# Privacy Policy, civo-cloud-manager.app website

Canonical URL: <https://civo-cloud-manager.app/privacy/>

Effective date: October 2026  
Last updated: October 18, 2026

Scope of this notice

This policy covers the marketing website **civo-cloud-manager.app** only, what happens when you load the page in your browser. The privacy policy for the **CivoCloudManager macOS app** itself (Civo API key in macOS Keychain, direct connections from the app to Civo, the user's Kubernetes API endpoint and Object Store, IP-detection providers and Apple StoreKit) is the separate document shown on the App Store listing and bundled inside the app.

## 1\. Service provider

The website civo-cloud-manager.app is offered under the **DigitalFreedom** brand. The data controller (Art. 4(7) GDPR) is:

DigitalFreedom Global LLC (trading as DigitalFreedom)  
30 N Gould St, Ste N · Sheridan, WY 82801 · United States

Data protection inquiries: [data-protection@digitalfreedom.co.za](mailto:data-protection@digitalfreedom.co.za)  
General inquiries: [hello@digitalfreedom.co.za](mailto:hello@digitalfreedom.co.za)

CivoCloudManager is an independent native macOS client for the Civo Cloud platform operated by [Civo Ltd.](https://www.civo.com/) “Civo” is a trademark of Civo Ltd.; the publisher of CivoCloudManager is not affiliated with Civo Ltd.

## 2\. GDPR as the global baseline

We adopt the EU General Data Protection Regulation (GDPR) as the strictest baseline and apply it as a **global floor**, every visitor, in every country, benefits from at least the GDPR-level protections set out here. We additionally respect any applicable local data-protection law (UK GDPR, Swiss FADP, CCPA/CPRA, PIPEDA, Australian Privacy Act, LGPD, APPI, PIPA, DPDP Act, POPIA, etc.); where it is more protective for you, the more protective standard applies.

## 3\. What we collect on this website

### 3.1 Hosting (server log data)

The site is hosted on **GitHub Pages**. When you load a page, GitHub processes:

-   IP address
-   browser user-agent string
-   requested URL and timestamp
-   referrer URL (where available)

Purpose: deliver the page and protect against abuse (rate limiting, anti-DDoS). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a secure website). Retention: per GitHub's policies. International transfer is covered by the EU-US Data Privacy Framework. See [GitHub's General Privacy Statement](https://docs.github.com/site-policy/privacy-policies/github-general-privacy-statement).

### 3.2 Browser local storage

The site sets up to three keys in your browser's `localStorage`, and nothing in `sessionStorage`:

-   `theme`, your light/dark preference, only when you actively switch the theme. No personal data, never transmitted to a server.
-   `cookie-consent`, your decision on the cookie banner (`granted` or `denied`). Set when you click Accept or Decline.
-   `locale-explicit`, the value `1`, once you pick a language in the language menu, follow the language suggestion on a start page or close it. It only stops that suggestion from appearing again. No personal data, never transmitted to a server.

You can clear these entries any time in your browser settings. Legal basis: § 25(2) No. 2 TDDDG (strictly necessary for the user-chosen function).

### 3.3 Google Analytics 4, only after consent

Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (for users in the EU).

On this website, and only after you consent in the cookie banner, Google Ireland Limited receives data for Google Analytics 4: pseudonymous cookie identifiers, the pages you view, information about your device and browser, and the IP address your browser sends with each request. Purpose: measuring visits and page views of the website. Location: Ireland, with onward transfer to the United States (see section 5).

**Consent Mode v2 only in its basic form.** In its advanced form the tag loads before you choose and, while consent is denied, still sends cookieless pings to the vendor’s endpoint. § 25(1) TDDDG governs the access to your device, not merely what is transmitted afterwards, so **no tag fires and no tag loads before consent**. That is the basic form. Before you consent, and after you decline, this website loads no Google script and sends no data to Google, including no cookieless pings.

| Vendor | Cookie / tracker | Purpose | Type | Category | Retention | Consent |
| --- | --- | --- | --- | --- | --- | --- |
| Google (GA4), Google Ireland Ltd. | `_ga`, `_ga_<container-id>` | Distinguish visitors, measure sessions and page views | 1P  | Analytics | up to 24 months | Yes |

Legal basis: consent, Art. 6(1)(a) GDPR, and § 25(1) TDDDG for the access to your device. There is no other legal basis for Google Analytics on this website.

Third-country transfer (Google): Google transfers to the United States. The transfer rests on the EU Standard Contractual Clauses together with Google’s participation in the EU-US Data Privacy Framework, whose current status is to be verified before each release of this Policy.

