Backup Atlas
DeutschDownload

Privacy Policy

As of 9 October 2026

This policy covers the website backupatlas.app, the forms on it (beta sign-up, “Lost your key?”), the emails about your license, support by email, and what the Backup Atlas app sends over the internet.

Who is responsible

Production Build, Owner: Raphael Stäbler
Bischofsweg 31, 60598 Frankfurt am Main, Germany
Email: info@productionbuild.de

For questions about your data, and to have it deleted: support@backupatlas.app. More in the imprint.

In short

Visiting the website

When you open a page, your browser sends the usual information: your IP address, the time, the address requested, the browser’s User-Agent, your preferred languages and possibly the page you came from. We use it only to deliver the page and to run the service securely; it is processed for the request. We don’t keep access logs of the website: Amazon CloudFront’s access logging is off, and requests aren’t logged anywhere else.

The website is hosted by Amazon Web Services: its files are stored in Amazon S3 in Frankfurt am Main, Germany (region eu-central-1), and delivered by Amazon CloudFront, a worldwide network of servers that answers from a location near you.

The website stores nothing on your device.

Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is to provide the website securely and reliably.

The app’s update check

Backup Atlas asks backupatlas.app once a day whether there’s a newer version (and when you choose Check for Updates…). When there is an update, the app loads its release notes from backupatlas.app, and the update itself when you install it. These requests carry your IP address, the time and the headers your Mac sends: the User-Agent with the app’s name and version and the version of Sparkle (the update component), and your preferred languages. They carry nothing from the index, no file names, no license key and no identifier of your Mac. They are processed only to answer the request and aren’t logged.

You can turn automatic checks off in the menu bar under More › Check for Updates Automatically.

Backup Atlas sends nothing else over the internet. License keys are checked on your Mac, with no activation server. Backups on a NAS are read over your local network, not through us.

Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is to provide the app’s users with fixes and security updates.

Beta sign-up

What we store: your email address, the page’s language, the version of the consent wording you agreed to, the time and IP address of the sign-up, a hash of the confirmation link (not the link itself) and when we last sent a link. When you confirm: the time, the IP address and the version of the consent wording. When we let you into the beta: the time and the license ID.

Why: to send you the confirmation link (double opt-in), to send you your beta key once you’re in, and to contact you about the beta. We keep the two IP addresses and times in plain text as proof that you asked for the sign-up and confirmed it yourself.

Legal basis: your consent, Art. 6(1)(a) GDPR. For the proof of consent, Art. 6(1)(f) GDPR; our legitimate interest is being able to demonstrate consent (Art. 7(1) GDPR).

How long:

Withdrawing consent: you can withdraw your consent at any time by emailing support@backupatlas.app; we then delete your sign-up. Withdrawing doesn’t affect what was lawfully done before.

The form has a field people don’t see, which spam programs fill in. Whatever is in it isn’t stored.

Your license

When we issue you a key, we store: the license ID, the name the license is issued to (for beta keys, your email address), your email address, the edition, the issue date, the key itself, where it came from (your beta sign-up), the language, its status (active, refunded or revoked) and when we emailed it. The key itself contains the name the license is issued to and the license ID; it is signed with a key in AWS Key Management Service.

Why: to send you the key, to send it again when you ask (“Lost your key?”) and to help you with questions. Legal basis: Art. 6(1)(b) GDPR (the license you asked for). How long: as long as the license is valid.

“Lost your key?”

The form sends your email address and the page’s language. We use them to look up your valid licenses and email them to you. Nothing is stored for it apart from the counters against abuse (below). Legal basis: Art. 6(1)(b) GDPR.

Protection against abuse

To protect the forms from abuse, we count requests per IP address and per email address for an hour or a day. For that we store only a hash, made with a secret key, of the IP address (for IPv6, of its /64 network) or of the email address, never the value itself, with a counter. The entries expire after their time window. The functions behind the forms write technical logs (Amazon CloudWatch, Frankfurt am Main). They contain only pseudonymous data: an email address at most as a short hash, and license and sign-up IDs; never an email address, a name, a key, a link or an IP address. The logs are deleted after 30 days. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is running the forms securely.

Emails

We send the confirmation email and the emails with your key from support@backupatlas.app through Amazon Simple Email Service (SES) in Frankfurt am Main (eu-central-1). SES processes your email address and the email’s content to deliver it. We don’t track whether you open an email or click its links. If an email can’t be delivered or is reported as spam, a notice with the email address reaches us at support@backupatlas.app; we treat it like a support email (below).

Support by email

support@backupatlas.app is a Google Workspace mailbox. When you write to us, we process your email address, your message and anything you send with it, to answer you. Legal basis: Art. 6(1)(b) GDPR where it concerns your license, otherwise Art. 6(1)(f) GDPR (answering you). We keep emails as long as we need them for your request and as statutory retention obligations require.

Processors

Both process data on our behalf under a data processing agreement (Art. 28 GDPR). Where data is transferred to the United States, this relies on the adequacy decision for the EU-U.S. Data Privacy Framework, under which both companies are certified, and on the European Commission’s standard contractual clauses.

We don’t sell data or pass it on to anyone else. There are no automated decisions: a person decides who gets into the beta.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), the right to object to processing based on legitimate interests (Art. 21), and the right to withdraw consent at any time (Art. 7(3)). Write to support@backupatlas.app.

You can also complain to a data protection supervisory authority, for example the one responsible for us: the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit).

Changes

We update this policy when what we do changes. The date at the top says when it last changed.