1who we are
The website hangar.computer is run by [TO CONFIRM: legal entity name] (“Hangar”, “we”, “us”). For the personal data described in this policy, we are the controller under the EU General Data Protection Regulation (GDPR). That means we decide why and how this data is used, and we are responsible for it.
2what we collect and why
You can read this website without telling us who you are. We collect personal data in two ways: what you type into a form or send us by email, and the technical data your browser sends when it loads a page.
| Data | Why we use it | Legal basis (GDPR) |
|---|---|---|
| Name, work email, company, role and your message, from a form | To reply, arrange a demo or call, and talk about access, pricing or a partnership | Steps you ask for before a contract, Art. 6(1)(b). Our legitimate interest in answering business enquiries, Art. 6(1)(f). [TO CONFIRM: basis for each form] |
| Emails you send us, and our replies | To answer you and keep a record of the conversation | Art. 6(1)(b) or Art. 6(1)(f), depending on the request |
| IP address, browser and device type, page requested, time, referring page | To deliver the pages, keep the site secure and fix errors | Our legitimate interest in running a secure website, Art. 6(1)(f) |
| Your console address, on the sign-in page | To remember where your own Hangar console is, so you don’t retype it | Stored only in your browser. See section 6 |
| Records needed for tax and accounting, if you become a customer | To meet our legal duties | Legal obligation, Art. 6(1)(c) |
Where we rely on legitimate interests, we have weighed them against your rights. You can object at any time (see section 10).
We don’t sell personal data, we don’t use it for advertising, and we don’t make decisions about you by automated means alone. We won’t add you to a newsletter or marketing list because you filled in a form. [TO CONFIRM: whether follow-up marketing emails are planned; if so, we will ask for consent separately]
3forms
The site has five forms. Each asks only for what we need to answer that request. Fields marked as required are needed to reply; without them we can’t handle the request.
| Form | What it’s for | What it collects |
|---|---|---|
| Request access | Joining early access | Name, work email, company, role, a description of what you want to run |
| Book a demo | Arranging a demo call | Name, work email, company, role, what you’d like to see |
| Contact | General questions | Name, work email, company, your message |
| Find a partner | Finding an implementation partner for your project | Name, work email, company, role, a description of the process |
| Become a partner | Applying to be an implementation partner | Name, work email, company, role, a description of your work |
[TO CONFIRM: final field list for each form once the pages are done]
Form entries are sent to [TO CONFIRM: where leads are stored, e.g. a CRM, an email inbox or a Vercel function with a database]. Only the people at Hangar who handle enquiries can read them.
Please don’t put passwords, logins, health data or other sensitive information in the free-text fields. We don’t need them to reply.
The sign-in page is not a form we receive. It takes you to the console on your own server, and your username and password go to that console. [TO CONFIRM: that sign-in never passes credentials through hangar.computer]
4hosting and logs
The website is a static site hosted by Vercel Inc., which delivers the pages from its network of servers around the world. When your browser asks for a page, Vercel’s servers receive your IP address, the page address, the time, your browser and device type and the referring page. They need this to send the page to you and to protect the service from abuse.
Vercel keeps request logs for a limited time that depends on our plan, and we can see them to fix errors and investigate attacks. Vercel acts as our processor under its data processing agreement.
- [TO CONFIRM: Vercel plan and how long its logs are kept]
- [TO CONFIRM: that Vercel Web Analytics and Speed Insights stay switched off; if either is turned on, this section and section 6 must change]
5fonts
The pages use two typefaces, Geist and IBM Plex Mono, which load from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), a service of Google. To fetch them, your browser connects to Google’s servers, which receive your IP address, your browser type and the address of the page you’re on. Google says that requests to the Google Fonts service don’t set cookies.
We use Google Fonts so the site looks the same on every device. Our legal basis is our legitimate interest in a consistent, readable website, Art. 6(1)(f).
