GDPR Statement

1. Which laws this covers

This statement explains how Cotterpin Technologies Ltd meets the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, for people in the EU and EEA, the EU General Data Protection Regulation (EU GDPR). It sits alongside our Privacy Policy, which is our full notice to you, and the Data Processing Addendum for Team and Enterprise customers.

2. Who is responsible for what

3. How we apply the data protection principles

• Data minimisation by design. For licensing, the software sends only the licence id, plan, machine fingerprint and version. The fingerprint is mfp_ + HMAC-SHA256 of the machine's stable hardware id under a fixed product salt, computed on your machine; the hardware id itself is never stored or sent. Email addresses are kept only as SHA-256 hashes.
• Purpose limitation. Licensing data is used to issue and check licences, enforce machine limits, and protect the service. It is not used for marketing or profiling.
• Lawfulness and transparency. Our lawful bases are listed for each kind of data in the Privacy Policy. cotterpin privacy prints, on your machine, exactly what leaves it.
• Storage limitation. Each kind of data has a retention period in our Data Retention Policy.
• Accuracy. You can see and correct the machines on your licence yourself with cotterpin machines.
• Integrity and confidentiality. See section 6.
• Accountability. We keep a record of our processing activities (Article 30), owned by our director, and review it and this statement whenever what the software or our services collect changes.

4. Consent first, in the product

The software follows one rule: say what we are going to do and why; the developer can approve or decline; if declined, run in serial or take the default that needs no scan.

• Each machine measurement (cores, memory, disk, a one-second calibration run, live load) is asked about separately. Its results never leave your machine.
• Every change outside your repository to your own files or your agent tools' settings, every hook and agent-tool adapter installation, and every call to a provider or to our licence service asks first. Cotterpin's own records in its configuration directory (such as the empty guarded-session files that keep an agent session's guards on after it leaves a repository) are kept without asking; they hold nothing about your code.
• Declining is never an error: work runs one job at a time, or Cotterpin runs in Watch.
• In a non-interactive shell, anything not approved in advance counts as declined.
• cotterpin consent shows every answer, and cotterpin consent revoke <id> withdraws one.
• Telemetry is off and this release contains no telemetry sender. There is no Team or Enterprise dashboard.
• Bug reports are sent only by you, after you read them; from the next release, also automatically, but only for a repository and kind of report you turned that on for yourself (your operating system confirms it is you), never your code, and never where your organisation forbids it. cotterpin bug-autosend off <kind> withdraws that consent. See the Privacy Policy.

5. Your rights, and how requests work

You have the right to be informed, of access, to rectification, to erasure, to restrict processing, to data portability, to object, and not to be subject to solely automated decisions with legal or similarly significant effects (we make none).

1. Ask. Email privacy@cotterpin.io. You don't need to use any particular words.
2. Help us find your records. We store your email only as a hash and your machine only as a fingerprint, so we may ask for the email address you used, or for your licence id (shown by cotterpin machines). We ask only for what we need to confirm it is you.
3. Timeline. We acknowledge your request within 5 business days and answer within one month of receiving it. For complex or numerous requests we may extend this by up to two further months, telling you why within the first month.
4. Cost. Free, unless a request is manifestly unfounded or excessive.
5. Data held by others. For payment data, we will pass your request to Paddle or you can contact Paddle directly at paddle.net. For what you sent your model provider, contact that provider.

Some things you can do yourself at any time: withdraw a consent with cotterpin consent, remove a machine with cotterpin machines remove, remove what Cotterpin added to a repository with cotterpin uninstall, remove an agent tool adapter with cotterpin adapters uninstall (or everything Cotterpin put on your machine with cotterpin --uninstall), and delete your stored consent answers by deleting consent.json in your Cotterpin configuration directory.

6. Security measures

• Licence tokens are signed with keys held in AWS KMS; the private keys never leave KMS.
• Paddle API and webhook secrets are held only in AWS Secrets Manager. Every Paddle notification is signature-checked, and replays are refused.
• The licence service runs in AWS eu-west-1 (Ireland), with access limited to the actions it needs.
• Personal identifiers are stored as one-way hashes where the service does not need the original.
• Releases are signed and verified on your machine before they run.
• Only our director can reach personal data. Administrative access to our AWS account needs multi-factor authentication, and our admin page needs a Microsoft Entra ID sign-in that only the director's account can complete. Anyone who joins us later will get access only to what their role needs, and will be bound in writing to keep personal data confidential.

See our Security page and Security and Responsible Disclosure Policy.

7. Personal data breaches

If we become aware of a personal data breach, we will contain it, assess the risk and record it. Where it is likely to result in a risk to people's rights and freedoms, we will notify the ICO (and, where the EU GDPR applies, the relevant EU authority) within 72 hours of becoming aware of it. Where the risk is high, we will also tell the people affected without undue delay. Team and Enterprise customers are notified as set out in the Data Processing Addendum.

8. International transfers

How data moves between countries, and the safeguards we rely on, is in the Privacy Policy and the Sub-processors list.

9. Data protection officer and EU representative

• Data protection officer: we are not required to appoint one. Our director is responsible for data protection and reads privacy@cotterpin.io.
• EU representative (Article 27 EU GDPR): we are appointing a representative in the EU, and will name them here. Until then, people in the EU can contact us directly at privacy@cotterpin.io.
• ICO registration number: ZC266082

10. Complaints

You can complain to the Information Commissioner's Office at ico.org.uk, or, in the EU and EEA, to the data protection authority where you live or work. We would appreciate the chance to put things right first.