How CUZY processes personal data as a controller (this website, customer accounts, orders, support) and as a processor (the HumHub communities we host for our customers).
Controller. For visitors of CUZY.app, holders of a customer account, buyers of module licenses or hosting subscriptions, and people who write to us, CUZY decides why and how data is processed. Our services are for organizations and are not directed to children; we do not knowingly collect data of anyone under 16 as a controller.
Processor. For the members of a HumHub community hosted by CUZY, the customer who administers that community is the controller. CUZY processes members' data only on the customer's instructions, under the Data Processing Agreement accepted at subscription. Members should read the privacy policy published by their community's administrators.
| Purpose | Data | Legal basis |
|---|---|---|
| Serving this website | IP address, user agent, requested pages, timestamps in server logs | Legitimate interest (security, operation) |
| Statistics of this website | Pages viewed, the page or site you came from, browser, language, time, and your IP address shortened to its first two bytes before it is stored (so the country can be told, not the person). Counted by CUZY's own server in Germany (Matomo, run by CUZY), without any cookie or script; never for signed-in members, nor when your browser sends a "Do Not Track" or Global Privacy Control signal | Legitimate interest (knowing which pages help visitors and how they find us) |
| Customer account on CUZY.app | Name, email, password (hashed), language, company details, consents with version and time | Contract |
| Orders and invoices | Billing name and address, VAT number, products, amounts, payment status; card and PayPal data are processed by Stripe or PayPal and never stored by CUZY | Contract; legal obligation (accounting) |
| Module license keys | Licensed domain, order reference, buyer's email address and, if given, the end customer's name, sent to HumHub GmbH & Co. KG (Germany), which issues the key through the HumHub marketplace | Contract |
| Hosting subscription | Community name and address, plan, usage counters (members count, storage, emails), technical events, availability | Contract |
| Support | Ticket content, attachments, email address, license key or instance URL | Contract (customers); legitimate interest in answering people who write to us (others) |
| Service emails | Trial reminders, invoices, security and maintenance notices | Contract |
| Newsletter | Email address, when you subscribe through the form linked from CUZY.app (hosted by Brevo) or ask us in writing; unsubscribe link in every message | Consent |
| Signing in with Google, GitHub or LinkedIn (if you choose it) | Name, email address and the provider's account identifier, received from that provider when you sign in | Contract |
| Fraud and abuse prevention | Record of each trial (email address, name, community address, date) to allow one trial per address; disposable-domain checks; rate-limit counters keyed on a hash of your IP address | Legitimate interest (preventing abuse of free trials and attacks on the service) |
We do not sell personal data and we do not use it for advertising. No AI service processes your data.
Hosted communities contain whatever their administrators and members put in them: profiles, posts, files, messages. CUZY stores and backs up this data, keeps the software running and updated, and accesses it only for support at the administrator's request (logged and visible to the administrators), to investigate an incident, or when required by law. Usage counters and technical health indicators reported to our operations tools contain no member data.
The Data Processing Agreement (Article 28 GDPR) describes instructions, confidentiality, security measures, sub-processors, assistance with members' rights, breach notification within 72 hours, deletion at the end of the contract and audit rights. It is section 10 of the terms of sale, shown and accepted at each checkout; we send a copy of the version you accepted on request.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Servers for CUZY.app and hosted communities | CUZY.app: Germany (EU). Hosted communities: the region chosen by the customer: Germany (EU), the USA or Singapore (APAC); in the USA and Singapore, data centers operated through Hetzner's subsidiaries, under the transfer safeguards of Hetzner's data processing agreement |
| Backblaze, Inc. | Encrypted backups and customer exports | Storage in the same region as the community, except Singapore communities, whose encrypted backups are stored in the United States; US company under Standard Contractual Clauses |
| Cloudflare, Inc. | DNS for cuzy.app and community addresses; forwarding of replies sent to our service addresses (@account.cuzy.app, @news.cuzy.app) to our own mailboxes | Global; US company under the EU-US Data Privacy Framework |
| Stripe Payments Europe, Ltd. | Payments, invoices, VAT validation | Ireland (EU) |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Payment of module licenses when you choose PayPal; PayPal processes the payment as its own controller | Luxembourg (EU) |
| Mollie B.V. | Charges of module license subscriptions created on our former website, until the last one ends; Mollie processes the payment as its own controller | Netherlands (EU) |
| HumHub GmbH & Co. KG (partner.humhub.com) | Issuing the license keys of the modules you buy: licensed domain, order reference, email address, end customer's name if given | Germany (EU) |
