Privacy Policy
Last updated:
1. Introduction
Rud1 (“we”, “us”, or “our”) operates the platform available at rud1.es (the “Service”). This Privacy Policy explains what personal data we collect, how we use it, and your rights under the General Data Protection Regulation (GDPR) and applicable Spanish data-protection law.
By creating an account or using the Service you agree to the practices described in this document. If you do not agree, please stop using the Service and contact us to delete your account.
2. Data We Collect
We collect only the data necessary to provide, secure, and improve the Service.
Account information
Name, email address, and a hashed copy of your password when you register. We never store passwords in plain text.
Device telemetry
Heartbeat signals sent by rud1 hardware units: CPU usage, memory usage, temperature, tunnel state, uptime, and USB device inventory. This data is tied to your device and organisation, not to an individual person.
Usage data
Log-ins, dashboard interactions, API key usage, and feature adoption metrics. We use this to understand how the product is used and where to improve it.
Audit logs
Actions taken within your organisation — device provisioning, config changes, invitations — are recorded with a timestamp and user ID for security and compliance purposes.
Assistant (RIA) conversations
Only if your organisation switches on the optional RIA assistant (it is off by default). What you type or dictate, and the account data the assistant looks up in order to answer — which can include member names and e-mail addresses, billing details, devices, alerts and variable history — is sent to OpenAI for processing (see section 5).
Cookies and session tokens
We set a secure, HttpOnly session cookie upon sign-in. We do not use third-party advertising cookies.
3. How We Use Your Data
- To create and maintain your account and organisation.
- To provide the core features of the Service: device management, secure tunnels, remote USB streaming, firmware updates, and alerting.
- To send transactional emails — registration confirmation, password reset, invitation, and alert notifications.
- To detect and prevent fraud, abuse, and security incidents.
- To comply with legal obligations (Spanish law, EU regulations).
- To improve the Service through aggregated, anonymised analytics.
We do not sell your data to third parties. We do not use your data for advertising.
4. Data Storage & Security
Our application servers and database are hosted in the European Union (Germany) and our e-mail server in France. Some of the providers listed in section 5 process data outside the European Union, as indicated there. We use industry-standard security measures including TLS in transit and strict access controls. Only employees who require access to personal data to perform their job are authorised to do so.
Passwords are hashed with bcrypt before storage. Session tokens are cryptographically random and invalidated on sign-out.
5. Third-Party Sub-processors
We share data with the following providers to run the Service. The table says what each one receives and where it is based.
| Provider | What for, and what it receives | Where |
|---|---|---|
| IONOS SE | Application servers, Postgres database and VPN relay hosting. Holds the data of the Service. | EU (Germany) |
| OVHcloud | Our own e-mail server: the e-mail we send and receive. | EU (France) |
| Cloudflare, Inc. | DNS for rud1.es and traffic protection for part of our services (for example the administration console). | US company, global network |
| Resend | Transactional e-mail delivery (account, invitations and alert e-mails). | US company; data region set in our account |
| Stripe | Payments for paid plans and the shop: name, e-mail, billing address, tax ID and payment details. Card data is entered on Stripe, not on our servers. | Ireland / United States |
| OpenAI, L.L.C. | Only for the optional RIA assistant: the text you type, dictated audio, generated images and the account data the assistant looks up to answer. OpenAI may keep it for up to 30 days under its API terms. | United States |
| Upstash, Inc. | Rate limiting and short-lived cache: IP addresses, request counters and cached look-ups. | US company; data region set in our database |
| ipwho.is | Approximate location of a device from its public IP address, for the administration map. | Third-party service |
| OpenStreetMap Foundation (Nominatim) | Turns an address you type into coordinates when you place a device on the map. | United Kingdom |
| GitHub, Inc. | Distribution of device firmware updates and of the desktop app: the downloading device or computer connects to GitHub. | United States |
This list is updated whenever a provider is added or removed.
6. Your Rights (GDPR)
Under the GDPR you have the following rights:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — request deletion of your account and associated data (“right to be forgotten”).
- Restriction — ask us to limit processing while a dispute is resolved.
- Portability — receive your data in a machine-readable format.
- Objection — object to processing based on legitimate interests.
To exercise any of these rights, email us at support@rud1.es. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish data-protection authority (AEPD) at www.aepd.es.
7. Data Retention
We retain your personal data for as long as your account is active. When you delete your account we will erase your personal data within 30 days, unless we are required to retain it for legal or compliance reasons (e.g., billing records for tax purposes are kept for 7 years).
Device telemetry is retained for 90 days by default and automatically purged thereafter. Audit logs are retained for 12 months.
8. Contact
For privacy enquiries, data requests, or to report a concern:
Rud1
rud1.es
Email: support@rud1.es