RReseat

Template — version 2026-08. This is a working template. The operator will finalize the binding text (including legal entity, jurisdiction and contact details) before general availability; the accepted version is recorded at onboarding.

Privacy Policy

Version 2026-08 (template). This policy explains how [Operator legal entity] handles personal data around Reseat — this portal and the managed instances we operate for customers.

1. Who is responsible

[Operator legal entity], established in the European Union, is the data controller for this portal and for customer account data. Contact: [privacy contact email].

For personal data your company stores inside its instance — for example ticket buyers’ names and delivery details — your company is the controller and we act as processor under the Data Processing Agreement.

2. What we process, and why

  • Account data — your Whop user ID, membership ID and email address, to authenticate you and link your subscription. Legal basis: performance of contract.
  • Onboarding data — company name, workspace address, Tailscale email, optional logo, and a record of which document versions you accepted (with timestamp and IP address). Legal basis: performance of contract and legal obligation.
  • Operational data — instance health, provisioning logs and audit trails needed to run the fleet securely. Legal basis: legitimate interest in operating a reliable service.
  • Session cookies — strictly necessary authentication cookies for this portal. We use no analytics or tracking cookies, so no cookie banner is shown.

3. Sub-processors and recipients

We use a short list of providers to operate the service:

  • Whop — checkout, membership and sign-in identity.
  • [Hosting provider, e.g. Hetzner] — servers the instances run on (EU).
  • Tailscale — the private network layer that carries access to instances.
  • Anthropic — AI-assisted parsing of confirmation emails inside instances, where the feature is enabled.
  • [Backup storage provider] — encrypted off-site backups.

The current list, with roles and locations, is maintained in the DPA. We do not sell personal data.

4. Retention

Account and acceptance records are kept for the life of the contract plus statutory retention periods. Instance data follows your instructions as controller: it is deleted after the post-termination grace period, and buyer-PII erasure tooling is available in-app throughout.

5. Security

Instances are single-tenant, reachable only through private network shares, with encrypted transport, least-privilege operator access, and audit logging. Details are described in the DPA’s technical and organizational measures.

6. Your rights

Under the GDPR you can request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. Write to [privacy contact email]; you may also complain to your supervisory authority. For data inside a customer’s instance, direct requests to that customer — we assist them under the DPA.

7. Changes

We will announce material changes to this policy through the portal. The version you accepted at onboarding is recorded and available on request.