LEGAL

Privacy Policy

This policy covers karshipta.com, the hosted service operated by NIKX Technologies B.V. ("NIKX", "we", "us"), a company based in the Netherlands. It does not cover the open-source Karshipta console or gateway when you self-host them on your own infrastructure - in that case, no data reaches us at all, and this policy does not apply.

Last updated: August 2026

Who we are

NIKX Technologies B.V. is the data controller for karshipta.com.

Registered office: Lambertus Zijlplein 66, 1067JS, Amsterdam, the Netherlands. Contact for privacy questions or to exercise your rights: [email protected].

What we collect, and why

Account data

Signing in uses Firebase Authentication (Google Ireland Ltd.). If you sign in with Google, we receive your email address, display name, and profile photo URL. If you use an email magic link instead, we only receive the email address. This is used to create and secure your account. Legal basis: performance of a contract (you can't have an account without it).

Guest sessions

Browsing the public map without signing in creates a silent, read-only session. This session is not tied to any personal identifier and cannot issue commands to any ward.

Gateway and ward data

When you connect a gateway, we store the gateway's name and pairing state. The connection between your gateway and our relay is end-to-end encrypted (Noise XX); we never have plaintext access to your ward's command or telemetry stream, only pairing metadata needed to route the encrypted tunnel. If you mark a ward public, its telemetry is sanitized before it reaches the public map: delayed, coordinate-decimated, and with its home/launch position never exposed. Private Fleet subscribers are excluded from the public feed entirely, account-wide.

Billing data

Subscriptions are processed by Stripe. We store your subscription tier and Stripe customer/subscription identifiers; we never receive or store your card details. See Stripe's privacy policy.

Analytics and cookies

We use Firebase Analytics (Google) to understand aggregate product usage, and a session cookie set by Firebase Authentication to keep you signed in. We do not use third-party advertising cookies or sell your data.

Sub-processors

We rely on the following providers to run karshipta.com. Each processes a defined subset of the data above on our behalf, under their own data processing agreement with us.

· Google / Firebase - authentication, analytics
· Stripe - subscription billing
· Hetzner Online GmbH - application and database hosting

Data retention

We keep account and fleet data for as long as your account is active. If you delete your account, we delete your account data within 30 days, except where we're required to keep billing records longer for tax and accounting purposes.

Your rights

Under the GDPR, you have the right to access, correct, delete, restrict, or export your data, and to object to processing based on legitimate interest. To exercise any of these, email [email protected]. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Children

Karshipta is not directed at children under 16, and we do not knowingly collect data from them.

Changes

If we make material changes to this policy, we'll update the date above and, for significant changes, notify account holders directly.