[TO CONFIRM: Google’s role, independent controller or processor. Before launch, consider serving the fonts from our own host, so that no visitor data goes to Google; this section could then be removed]
6cookies and local storage
We don’t use analytics, advertising or tracking cookies, and no third party tracks you on this site. [TO CONFIRM: run a cookie and storage scan before launch]
We use one functional item in your browser’s local storage:
| Name | What it does | How long it stays |
|---|---|---|
| Console address [TO CONFIRM: storage key name] | Remembers the address of your Hangar console on the sign-in page, so you don’t type it each time. It stays in your browser and isn’t sent to us. | Until you clear it, or remove it on the sign-in page [TO CONFIRM: whether the sign-in page offers a “forget” option] |
You can delete local storage and cookies at any time in your browser settings. The site works without it; you’ll just need to type your console address again.
If we add analytics or any other non-essential cookies later, we’ll update this policy first and ask for your consent where the law requires it. [TO CONFIRM: whether storing the console address needs consent, or counts as strictly necessary for a service you asked for]
7how long we keep data
We keep personal data only as long as we need it for the reason we collected it, then delete it or make it anonymous.
| Data | How long |
|---|---|
| Form entries and emails that don’t lead to a contract | [TO CONFIRM: retention period after the last contact] |
| Form entries and emails that lead to a contract | For the length of the contract, then [TO CONFIRM: period for possible claims] |
| Partner applications | [TO CONFIRM: retention period] |
| Tax and accounting records | As long as tax and accounting law requires [TO CONFIRM: period under the applicable law] |
| Hosting request logs | As set by Vercel for our plan [TO CONFIRM: period] |
| Console address in your browser | Until you clear it |
If you object or ask us to delete your data, we’ll delete it sooner, unless the law requires us to keep it.
9international transfers
Vercel and Google are US companies, so data from this site may be processed outside the European Economic Area. When that happens, we rely on one of the safeguards the GDPR allows:
- the EU–US Data Privacy Framework, for US companies certified under it;
- the European Commission’s standard contractual clauses, included in the provider’s data processing agreement.
[TO CONFIRM: each provider’s certification and the safeguard used for each one]
You can ask us for a copy of these safeguards using the contact details in section 11.
10your rights
Under the GDPR you have these rights over your personal data:
- AccessArt. 15
- Ask whether we hold data about you and get a copy.
- CorrectionArt. 16
- Have wrong or incomplete data corrected.
- ErasureArt. 17
- Have your data deleted when we no longer need it, or when we have no legal basis to keep it.
- RestrictionArt. 18
- Ask us to stop using your data while a question about it is settled, and only keep it.
- PortabilityArt. 20
- Get the data you gave us in a common, machine-readable format, or have it sent to someone else.
- ObjectionArt. 21
- Object to our use of your data based on legitimate interests. If you object to direct marketing, we stop.
- Withdraw consentArt. 7(3)
- Where we rely on your consent, withdraw it at any time. This doesn’t affect what we did before.
- ComplaintArt. 77
- Complain to a data protection authority. In Poland that is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. You can also complain in the EU country where you live or work. [TO CONFIRM: lead supervisory authority, which depends on where the entity is established]
How to use them
Email our data protection contact (section 11) and say which right you want to use. We reply within one month. For complex or numerous requests we can extend this by up to two more months, and we’ll tell you if we do. Using your rights is free. We may ask you to confirm your identity first, so that we don’t give your data to someone else.
11contact
For anything about this policy or your data, write to us.
You can also use the contact form, but for a request about your data, email is simpler.
12changes to this policy
We’ll update this policy when the website, our providers or the law change, for example when the forms are connected or if we add analytics. The date at the top shows the latest version. If a change affects how we use data you’ve already given us, we’ll tell you by email before it applies. [TO CONFIRM: whether to keep earlier versions available]
13the Hangar product
This policy covers the website only. Hangar itself runs on the customer’s own infrastructure: their server, a VM in their own cloud account or a workstation. The desktops, files, recordings, the click-by-click log and the vault for logins stay there. The website doesn’t receive or process any of it.
For data inside a Hangar installation, the customer is the controller and decides how it is used. The customer’s own privacy notices and rules apply to it.
[TO CONFIRM: whether we can access customer data at any point, for example during remote technical setup or support, and in what role] [TO CONFIRM: whether the product sends anything back to us, such as licence checks, update checks or usage data]
Customers can get a data processing agreement (DPA) that covers any processing we do for them. [TO CONFIRM: DPA availability, terms and which plans include it]