Privacy Policy
Last updated
This policy explains what personal data DCMS processes, why, how long we keep it and what control you have. In short: we collect what the service needs to work, keep it in the EU, and don’t use it for advertising.
1. Who we are
DCMS is operated by HighGeek, Czech Republic (“we”, “us”). For the personal data described in sections 3 to 5 we are the controller under the EU General Data Protection Regulation (GDPR).
For anything about your personal data, including exercising your rights, write to admin@highgeek.eu. We do not have a data protection officer, as the GDPR does not require one for a service of our kind.
2. What this policy covers
- This website, highgeek.eu.
- The DCMS service: your account, the admin console at admin.highgeek.eu, sign-in at auth.highgeek.eu, the git server at git.highgeek.eu, and everything you do in a workspace.
- Websites built with DCMS, but only in part. When you visit a site that one of our customers built and published with DCMS, that customer decides what the site collects and is the controller; we process the data on their behalf. Section 6 explains what DCMS itself does on those sites; for everything else, read that site’s own privacy notice.
3. Visiting this website
This website sets no cookies, runs no analytics or advertising, and loads nothing from third parties. If you switch between light and dark mode, the choice is saved in your browser’s local storage under dcms.theme. It never leaves your device.
Like any web server, ours records each request: IP address, time, requested address, browser user agent and response status. We use these logs only to keep the service running and secure (our legitimate interest, Art. 6(1)(f) GDPR) and delete them after 30 days.
4. Your DCMS account
| Data | Why | Legal basis |
|---|---|---|
| Email address, display name, password (stored only as a salted hash), account creation date | To create your account and sign you in | Contract, Art. 6(1)(b) |
| Your Google account’s email and identifier, if you sign in with Google | To sign you in with Google and link it to your account | Contract, Art. 6(1)(b) |
| Git username, SSH public keys you add, the password you set for git | To give you access to your site repositories over HTTPS and SSH | Contract, Art. 6(1)(b) |
| Active sessions, with the IP address and browser of each | To keep you signed in and let you see and end your sessions | Contract, Art. 6(1)(b) |
| Audit log of security-relevant actions: sign-ins and failed attempts, password and sign-in method changes, changes made in a workspace, with IP address and browser | To protect accounts, investigate abuse and let workspace owners see who changed what | Legitimate interest, Art. 6(1)(f) |
| Messages we send you: password resets, invitations, notifications | To run the service and respond to what you asked for | Contract, Art. 6(1)(b) |
We do not use your data for advertising, do not sell it, and do not build profiles of you.
5. Content in your workspace
Everything you and your team put into a workspace — pages, site source code, posts, media, settings, AI conversations — is stored so we can provide the service to you (Art. 6(1)(b)). If that content contains other people’s personal data, the workspace owner is responsible for having a legal basis for it, and we process it on the owner’s instructions as described in our Terms of Service.
AI features
When you use the assistant, the coding agent or a visitor chatbot, the prompt and the content needed to answer it — such as the page being edited or the published pages a chatbot answers from — are sent to the AI provider configured for your workspace. That can be Anthropic, OpenAI, another OpenAI-compatible service or a model you run yourself. If you add your own API key, your use of that provider is governed by your agreement with them. Keys are stored encrypted. Assistant conversations are kept for 180 days and coding-agent runs for 45 days.
Optional integrations
If you import files from Google Drive, Google gives us access only to the files you pick, for that one import; the access token is not stored. If you connect an Instagram account or Facebook Page, we store an encrypted access token and copy the posts you chose to display.
6. Visitors to sites built with DCMS
On those sites the site owner is the controller. Depending on which features they turned on, DCMS may process:
- Analytics, only after the visitor agrees in the consent banner: pages viewed, referrer, campaign tags, device and browser type, and a random session identifier. IP addresses are not stored. Raw events are deleted after 90 days; only aggregated daily counts are kept.
- Form submissions: what the visitor typed, the time, and a shortened browser identifier for abuse checks. No IP address is stored.
- Chat: the name given, the messages and their times.
- Visitor accounts: email, display name, a hashed password and when the email was verified.
The site owner decides how long submissions, chats and visitor accounts are kept and can delete them at any time. Requests about this data should go to the site owner; if you contact us instead, we will pass your request on.
8. Who we share data with
We use these service providers (processors). Each receives only what it needs for the task listed:
| Provider | Task | Location |
|---|---|---|
| OVHcloud | Servers that host the entire service and all its data | European Union |
| Apple (iCloud Mail) | Delivering email we send: recipient address and message | EU / USA |
| Cloudflare | DNS for our domains; it does not see website traffic | Global |
| Let’s Encrypt | HTTPS certificates; receives only domain names, which are public | USA |
| Only if you sign in with Google or import from Google Drive | USA | |
| Meta | Only if you connect Instagram or Facebook | USA |
| Your chosen AI provider | Only when you use AI features (section 5) | Depends on the provider |
We disclose data to public authorities only where the law requires it, and we check that each request is lawful first.
9. Transfers outside the EU
Your account and workspace data are stored in the European Union. Where a provider above processes data in the USA or another country without an EU adequacy decision, the transfer relies on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.
10. How long we keep data
| Data | Kept for |
|---|---|
| Account and workspace content | Until you delete it, your account, or the workspace |
| Server and application logs | 30 days; security logs 90 days |
| Audit log | 400 days, including after an account is deleted, so past actions stay attributable |
| Sessions | Until sign-out or expiry; a record of ended sessions for 14 days |
| AI assistant conversations / coding-agent runs | 180 days / 45 days |
| Read notifications | 90 days |
| Site analytics events | 90 days; aggregated counts until the workspace is deleted |
11. Security
All traffic is encrypted with HTTPS. Passwords are stored only as salted hashes, repeated failed sign-ins lock the account temporarily, and secrets such as API keys and access tokens are encrypted in a dedicated secrets vault. Workspaces are separated both by the application and by row-level security in the database. Access to production systems is limited to the people who operate them.
12. Your rights
Under the GDPR you have the right to:
- get a copy of your personal data and information about how it is processed;
- have inaccurate data corrected;
- have your data deleted;
- restrict processing, or object to processing based on our legitimate interest;
- receive the data you gave us in a machine-readable format;
- withdraw consent at any time, where processing relies on consent.
You can delete your account yourself in the admin console under your account settings, after leaving or handing over any workspaces you own. For everything else, write to admin@highgeek.eu. We answer within one month.
You can also complain to a supervisory authority. In the Czech Republic that is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), uoou.gov.cz; you may instead contact the authority where you live or work.
13. Children
DCMS is not intended for anyone under 16, and we do not knowingly create accounts for them.
14. Changes to this policy
If we change how we process personal data, we will update this page and its date. For significant changes we will also tell account holders by email before they take effect.