Deployment Playbook — Privacy Policy

Version: 29 October 2026 — effective 29 October 2026

1. Who we are

Generation Y B.V. (KvK 83458034, Planciusplein 13A, 4812 SE Breda, the Netherlands, contact: info@genydev.nl) operates Deployment Playbook ("Service"). This policy explains how we process personal data under the General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act (UAVG).

2. Our role

Controller for data about our customers' account holders and billing contacts, website visitors, and for our own administration.
Processor for personal data that customers put into their workspaces (playbooks, deployments, approvals, audit logs). For that data the customer is the controller and our Data Processing Agreement applies.

3. What we process, why, and on which legal basis

Data	Purpose	Legal basis (Art. 6 GDPR)
Account data: name, email address, password (stored only as a bcrypt hash), workspace memberships and roles	Providing accounts and access control	Performance of contract (6(1)(b))
Workspace content entered by users	Providing the Service (as processor)	Customer's instructions / contract
Approval and audit logs (who did what and when, e.g. approvals, password changes)	Security, accountability, four-eyes approvals	Contract and legitimate interest in security (6(1)(b),(f))
Social sign-in (if you choose Google, GitHub or Microsoft): provider name, provider account ID, email address and whether it is verified, display name	Signing you in and linking to your account	Performance of contract (6(1)(b))
Company SSO (if your organisation set it up): identity provider, SAML/OIDC subject ID (NameID / sub), email, display name, and the workspace's SSO configuration and verified email domains	Signing in via your organisation's identity provider; adding you to its workspace	Contract with your organisation (6(1)(b)); legitimate interest (6(1)(f))
API tokens (stored only as a SHA-256 hash; the token is shown once)	Programmatic access	Contract
Technical data: IP address, browser, session cookies, server logs	Security, abuse prevention, operating the Service	Legitimate interest (6(1)(f))
Billing data: company name, billing contact, VAT number, subscription status, invoices	Billing and tax administration	Contract; legal obligation (6(1)(c))
Payment card details	Payment	Handled directly by Stripe; we do not receive or store full card numbers
Support correspondence	Answering questions	Contract / legitimate interest

We do not sell personal data and do not use it for profiling or automated decision-making with legal effects.

4. Cookies

We only use strictly necessary cookies for authentication and sessions (the session cookie, and short-lived cookies that protect social sign-in and SSO). We do not use analytics or marketing cookies, so no consent banner is needed. If that ever changes, we will ask for consent first.

5. Recipients and subprocessors

Amazon Web Services EMEA SARL — hosting (AWS Amplify) and database (Amazon Aurora PostgreSQL), region eu-central-1 (Frankfurt, Germany).
Stripe Payments Europe Ltd. — payment processing and invoicing; Stripe is an independent controller for certain payment data under its own privacy policy.
Google, GitHub and Microsoft — only if you choose to sign in with them: they receive the sign-in request and return your identity to us. They are independent controllers for their own login services.
Your organisation's identity provider — only if your organisation set up company SSO; it is engaged by your organisation, not by us.
We currently use no email delivery, error monitoring or analytics provider.
Our accountant and authorities where legally required.

6. International transfers

Primary hosting is in the EU (Frankfurt). Some providers (e.g. AWS, Stripe, Google, GitHub, Microsoft) are US-related companies; where data is transferred outside the EEA we rely on the EU–US Data Privacy Framework where the provider is certified and/or Standard Contractual Clauses.

7. Retention

Account and workspace data: for the duration of the agreement; after termination a 30-day export window, then deletion within a further 30 days. Backups expire automatically within 35 days.
Audit logs: for the lifetime of the workspace.
Server/security logs: at most 90 days.
Billing and invoice records: 7 years (Dutch fiscal retention obligation, art. 52 AWR).
Support email: up to 2 years after the last contact.

8. Security

We use TLS encryption in transit, encryption of the production database at rest, application-level AES-256-GCM encryption of stored third-party secrets (SSO and webhook secrets), bcrypt password hashing, hashed API tokens and session tokens, role-based access control, HMAC-signed webhooks, multi-factor authentication on administrative accounts, and four-eyes approvals for sensitive actions. See the DPA for details.

8A. Data Protection Officer

We are not required to appoint a Data Protection Officer. Privacy questions go to info@genydev.nl.

9. Your rights

You have the right to access, rectification, erasure, restriction, data portability and to object, and to withdraw consent where processing is based on consent. Contact info@genydev.nl; we respond within one month. For workspace content, please contact the organisation that controls the workspace; we will assist them. You may lodge a complaint with the Dutch Data Protection Authority, Autoriteit Persoonsgegevens (www.autoriteitpersoonsgegevens.nl), or the authority in your EU country.

10. Changes

We may update this policy; material changes are announced by email or in-app.