EU & UK privacy rights

The controller is Omnibus, Ltd; see the legal notice for the address. Contact for all data protection matters: privacy [at] omnibus.dev.

The CleanPanda app looks at your files only on your computer. We never receive your files or their contents, so for your files you are the only controller, and no data processing agreement with us is needed.

• Answering your contact form messageLegitimate interest (Art. 6(1)(f)), or steps before a contract (Art. 6(1)(b))
• Spam protection on the contact form (Turnstile)Legitimate interest in a secure site (Art. 6(1)(f))
• Delivering and supporting a license you boughtContract (Art. 6(1)(b))
• Keeping order and tax recordsLegal obligation (Art. 6(1)(c))
• Website hosting and security logsLegitimate interest (Art. 6(1)(f))
• Website analyticsConsent (Art. 6(1)(a)), which you can withdraw at any time
• Error reports from the app (Sentry)Legitimate interests in keeping the app stable and secure (Art. 6(1)(f)); you can object by turning Send diagnostics off; crash reports are needed to fix crashes

Where we rely on legitimate interest, you can object at any time and we will stop unless we have compelling grounds. We make no decisions based solely on automated processing, and we do no profiling.

Error reports from the app. Our service provider (processor) Sentry, run by Functional Software, Inc. in the USA, receives the app's error reports: the error type and message with your home folder, user name, file paths and quoted text removed; the stack trace; the app version; the operating system and its version; the computer model and processor architecture; a random installation identifier; and the IP address of the computer sending the report, which Sentry receives as with any internet request and may store with the report. Crash reports are always sent; other diagnostics only while Settings > Privacy & data > Send diagnostics is on (on by default; you can turn it off at any time). Reports never contain your files, document, photo or mail contents, or license keys. The data goes to the USA under Sentry's data processing terms with Standard Contractual Clauses, and Sentry keeps it for 90 days (its default retention). Legal basis: our legitimate interests in keeping the app stable and secure (Art. 6(1)(f)). You can object at any time by turning Send diagnostics off; crash reports are still sent, because they are needed to fix crashes.

• Access: get a copy of the personal data we hold about you (Art. 15)
• Rectification: have inaccurate data corrected (Art. 16)
• Erasure: have data deleted when there is no reason to keep it (Art. 17)
• Restriction: have processing limited while a dispute is resolved (Art. 18)
• Portability: receive data you gave us in a machine-readable format (Art. 20)
• Objection: object to processing based on legitimate interest (Art. 21)
• Withdraw consent at any time, without affecting earlier processing (Art. 7(3))

Write to privacy [at] omnibus.dev. We answer within one month, free of charge, and may ask you to confirm your identity, for example by writing from the address you used with us.

Our hosting, form, sales and error-reporting providers are based in the United States. We rely on the EU-US Data Privacy Framework, the UK Extension and the Swiss-US framework where a provider is certified, and on the European Commission's Standard Contractual Clauses (with the UK Addendum) otherwise. You can ask us for a copy of the safeguards.

Payments. Lemon Squeezy, the merchant of record for purchases on this website, is a Stripe company. Card payments are processed on Stripe's infrastructure, with Stripe acting for Lemon Squeezy; we never receive your card details.

• Contact messages: up to 24 months after our last exchange
• Order and license records: as long as tax and accounting law requires
• Error reports: 90 days (Sentry's default)
• Consent choice: stored in your browser until you change or clear it
• Analytics: aggregated; Google Analytics data, if enabled, for 14 months

You can complain to the data protection authority where you live or work, or where you think an infringement happened. The European Data Protection Board lists all EU authorities at edpb.europa.eu; in the UK it is the Information Commissioner's Office. We would appreciate the chance to resolve it first.