Privacy Policy
Last updated: 19 September 2026
This policy explains how BPW Consulting OÜ processes personal data in connection with the inwardis.com website and the Inwardis licensing and billing services. It is written to be read, not skimmed past — it is short because we collect little.
1. Who is responsible
The data controller is BPW Consulting OÜ, registry code 10560025, Maakri 23A, 10415 Tallinn, Estonia. Contact: contact form or the email address shown there.
2. The product itself: we never see your data
Inwardis is self-hosted software. It runs entirely on your infrastructure, contains no telemetry and no phone-home functionality — licensing included — and makes no connections to us. For everything you model in Inwardis, you (or your organization) are the data controller, not us. This policy therefore concerns only the website and our billing services.
3. What we process, and why
| When | Data | Purpose & legal basis |
|---|---|---|
| You request a trial key | Email address | Issuing and delivering your trial license and download link — steps prior to a contract, Art. 6(1)(b) GDPR |
| You buy a license | Email, name/company, payment data (handled by Stripe — we never see card numbers) | Performing the contract, Art. 6(1)(b); keeping accounting records, Art. 6(1)(c) |
| You use the contact form | Email, optional name, your message | Answering you — our legitimate interest in responding to inquiries, Art. 6(1)(f) |
| You visit the site | Technical data (IP address in server logs; anonymous, cookieless page-view counts) | Operating and securing the site and understanding aggregate usage — legitimate interest, Art. 6(1)(f) |
4. Cookies: none
This site sets no cookies and uses no cross-site tracking. Our analytics (GoatCounter) is cookieless and collects no personal profiles — which is why you see no consent banner: there is nothing to consent to.
5. Who else is involved
We use a small number of service providers who process data on our behalf or receive technical requests:
- Stripe (Stripe Payments Europe Ltd., Ireland; with transfers to Stripe Inc., USA under EU Standard Contractual Clauses) — payment processing and subscription management.
- UpCloud (UpCloud Ltd., Finland) — hosting for this website and our billing service, in EU data centres.
- Migadu (Migadu Mail, Switzerland — EU adequacy decision) — our mailboxes, where contact-form messages and email replies live, and the sending of transactional email (your license key, download link, receipts).
- GoatCounter — cookieless, privacy-focused page-view analytics.
- Content delivery — this site loads its styling framework and, on
production, the analytics script from third-party CDNs (
cdn.tailwindcss.com,gc.zgo.at); your browser sends those hosts your IP address as part of the request, as with any web resource.
We do not sell personal data, and we do not share it with anyone beyond the providers above and cases where the law requires it.
6. How long we keep it
- Billing and license records (including trial issuance): 7 years, as Estonian accounting law requires.
- Contact messages and their delivery records: up to 2 years, then deleted.
- Server logs: rotated on a short technical cycle.
- Analytics: aggregate counts only; no personal profiles are kept.
7. Your rights
You may request access to, rectification or erasure of your personal data, restriction of processing, data portability, and you may object to processing based on legitimate interest. Write to us via the contact form. Erasure has one limit: records we must keep under accounting law are kept for that period.
You also have the right to lodge a complaint with a supervisory authority — in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).
8. Changes
If this policy changes, the new version is published here with an updated date. Material changes to how we process existing customers' data will be announced by email.