You may withdraw consent at any time via the “Cookie settings” link in the footer, by choosing Decline. The site then deletes the `_ga` cookies and reloads the page without Google Analytics. Withdrawal of consent does not affect the lawfulness of processing before withdrawal.

### 3.4 What we do *not* do on this website

-   no marketing tracking pixels (Meta, LinkedIn, X)
-   no third-party fonts (Geist is self-hosted from this domain, no connection to Google Fonts)
-   no payment or checkout, purchases happen on Apple's Mac App Store
-   no account creation, login or contact form on this website
-   no newsletter signup on this website
-   no audio, video or session-replay recording

## 4\. Sub-processors used by this website

For the website itself, the following parties may process data on our behalf or as independent controllers:

| Party | Role | Location |
| --- | --- | --- |
| GitHub, Inc. | Static site hosting (GitHub Pages), DNS routing, abuse protection | USA (EU-US DPF) |
| Google Ireland Ltd. (Google Analytics 4) | Website analytics, only after consent in the cookie banner; nothing is loaded or sent before consent | Ireland, with onward transfer to the United States under EU SCCs and the EU-US DPF |
| INWX GmbH & Co. KG | DNS hosting for the `civo-cloud-manager.app` zone | Germany |

**CivoCloudManager (the macOS app) has no publisher backend.** When you use the app, it talks directly to (a) the Civo REST API at `api.civo.com` with your API key, (b) your own Kubernetes API endpoint via client-certificate mTLS, (c) your own Object Store endpoint over S3 with AWS Signature V4, (d) three public IP-detection services (`ipify.org`, `ifconfig.me`, `icanhazip.com`) for firewall rule scoping, and (e) Apple's StoreKit for the In-App Purchase. DigitalFreedom Global LLC does not operate any server in the loop and receives no data from your use of the app.

## 5\. International data transfers

Transfers to the United States by GitHub are covered by the EU-US Data Privacy Framework (adequacy decision of 10 July 2023, Art. 45 GDPR) and additionally by EU Standard Contractual Clauses where required. We rely on the provider's contractual safeguards and on TLS encryption in transit. The transfer basis for Google Analytics is set out in section 3.3.

## 6\. Your rights

Under GDPR you have the right to:

-   access the personal data we hold about you (Art. 15 GDPR)
-   rectification (Art. 16 GDPR)
-   erasure (Art. 17 GDPR)
-   restriction of processing (Art. 18 GDPR)
-   data portability (Art. 20 GDPR)
-   object to processing on grounds of legitimate interest (Art. 21 GDPR)
-   withdraw consent at any time, with effect for the future (Art. 7(3) GDPR)
-   lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority is the one of your habitual residence, your place of work, or the place of the alleged infringement; in the United Kingdom this is the Information Commissioner's Office (ICO). The controller has no establishment in the Union, so the one-stop-shop mechanism under Art. 56 GDPR does not apply

To exercise any of these rights, email [data-protection@digitalfreedom.co.za](mailto:data-protection@digitalfreedom.co.za).

### 6.1 Additional regional rights

-   **California (CCPA/CPRA):** right to know, delete, correct, opt out of sale/sharing, limit use of sensitive personal information, and non-discrimination. We do not sell or share personal information for cross-context behavioural advertising.
-   **UK (UK GDPR):** equivalent rights to the EU GDPR list above. Supervisory authority: Information Commissioner's Office (ICO).
-   **Switzerland (FADP):** equivalent rights; supervisory authority: FDPIC (Bern).
-   **Canada (PIPEDA):** access, challenge accuracy, withdraw consent.
-   **Australia (Privacy Act):** access, correction, complaint to OAIC.
-   **Brazil (LGPD):** confirmation, access, correction, anonymisation/blocking/deletion, portability, information about shared data, consent revocation.

## 7\. Children's privacy

This website is not directed at children. We do not knowingly collect personal data from children under 16 (or the applicable age of consent in your jurisdiction).

## 8\. Changes to this policy

We may update this policy when the website's data flows change (for example if new analytics or hosting providers are introduced). The current version is always available at this URL with the effective date at the top.

## 9\. Contact

DigitalFreedom, a brand of DigitalFreedom Global LLC  
30 N Gould St, Ste N · Sheridan, WY 82801 · United States  
Data protection: [data-protection@digitalfreedom.co.za](mailto:data-protection@digitalfreedom.co.za)  
General: [hello@digitalfreedom.co.za](mailto:hello@digitalfreedom.co.za)

* * *

© 2025-2026 DigitalFreedom Global LLC. All rights reserved.