Privacy Policy
Last updated: 17 September 2026
This policy describes how AKASHA OMS (“we”, “the service”, operated from the European Union) handles personal data when you use akashaoms.com and api.akashaoms.com. It serves as both the GDPR (EU/EEA/UK) privacy notice and the CCPA/CPRA notice at collection for California residents.
1. Who is responsible (controller)
The operator of this service is the person named in the Impressum. You can reach us for any privacy matter at hello@akashaoms.com.
2. What personal data we process
| Category | Examples | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Account data | Email address, password (stored only as a bcrypt hash) | Account creation, authentication, service delivery | Art. 6(1)(b) contract |
| Order & customer data you submit | Your customers’ names, emails, delivery addresses, order contents | Processing orders on your instructions (we act as processor; you are the controller for your customers’ data) | Art. 6(1)(b); our Terms include processor terms |
| Billing data | Stripe customer ID, subscription status | Subscription billing | Art. 6(1)(b) |
| Technical logs | Request metadata, error logs | Security, debugging, abuse prevention | Art. 6(1)(f) legitimate interest |
Card data: we never see or store card numbers. All card payments are handled by Stripe; our servers only receive payment references.
3. Where data is hosted and who receives it (subprocessors)
All production data is hosted on a server in Nuremberg, Germany (EU) operated by Hetzner Online GmbH (hosting provider). Payments are processed by Stripe, Inc. (USA), which participates in the EU–US Data Privacy Framework for lawful transfers. We do not sell personal data, share it for cross-context behavioral advertising, or disclose it to anyone else except: (a) your own configured webhook endpoints (data you explicitly direct us to send), and (b) legal authorities where required by law.
4. Your rights
GDPR (EU/EEA/UK): you have the right of access, rectification, erasure, restriction, data portability, and objection (Art. 15–21), and the right to lodge a complaint with a supervisory authority — for this service, the Bavarian Data Protection Authority (BayLDA) for our own processing, or your local authority for your customers’ data, which you control.
CCPA/CPRA (California): you have the right to know, access, correct, and delete your personal information, and the right not to be discriminated against for exercising these rights. We do not sell or share personal information (as those terms are defined by CCPA/CPRA), so no “Do Not Sell or Share” opt-out is required.
To exercise any right, email hello@akashaoms.com from your account address. We respond within 30 days (GDPR) / 45 days (CCPA, extendable once).
5. Cookies
We set exactly one cookie: of_session, a session token used to keep you logged in. It is HttpOnly, Secure, and SameSite=Lax. We use no analytics cookies, advertising cookies, or third-party trackers of any kind. Because the cookie is strictly necessary for the service, no consent banner is required under the ePrivacy Directive.
6. Retention & deletion
- Account data: kept while your account is active; deleted within 30 days of a verified deletion request or account closure.
- Order/customer data: kept while your account is active; deleted with your account unless a longer period is required by law.
- Webhook delivery records: terminal deliveries deleted after 30 days.
- Event outbox records: deleted 7 days after publication.
- Technical logs: rotated routinely and kept no longer than 90 days.
7. Security
TLS 1.2+ in transit, bcrypt password hashing, AES-256-GCM encryption for stored payment-integration credentials, per-tenant database isolation enforced by row-level security, and a least-privilege database role for the application.
8. Changes
We will update the “last updated” date above for material changes. Continued use after a change constitutes acceptance.