What we hold, and the much longer list of what we do not.

This website

portiger.com is a set of static files. It sets no cookies and runs no analytics. Two pages carry a form — the contact form and the early-access list — and both post to our own server on this domain, to nobody else. Nothing you do here is recorded beyond what you type into one of those two forms and the ordinary web-server log described below.

The server keeps a request log: the requesting IP address, the time, the page, the referrer and the browser's user-agent string. It exists to keep the site up and to notice abuse, and it is not joined to anything else.

Those two form pages load one piece of third-party code, and only when the bot check is switched on: the Cloudflare Turnstile widget. It sees your IP address and signals from your browser in order to decide that you are a person rather than a script, and it is told nothing about what you typed. It is the only script on this site that does not come from this domain, and it is on the subprocessor page.

Your account

An account at portiger.com/account holds your email address, the name and billing address you enter, your subscriptions and the licences issued to you. You create it deliberately, and everything in it is something you typed or bought.

Payment details are not among them. Polar Software, Inc. is the merchant of record and holds your name, e-mail address, billing address and payment method for a purchase; what reaches us is the record that the purchase happened, never the card.

The licence check

A licensed installation contacts the licence server on a schedule. That request carries, in full:

• the licence it currently holds
• the activation key it was issued against
• the public half of the keypair the installation generated, and a proof that it holds the private half

The response carries the plan, the limits, the feature list and a new expiry. The connection itself has a source IP address, and like any server that answers a request we see it and it lands in the server log.

What is never sent

Portiger reports none of the following to us, and no setting turns it on:

• your stacks, services, container names or compose files
• your images or the registries you pull them from
• environment variables, secrets or credentials of any kind
• logs, metrics or scan results
• your servers' hostnames or addresses
• your users, their names or their email addresses
• anything belonging to your own customers

A scan runs on your machine and its findings stay there. If you want us to see one, you have to send it.

How long any of it is kept

Server logs, including licence-server logs, are kept for 30 days and then deleted. Account and licence records are kept while the account exists, and invoices for as long as tax law requires us to keep them, which is longer than we would otherwise choose.

Legal basis

Under the GDPR: running your account and issuing licences is performance of a contract; keeping invoices is a legal obligation; keeping short server logs to defend the service is a legitimate interest. Turkish KVKK recognises the equivalent grounds and we apply the same practice under both.

Your rights, and how to use them

Write to privacy@portiger.com to ask what we hold about you, to correct it, to get a copy or to have it deleted. Deleting an account ends the subscriptions attached to it, so we will say so before doing it rather than after.

The one thing we cannot do is reach into your installation. If the data you want removed is on your own servers, it is yours to delete and we have no way in.

The formal notice

This page is the plain-language version. The binding text — the controller's identity, the legal basis for each purpose, the retention periods and the full list of rights under KVKK and the GDPR — is the privacy policy in the portal, and where the two differ that one is what counts. The terms of service sit alongside it.