Privacy Policy

This policy explains what personal data we collect when you use status302: the website and developer documentation at status302.com, the web app at app.status302.com and the API at api.status302.com (together, the “Service”). It explains why we collect the data, who processes it on our behalf and what rights you have. We have tried to write it so it can be read without a lawyer.

Who is responsible for your data

status302 is a product of status403 Sp. z o.o. (status403 Spółka z ograniczoną odpowiedzialnością), with its registered office in Warsaw, Aleja "Solidarności" 68 lok. 121, 00-240 Warszawa, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) kept by the District Court for the Capital City of Warsaw, 12th Commercial Division, under KRS number 0001269943, NIP 5253108931, REGON 54585207200000. We are the controller of the personal data described here.

For anything concerning your personal data, write to [email protected]. We have not appointed a data protection officer, because the scale of our processing does not require one; that address reaches the people who handle it.

What data we collect and why

Visiting the website and the docs

When you open a page, your browser necessarily sends connection data: your IP address, browser and device type, the page requested, the referring page and the time of the request. We need it to deliver the page and to protect the Service against abuse. All our domains are served through Cloudflare, which processes this data as part of delivering and protecting them. Our own web server does not keep an access log.

The website’s fonts and search are served from our own domain. The interactive API reference runs in your browser: when you try a request there, it goes from your browser directly to our API.

Analytics and advertising measurement, only with your consent

With your permission we use Google Analytics 4 to understand how the website and the docs are used and Google Ads to measure campaigns and show relevant ads. Both load through Google Tag Manager, and Tag Manager itself is not fetched until you allow at least one of them in the cookie notice. Until then nothing is sent to Google’s measurement servers and no Google cookies are set. The two purposes are separate choices.

If you allow analytics, Google collects the pages you view, how you got here, approximate location derived from your IP address, your browser and device, and interactions such as scrolling and outbound clicks. If you allow advertising, Google additionally stores advertising identifiers and uses your activity to measure our campaigns and personalise ads. The web app and the API never load Google Analytics or Google Ads.

Your account

To create and run your account we process your email address, your name and profile picture (if you set them, or if they come from Google or Discord when you sign in with them), the organisations you belong to and your role in each, and the settings you choose (region, display currency, price basis, fee settings, saved presets, lists and alert rules).

• Signing in by email. We email you a single-use sign-in link, valid for 15 minutes. A short-lived cookie ties the link to the browser that asked for it.
• Signing in with Google or Discord. If you choose this, the provider tells us your account identifier, your verified email address, your name and your profile picture. We do not receive your password, and we accept only an email address the provider has verified.
• Two-factor authentication. If you enrol an authenticator app, we store its secret in encrypted form and your recovery codes only as keyed hashes.
• Sessions. For each browser you are signed in on, we keep the time it was created and last used, its user agent and its IP address, so you can review and sign out your sessions in Settings and so we can protect your account.
• Pictures from other servers. Event and venue images, and profile pictures from Google or Discord, load in the web app directly from the servers that host them, which receive your IP address as with any request.
• Organisations and invitations. When someone invites you to an organisation, we process your email address, the role offered and who invited you. Within an organisation, an audit log records security-relevant actions (for example inviting a member or creating an API key) with the member who performed them and their IP address; the organisation’s owners and admins can read it.

API keys and usage

For each API key we keep its name, scopes, optional IP allowlist and expiry, and the time and IP address of its last use. The secret part of a key is never stored, only a keyed hash of it. We count API requests per minute for each organisation, key and group of endpoints, to enforce plan quotas, bill usage where your plan includes it and show you your usage.

Notifications you set up

If you add a notification channel — an email address, a Discord, Slack, Microsoft Teams or Google Chat webhook, a Telegram chat, a browser push subscription or a webhook endpoint of your own — we store its details in encrypted form and send alert messages there when your alert rules fire. The service you send them to (for example Discord, Slack, Telegram or your browser vendor’s push service) handles them under its own terms. We keep a log of alert firings and webhook deliveries so you can see what was sent.

Payments

Subscriptions are paid through Stripe. When you start a checkout, we give Stripe the email address of the person paying, the organisation’s name and our internal identifiers. You enter your payment details on Stripe’s own pages; we never see or store your card number. Stripe tells us the subscription’s plan, status, number of seats and billing period. Invoices and payment records are kept for as long as tax and accounting law requires.

Emails we send

We send transactional emails only: sign-in links, organisation invitations and the alert emails you set up. Stripe sends receipts and billing notices. We do not send newsletters or marketing emails.

Writing to us

If you email us, we process your address, your name if you give it, and the content of the correspondence, to answer you and to handle whatever the message is about.

Error reports

When the web app or our servers hit an error, a report is sent to an error tracker we host ourselves. Reports are built to leave personal data out: they carry no user identity, cookies, request bodies or query strings, email addresses in them are masked, and the only request header kept is the browser’s user agent.