| SMTP2GO (SMTP2GO Ltd) | Delivery of notification and service emails | EU sending infrastructure; company in New Zealand (adequacy decision) |
| Brevo SAS (formerly Sendinblue) | Sending our newsletter to people who opted in (email address only; no community member data) | France (EU) |
| HumHub GmbH & Co. KG (push.humhub.com, through Google Firebase) | Push notifications of hosted communities on the Business plan: the device tokens of the members who turned them on and the text of their notifications | Germany (EU); Google Firebase: US, under Standard Contractual Clauses |
| Google LLC (Google Maps Platform, Geocoding API) | On the Business plan, the map modules of a hosted community turn the postal addresses entered by its members into map positions with the key CUZY provides: the address sent for each lookup | United States; EU-US Data Privacy Framework |
| WhatsApp (Meta Platforms Ireland Ltd) | The support channel of the Business plan, for the one contact the customer names: what that person sends us there | Ireland (EU); messages end-to-end encrypted, metadata with Meta |
| StatusCake Ltd | External availability checks of CUZY.app and our status page (hostnames only, no personal data) | United Kingdom (adequacy decision) |
| Infomaniak Network SA | Our own mailboxes: everything you write to us (support, contact, security reports) is stored there | Switzerland (adequacy decision) |
Before we add or replace a sub-processor we announce it by email to every customer and on this page at least 30 days in advance. A customer who objects within those 30 days may terminate the affected service without penalty, with the unused prepaid period refunded. The list above is the current one and carries the date of the version you are reading.
Hosting and backups of a community stay in the region its customer chose, except that backups of Singapore communities are stored in the United States because our backup provider has no Asian data center; they are encrypted before they leave the server. Customers whose members are in the European Union should choose the Germany (EU) region, which is the default and keeps hosting and backups inside the EU. Customers are informed before a sub-processor is added or replaced and may object under the Data Processing Agreement.
CUZY.app loads no third-party scripts, fonts or trackers and uses no analytics cookies: visits are counted on our own server, without a cookie (section 2). The site and the customer area set only cookies needed for what you asked for, which require no consent: the HumHub session cookie, the security (CSRF) cookie, the "remember me" cookie when you tick that box at login (up to 30 days), and a language cookie when you choose a language (one year). If you choose a light or dark color theme, the choice is kept in your session or, when you are logged in, in your account settings. Hosted communities start with the same cookies; their administrators may add modules that set others and describe them in the community's own cookie notice.
Your right to object. Where we rely on our legitimate interests (server logs, support of non-customers, fraud and abuse prevention), you may object at any time on grounds relating to your particular situation; we then stop unless we have compelling legitimate grounds or need the data for legal claims. You may object to direct marketing at any time, without giving a reason: use the unsubscribe link or write to contact@cuzy.app.
Under the GDPR you may access, rectify, erase and receive a copy of your data, restrict or object to some processing, and withdraw consent at any time. Customer account holders do most of this from their account; otherwise write to contact@cuzy.app. We answer within one month. You may lodge a complaint with the Data Protection Commission (Ireland) or your local supervisory authority. Members of a hosted community should address requests to that community's administrators, whom we assist as their processor. Withdrawing a consent does not affect the processing carried out before.
Providing the data marked "Contract" is needed to create an account, place an order or run a subscription; without it we cannot provide the service. Billing data is also required by tax law. Everything else is optional. We make no decision based solely on automated processing that has legal or similarly significant effects on you; a trial signup from a disposable email address is refused automatically, and you can write to us to have it reviewed by a person.
Isolated environments per community, encryption in transit and for backups, least-privilege access, monitoring, tested restores and a documented incident process. The security and reliability page describes the measures in detail.
CUZY, 80 St. Columbanus Road, Dundrum, Dublin 14, D14 WP98, Ireland. Privacy questions: contact@cuzy.app. Security reports: security@cuzy.app. CUZY has not appointed a data protection officer, as its activity does not require one; privacy questions go to the address above.
CUZY is below the thresholds of the California Consumer Privacy Act. For transparency: the categories of personal information we collect, their purposes and retention are in sections 2 and 5; we do not sell or share personal information and do not use it for targeted advertising; we do not track visitors across sites, so Do Not Track and Global Privacy Control signals change nothing here. You may ask for access, correction or deletion at contact@cuzy.app.
