Privacy Policy

Last updated: 12 November 2026

This policy explains how personal data is processed when you visit ogschaut.de or use the ogschaut deployment platform.

1. Controller and contact

The controller for the website, user accounts, organisations, billing, support and operation of the platform is:

anycast.io UG (haftungsbeschränkt)

Hintere Straße 125a, 90768 Fürth, Deutschland

Represented by the managing director: Franz Bettag

Email for privacy requests: info@ogschaut.de

For personal data contained in the applications, repositories, environment variables and logs that customers deploy, the respective customer is the controller. We process this data on the customer’s behalf under the data processing terms in the Software Usage Agreement. Please contact the operator of the respective application for questions about it.

2. Data we process

Website and technical data

When you access the website or the platform, we process technical data such as IP address, time, requested address, response status, browser type, referrer and security information. This is necessary to deliver the website and to protect it against misuse. Essential cookies and comparable browser storage keep you signed in and remember language and display preferences.

We measure page views and events with a self-hosted instance of the web analytics software Rybbit. It does not create cross-site advertising profiles. If error monitoring is enabled, Sentry receives the diagnostic data needed to investigate application errors.

Account, sign-in and organisations

We process name, email address, avatar, language, organisation memberships, roles, invitations and timestamps. Depending on the sign-in method, we also process password hashes, sign-in links, session data, passkey data, two-factor authentication data and the last sign-in IP address. If you sign in with GitHub or another offered provider, that provider sends us basic profile and authentication data.

GitHub connection and deployments

When an organisation installs the ogschaut GitHub App, we store the installation, the GitHub account name, the selected repositories and the granted permissions. For every push and pull-request event, we store the repository, branch, commit hash, commit message, pull-request number and the status we write back to GitHub as a check and comment. We fetch the source code of the respective commit to build it and store the result as a container image.

We also store environment variables (encrypted), deployment logs, preview addresses, release history, vulnerability scan results and usage records such as build minutes, runtime, data transfer and storage. Logs are deleted automatically after the retention period of the organisation’s plan.

Billing

We process billing contact, plan, subscription and payment status, billing periods and usage. Payment details are entered with and processed by Mollie; we receive only the identifiers and status information needed to administer the contract.

Communication and optional features

If you contact us, subscribe to the newsletter or request support, we process your contact details and message. Transactional emails are sent through Postmark. If you actively use the optional AI chat or upload files such as an avatar, prompts, messages and file content are processed by the configured AI or storage service.

3. Purposes and legal bases

We process data to perform the contract and pre-contractual measures (Article 6(1)(b) GDPR), to comply with tax and accounting obligations (Article 6(1)(c) GDPR) and on the basis of our legitimate interests in secure operation, abuse prevention, analysis of our website and improvement of the service (Article 6(1)(f) GDPR). Where we ask for consent, for example for the newsletter, processing is based on Article 6(1)(a) GDPR; you can withdraw consent at any time with effect for the future.

4. Hosting and recipients

The platform, its database, the build environments and customer applications run on infrastructure operated by us in Germany. Data is disclosed to third parties only where necessary to operate the service, process a payment, comply with law or follow your instructions. Recipients are:

  • GitHub (GitHub, Inc., USA) for sign-in, repository access and status updates on pull requests;
  • Mollie (Mollie B.V., Netherlands) for payments and subscriptions;
  • Postmark (ActiveCampaign, LLC, USA) for transactional email;
  • Sentry, if error monitoring is enabled;
  • the configured AI and storage services, if you actively use the optional AI chat or file uploads;
  • authorities and professional advisers where required by law or to establish, exercise or defend legal claims.

Where a provider processes data outside the European Economic Area, the transfer is based on an adequacy decision, in particular the EU-U.S. Data Privacy Framework, or on standard contractual clauses.

5. Retention and deletion

We keep account and organisation data while needed to provide the service. Accounts selected for deletion are first deactivated and permanently deleted after about 30 days. References to the deleted user in organisation-owned deployments and GitHub records are removed, while the release history remains with the organisation. Deployment logs are deleted after the plan’s retention period. Billing records are kept for the statutory tax and commercial retention periods of up to ten years. Backups and security logs are overwritten after a limited period.

6. Security

We use tenant separation, role-based access, isolated builds, encrypted storage of environment variables, encrypted transport and filtering of sensitive values in logs. No Internet service can guarantee complete security; please also protect your accounts, GitHub access and secrets.

7. Your rights

Under the statutory conditions, you have the right to access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests. You can withdraw consent at any time for the future. Signed-in users can request a machine-readable export of their data in the account settings. You also have the right to lodge a complaint with a data protection supervisory authority, for example the Bavarian State Office for Data Protection Supervision (BayLDA) responsible for us.

8. Changes

We update this policy when the service, our providers or the law change. The current version is always available on this page.