs) and request contents. Reports are kept for at most 90 days.
• Feedback and access requests: messages you send with the feedback button, and the email address and note you enter when you request access, with the page you were on.

3. Public lookups for dependencies

To show the latest versions, known vulnerabilities and end-of-life dates, Inventory sends the names and versions of public packages to the public services that publish this data: rubygems.org, the npm registry, proxy.golang.org, PyPI, the OSV vulnerability database (Google) and endoflife.date. Packages that do not come from the public registry (for example git or path sources, or another registry) are never sent. The requests come from our server, contain no account or organization data, and the results are cached and shared across all customers, so these services cannot tell which organization uses a package.

4. Why (purposes and legal bases)

We process this data to provide and secure the service, to bill paid plans, to send the emails you need (sign-in links, invitations and, once billing is live, billing notices), and to answer your messages and access requests. Legal bases under the GDPR: performance of the contract (Art. 6(1)(b)), legal obligations such as bookkeeping (Art. 6(1)(c)), and our legitimate interest in a secure, working service (Art. 6(1)(f)). We do not sell data, we do not show ads and we do not profile you.

5. Cookies and tracking

Inventory uses two technically necessary cookies: a session cookie that keeps you signed in, and a security cookie against cross-site request forgery. The dark mode choice is stored in your browser's local storage. There are no analytics, tracking or advertising cookies, and no third-party scripts.

6. Processors and where data is stored

• Hetzner Online GmbH, Germany: servers, object storage and backups, in data centres in Germany (EU).
• Stripe Payments Europe Ltd., Ireland (with Stripe, Inc., USA): payment processing for paid plans, once billing is live. Transfers to the USA are covered by the EU-US and Swiss-US Data Privacy Framework and standard contractual clauses.
• Our mail server (operated by us in Europe): delivery of all emails.
• Your forges (GitHub, GitLab, Forgejo, Gitea), only if your organization connects them: we send requests with your token to the base URL you enter.
• Public package services (section 3): only public package names and versions, no personal data.

Switzerland recognises the EU/EEA as providing adequate data protection.

7. How long we keep data

• Account and content: as long as your account or organization exists. When they are deleted, the data is deleted immediately and disappears from backups within 30 days (backups are kept for 7 days).
• Sign-in links: 15 minutes. Invitations: 7 days. Sessions: 30 days.
• Forge tokens: until the connection is deleted. Pull request and issue copies: until the repository is unlinked or the item is closed.
• Billing records: 10 years, as required by Swiss bookkeeping law (Art. 958f CO).
• Server logs: at most 30 days. Error reports: at most 90 days.

8. Your rights

You have the right to access your data, to correct it, to have it deleted, to receive it in a portable format, to restrict or object to processing, and to withdraw consent. Write to hello@metastic.ch; we answer within 30 days. You can also do much of this yourself in the app:

• Export: admins of an organization download all its data as a JSON file under Settings → Export and deletion (servers, applications, deployments, todos and notes, dependency manifests and packages, repository links, members and pending invites). Forge tokens, API tokens and other secrets are never part of the export.
• Delete an organization: admins delete an organization with all its data under Settings → Delete organization, including its forge tokens, API tokens, invitations and memberships. It is deleted immediately and disappears from backups within 30 days.
• Delete your account: under Your account. Content you created stays in your organizations, but your email address is removed from it, and API tokens you created are revoked. If you are the only admin of an organization, delete it or make another member an admin first.

We keep a log of deleted organizations and accounts without personal data (only the organization's random id and the time). You may also complain to a supervisory authority, in Switzerland the Federal Data Protection and Information Commissioner (FDPIC/EDÖB), or the authority of your EU country of residence.

9. Security

All traffic is encrypted (HTTPS with HSTS). Sign-in uses one-time links instead of passwords; sign-in links, sessions and API tokens are stored only as hashes, and forge tokens encrypted. Data of different organizations is strictly separated, and ids cannot be guessed. Servers are kept up to date and backed up continuously.

10. Changes

We update this policy when the service changes. The version date is shown at the top; material changes are announced by email.