Exports

Files you export (CSV or JSONL) are kept on our servers for 7 days so you can download them, through links that are valid for 15 minutes.

Legal bases

We process personal data under the GDPR, specifically:

• Art. 6(1)(b) — performing the contract with you, and steps taken at your request before entering into it: your account, sign-in, the features of your plan, notifications you set up, billing and support.
• Art. 6(1)(f) — our legitimate interests, and those of our customers: providing the Service to the members a customer invites to its organisation, keeping the Service and accounts secure (sessions, audit log, rate limits, error reports), measuring API usage, delivering the website, answering correspondence, and establishing, exercising or defending legal claims.
• Art. 6(1)(a) — your consent: Google Analytics and Google Ads on the website and the docs, and the cookies they set. You can withdraw consent at any time; withdrawal does not affect the lawfulness of what happened before it.
• Art. 6(1)(c) — legal obligations, above all tax and accounting rules for invoices and payments.

Providing your email address is necessary to have an account. Everything else in your profile is optional.

How long we keep data

You can ask us to delete your account at any time by writing to [email protected] from the address the account uses.

Who we share data with

We do not sell personal data and do not share it for purposes not described here. The Service runs on servers we operate ourselves; the database, exported files and backups are held there. We use the following providers, which process data on our behalf under data processing agreements:

• Cloudflare, Inc. — delivery and protection of all our domains (traffic passes through Cloudflare encrypted, and Cloudflare terminates the HTTPS connection), and, where we use it, storage of backup copies that are encrypted before they leave our servers.
• Stripe Payments Europe, Ltd. — payment processing and subscription billing. Stripe is also an independent controller for some processing, such as fraud prevention, under its own privacy policy.
• Resend, Inc. — sending sign-in, invitation and alert emails.
• Google Ireland Limited — Google Workspace (our own email), Google sign-in if you choose it, and, with your consent, Google Tag Manager, Google Analytics and Google Ads.

If you sign in with Discord, Discord Inc. processes your sign-in under its own terms; the same applies to Google sign-in. Data may also be disclosed to public authorities entitled to it under the law, if they request it.

Transfers outside the European Economic Area

Cloudflare, Stripe, Resend and Google are part of groups headquartered in the United States, so data may be transferred outside the EEA. Each of them is certified under the EU–US Data Privacy Framework, the European Commission’s adequacy decision for the United States; where a particular transfer is not covered by it, it is based on the Commission’s standard contractual clauses. You can ask us which mechanism applies to a given provider.

Cookies and local storage

Cookies are small files a website stores in your browser. Polish law (Art. 399 of the Electronic Communications Law) and the GDPR allow them to be stored only after you have been told what they are for and have agreed, unless they are necessary to provide the service you asked for. The same applies to local storage.

On the website and the docs

Our own pages set no cookies. They store a few entries in your browser’s local storage, which are never sent to our servers. Google’s cookies are set only after you allow the corresponding purpose:

Until you choose, both purposes are treated as refused. You can change or withdraw your choice at any time with Cookie settings in the footer of every page.

In the web app and the API

The web app uses only what it needs to work. It sets no analytics or advertising cookies:

All of these are necessary for a feature you use, so they need no consent. You can delete cookies and block new ones in your browser’s settings — the browser decides the conditions under which information is stored on your device — but without the session cookie you cannot stay signed in.

Profiling and automated decisions

We do not make decisions about you that produce legal or similarly significant effects by automated means. Google may use the advertising data described above to personalise ads, but only if you have allowed the advertising purpose.

Your rights

In connection with our processing you have the right to:

• access your data and receive a copy of it,
• have inaccurate data corrected and incomplete data completed — your name and profile picture you can change yourself in Settings,
• have your data erased, including your whole account, where we have no basis to keep processing it,
• restrict processing,
• receive the data you gave us in a portable format and have it transmitted to another controller,
• object to processing based on our legitimate interests,
• withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise any of them, write to [email protected]. We respond without undue delay and at the latest within one month.

If you believe we process your data unlawfully, you have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl, or with the supervisory authority of the EU member state where you live or work.

Security

The Service is available over HTTPS only. Session tokens, sign-in links and API key secrets are stored only as hashes; authenticator secrets and notification channel details are encrypted; our servers’ disks are encrypted. Access to the systems and provider accounts that hold personal data is limited to the people who need it for the purposes above. You can protect your own account further with two-factor authentication and by reviewing your active sessions in Settings.

Children

The Service is intended for businesses and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, let us know and we will delete it.

Links to other sites

The Service links to and shows content from sites run by others, including the ticket marketplaces its data describes. Their processing is governed by their own policies.

Changes to this policy

We will update this policy when the Service, the providers we use or the applicable law change. The date of the last update is shown at the top of the page; if a change affects how we use the data of existing account holders, we will also tell them by email or in the app. The policy’s canonical location is https://status302.com/privacy-policy/.