Privacy Policy

The controller for the processing described in this policy is Bauer & Kuke EDV GbR, Rudolf-Breitscheid-Straße 49, 16559 Liebenwalde, Germany, represented by Phillip-Luca Bauer and Celine-Julie Kuke. The data-protection contact is Phillip-Luca Bauer, reachable at care@goberly.com. The full provider information is available in the imprint.

We process personal data only where necessary to provide Zonekey, protect the service, perform the user agreement or meet legal obligations. The applicable legal bases are Article 6(1)(b) GDPR for the service, Article 6(1)(c) GDPR for legal duties, Article 6(1)(f) GDPR for security and reliable operation, and Article 6(1)(a) GDPR where consent is required.

• Website operation: IP address, time, requested page, response status and, where applicable, user agent for delivery, attack prevention and troubleshooting.
• Account and security: name, email address, verification status, language, profile image, login and session data, IP address, user agent, linked login accounts and, if enabled, passkeys, two-factor authentication and recovery codes.
• Cloudflare management: encrypted Cloudflare API tokens and the zone or DNS data needed to carry out actions requested by the user. DNS content may contain personal data.
• Organisations and notifications: organisation details, memberships, roles, invitations, audit records and account or security notifications.
• Profile images and backups: voluntary profile images and encrypted database and R2 backups.
• Optional analytics: only after consent, Google Analytics 4 is delivered through Google Tag Manager and processes online identifiers, browser and device information, IP-derived location and page or interaction data to create aggregated usage statistics and improve Zonekey. We do not use it for advertising or marketing audiences.

We use Host-Unlimited exclusively in Wolfsburg, Germany, for hosting and self-operated PostgreSQL, Redis and Mailcow services. Cloudflare processes data for the DNS API, R2 storage for profile images and encrypted backups, and Turnstile for abuse protection. Better Auth Dash and Sentinel provide active security and activity functions.

Host-Unlimited processes data under an Article 28 GDPR data-processing agreement. For the Cloudflare Self-Service account, the Data Processing Addendum forms part of the contract; Cloudflare identifies the EU-US Data Privacy Framework and, where required, EU Standard Contractual Clauses for international transfers. The accepted Better Auth DPA identifies appropriate safeguards such as Standard Contractual Clauses for required international transfers. Cloudflare and Better Auth may process data outside the EEA, including in the United States.

With Analytics consent, Google Analytics 4 is provided by Google LLC under Google's applicable data-processing terms; processing may take place outside the EEA, including in the United States. Google, GitHub and Discord are independent controllers for their respective OAuth sign-in services and receive data only when you select that sign-in method. OIDC/SSO is not enabled. Their own privacy notices and transfer arrangements apply.

Sessions expire after seven days. Technical Redis metrics are deleted after 24 hours. Encrypted backups are deleted after seven days. Account data is retained for the duration of the account and then deleted unless a legal retention duty or a legitimate need requires otherwise.

Audit logs and invitations are deleted automatically after three months; notifications are deleted after six months. We retain these data only as long as necessary for their purpose.

Subject to the statutory requirements, you have the rights of access, rectification, erasure, restriction, data portability and objection under Articles 15 to 21 GDPR. You may withdraw consent at any time with future effect. Requests can be made through the contact details in the imprint or the configured support email.

You may lodge a complaint with a data-protection supervisory authority. The authority responsible for the controller is the Brandenburg Commissioner for Data Protection and for the Right of Access to Files, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany, Poststelle@LDA.Brandenburg.de.

We update this policy when processing activities, legal requirements or technical providers change. The version published on this page applies.