DirectoryBrain hosts directory websites. That gives us two different jobs at once, and this policy keeps them apart.
For our customers, the people who buy a site from us, we decide what we collect and why. In data protection terms we are the controller.
For the people who use those sites, the members and visitors of a directory somebody built with us, we only hold what passes through the site on its owner's behalf. There we are a processor, and the site's owner is the controller. Section 10 covers that case.
1. Who is responsible
DirectoryBrain is a service of Keltikos Software Ltd, registered in Cyprus, company number HE 496195, registered office Onisiforou Center, Floor 2, Neofytou Nikolaidi & Theodorou Kolokotroni, Agios Theodoros, 8011 Paphos, Cyprus.
We process personal data under the UK and EU General Data Protection Regulation and, in Cyprus, Law 125(I)/2018. Keltikos Software Ltd also publishes a company-wide privacy policy. Where the two overlap, this one is the more specific and describes the DirectoryBrain service; nothing here is intended to contradict it.
2. What this policy covers
The DirectoryBrain website at directorybrain.com, the customer panel at app.directorybrain.com, the control plane that runs behind them, and the websites we host for customers on dirbrain.com and on their own domains.
3. What we collect and why
- Your account. Email address and name. We need them to identify you and to send you a sign-in link. We sign you in by emailed link rather than a password, so we never hold one.
- Billing. Your plan, subscription state and invoices. Card details are entered with Stripe and handled by them. We never see or store a card number.
- Your sites. Hostnames, domain names you connect, which server a site is on, its software versions, when it last checked in, when it was last backed up, and the record of actions taken on it. This is what lets the service run a site, update it and prove it was backed up.
- Traffic figures. Page load counts for your own site, with the country and browser of visitors in aggregate. These come from Cloudflare Web Analytics, which sets no cookies and does not build a profile of anybody. We cannot see the individual visitors behind the figures, and neither can you.
- Support and feedback. What you write to us, and what you send through the feedback form in your site's dashboard, with the name and email you put on it.
- Security and operational logs. Request and error logs, kept to find faults and to spot abuse.
We do not sell personal data, we do not share it for advertising, and we do not use it to train anything.
4. Cookies and tracking
The panel sets a cookie to keep you signed in. That is a strictly necessary cookie and there is no way to offer an account without it.
We use Cloudflare Web Analytics for visitor counts. It is cookieless and collects no personal identifiers, which is why this site shows you no cookie banner. We run no advertising or profiling trackers.
A site we host is its owner's to configure. If they add analytics or advertising to it, that is their choice and their policy governs it, not this one.
5. Who we share data with
Only the providers the service is built on, each under a data processing agreement, and each handling only what their job requires.
| Provider | What they do for us | Where |
|---|---|---|
| Cloudflare | Hosting for our own services, CDN, DNS, TLS certificates, cookieless analytics, inbound mail routing | Global |
| Stripe | Payments, subscriptions and invoices | Global |
| Elastic Email | Sign-in and account email, and notification email sent by the sites we host | EU and US |
| ServerAvatar | Provisioning and management of the servers your site runs on | Global |
| Hetzner | The physical server for sites in our EU region | Germany |
| Nocix | The physical server for sites in our US region | United States |
We will also disclose data where the law requires it, and we will tell you when we are allowed to.
6. International transfers
You choose the region your site runs in, and we keep it there. We offer the European Union and the United States.
Some of the providers above operate outside the European Economic Area. Where personal data reaches them, the transfer relies on the European Commission's Standard Contractual Clauses or on an adequacy decision.
7. How long we keep it
- Your account
- While it is open, then 12 months
- Invoices and tax records
- 7 years
- The content of a deleted site
- 30 days
- Backups
- 1 month, rolling
- Security and operational logs
- 30 to 90 days
- Email you send us
- 3 years after the exchange
The 30 days on a deleted site is deliberate and is there to protect you: it is how long we can undo a deletion somebody regrets. After that it is gone from live systems and ages out of backups.
8. Security
Every site is served over HTTPS with a certificate we obtain and renew for you. Sites update themselves, so a security release reaches them without waiting for anyone. Backups are taken daily and we record evidence that each one happened rather than assuming it did.
Access to customer data by our staff is limited to the people who need it to run the service, and administrative actions are written to an audit log.
9. Your rights
Under the GDPR you may ask us to give you a copy of your personal data, correct it, delete it, restrict or object to what we do with it, or send it to somebody else in a portable form. Where we rely on consent you can withdraw it at any time. We do not make decisions about you by automated means alone.
Write to us and we will answer within one month. There is no charge for a reasonable request.
10. Sites we host, where we are the processor
If you are a member or a visitor of a directory built with Directory Brain, the person who runs that directory is the controller of your data, not us. They decide what the site collects and why, and their own privacy policy governs it.
We hold that data only in order to host the site, and we act on the owner's instructions. If you want your data corrected or removed from a directory, ask the directory, because they are the only ones who can decide it. If you cannot reach them, write to us and we will pass it on. We cannot make that decision for them.
11. Email sent by the sites we host
Sites we host send their notification email from dirbrainmail.com. The sender name is the directory's own, and the reply address is its owner's, so replying reaches the directory rather than us.
Our own account and billing email comes from directorybrain.com instead. The two are kept on separate domains on purpose, so that one site's behaviour cannot affect whether another customer receives a sign-in link.
If email sent through us is abusive or unwanted, tell us at abuse@dirbrainmail.com and we will act on it.
12. Children
DirectoryBrain is a business service and is not intended for children. We do not knowingly collect data from anyone under 16. If you believe we have, tell us and we will delete it.
13. Changes to this policy
If we change it we will update the date at the top, and where a change matters to you we will tell you by email rather than relying on you to notice.
14. Contact and complaints
For anything in this policy, including a request about your own data, write to privacy@directorybrain.com, or by post to Keltikos Software Ltd, Onisiforou Center, Floor 2, Neofytou Nikolaidi & Theodorou Kolokotroni, Agios Theodoros, 8011 Paphos, Cyprus.
For abuse of a hosted site or of mail sent through us, abuse@dirbrainmail.com reaches us faster.
If you are unhappy with our answer you can complain to the Office of the Commissioner for Personal Data Protection in Cyprus, which is our supervisory authority, or to the authority in the country where you live.