Privacy Policy

Effective date: 2026-10-06

Introduction

This Privacy Policy describes how Sterile Networks (operated by SaaStack LLC) collects, uses, stores, and shares personal data when you use our website, dashboard, and Services.

0. Scope and Roles

This Policy applies to:

• Our public website and marketing communications
• Registration, authentication, and account management
• Dashboard and support flows
• Network and security operations tied to customer accounts

For account/billing/support data Sterile often acts as Controller. For network traffic processing performed on behalf of a Customer, Sterile generally acts as Processor.

1. Contact

For privacy requests: open a support ticket from your dashboard labeled "privacy request" or contact: support@sterile.network

2. Information We Collect

2.1 Account & Profile

• Username, email, full name, company, phone, address, VAT/tax ID
• Password hashes, 2FA status, API keys, profile images (S3 keys/metadata)

2.2 Billing & Payments

• Stripe customer and subscription references; we do not store raw card numbers or CVC.

2.3 Service & Infrastructure Data

• Tunnel configurations, assigned IPs, edge identifiers, provision timestamps, subscription plan metadata.

2.4 Authentication & Security

• Sign-in metadata (IP addresses, timestamps), session tokens, anti-bot results (e.g., Turnstile)

2.5 Support & Content

• Support tickets, comments, attachments, knowledge base and blog content created by authorized users

2.6 Device & Site Data

• Browser and device metadata, and the cookies and local storage needed to keep you signed in and secure
• With your consent: product analytics events, and support-chat conversations (see Section 5)
• Without your consent: an anonymous count of visits, made without cookies or a persistent identifier (see Section 5)

2.7 Operational & Security Logs

• Network traffic metadata and logs (source/destination IPs, packet headers, metrics), error and performance telemetry, security event records

3. How We Use Information

We use personal data to:

• Provide, operate, and improve the Services
• Authenticate and secure accounts
• Detect and mitigate attacks and abuse
• Manage billing, invoices, and support requests
• Send transactional communications, and marketing messages only where you have opted in
• Comply with legal obligations and law enforcement requests

We do not sell personal data.

4. Retention

• Network and traffic logs: retained for up to 30 days by default
• Account and billing records: retained for the lifetime of the account plus legally required retention periods
• Support data and attachments: retained for support/history purposes subject to deletion requests and legal obligations

5. Cookies & Similar Technologies

We use cookies and similar browser storage, such as local storage. Until you choose otherwise, only the necessary ones are used.

Your choice. On your first visit we ask which optional categories you allow; refusing is as easy as accepting. We keep your choice in a cookie (sn_consent) for 12 months. We ask again after that, or sooner if we add a new kind of optional technology. You can change your choice at any time through Cookie settings at the bottom of the website. If your browser sends a Global Privacy Control signal, we treat it as refusing all optional categories and do not ask.

Which features you see. When you are signed in, we send PostHog your account ID, whether you are Sterile staff, and your current workspace's ID, type and your role in it, so that it can decide which product features your account sees — for example during a gradual rollout of a new feature. These details are used only for that decision, contain no contact details, and are not recorded as analytics. This is part of providing the Service and does not depend on your cookie choice.

Product tests. We sometimes compare two versions of a page, such as different wording, to see which works better. Only visitors who have accepted analytics take part; everyone else sees the standard version.

6. Sharing and Sub-processors

We share personal data only as necessary to operate the Service:

• Payment processors
• Object storage providers for attachments
• Anti-bot providers
• Our product analytics and feature-management provider (PostHog)
• Our live support chat provider (Crisp), when you use the chat
• Our email provider (Fastmail), for messages you send to or receive from us
  We will disclose data to comply with legal process and protect rights and safety. See Sub-processors for full details.

7. Security

We encrypt databases and stored logs at rest. Administrative access is protected by credentials and mandatory 2FA. Management and dashboard access use HTTPS. Note: GRE traffic is not re-encrypted by Sterile; Sterile does not perform TLS termination unless explicitly configured.

8. International Transfers

Data may be processed and stored in countries other than your own, including the United States (for example by our analytics provider). Where required, appropriate safeguards (such as Standard Contractual Clauses or the EU–US Data Privacy Framework) are used.

9. Your Rights

Depending on jurisdiction, you may have rights including:

• Access and obtain a copy of personal data
• Correction of inaccurate data
• Deletion of data (subject to legal exceptions)
• Restriction or objection to processing
• Data portability
  To exercise rights, open a support ticket and allow Sterile to verify identity or authority.

10. Children

Services are not intended for children under 13 (or higher age as required locally). We do not knowingly collect personal data of children.

11. Changes to Policy

Material changes will be posted with an updated effective date. Continued use constitutes acceptance.

12. Contact

support@sterile.network