Privacy notice

Company details and contact

Legal name

CoreStoneSoft

Address

Creel 19
7881 AV Emmer-Compascuum
Nederland

KvK

42080978

Privacy and legal contact

info@corestonesoft.nl

1. Who processes your data?

CoreStoneSoft provides Aether and this portal. The legal business name, address and contact details appear below. This notice covers the website, orders, licensing, distribution and support. For local gateway use, your organization determines the purposes and access to alarm data.

2. Data and purposes

Requests include company name, contact name, email, optional telephone number, country, VAT number, quantities and your message. Orders and invoices additionally include address details, edition, price, payment references and license entitlements. Device records include installation ID, software version, Android version, license status and last contact time. These data support request handling, delivery, device-bound licensing and support.

3. Legal bases

Requests, orders and support are processed to prepare and perform a contract. Invoice and tax data are processed to meet legal record-keeping obligations. Access security, fraud prevention and technical incident analysis serve our legitimate interest in a secure product, subject to data minimization and balancing privacy interests. Optional processing requiring consent is not automatically authorized by this notice.

4. Local messages and external services

Messages, numbers, OPC configuration/values, rules and SIM routing are processed and where needed stored locally. Customers determine purposes, access and recipients. SMS uses the carrier; configured WhatsApp/Telegram transports send content and identifiers to Meta/Telegram. MQTT may publish content/status to the customer broker. The license portal does not automatically receive local message history. CoreStoneSoft is controller for its customer, invoice, license and security records; processing solely on customer instructions during support requires appropriate processing agreements.

5. Recipients and transfers

STRATO provides hosting and database services. The configured mail service is used for customer communication. Mollie B.V. processes payment transactions as an independent controller on its checkout page; we receive payment references and status, not payment-card details. We do not sell personal data. STRATO states that its webhosting data centres are in Germany. Customer-selected Meta, Telegram and carrier services have their own privacy policies and may process outside the EEA. Required safeguards apply to international transfers by CoreStoneSoft.

6. Retention and deletion

Unpaid requests and free text: twelve months after last handling. Accounts, device bindings and licenses: as needed for use rights and recovery, minimizing unnecessary fields. Security and audit logs: ninety days. Support logs: twelve months after closure. Necessary incident or dispute evidence is separately retained as long as needed. Expired temporary access codes are cleaned at least monthly. Core tax records and necessary order evidence: generally seven years. Operational backups: rolling no more than thirty days; fiscal archives separately for statutory periods. Cleanup is reapplied after restoration. Gateway history: thirty days by default; AT logs: seven days, locally configurable. History cleanup does not delete active queues.Definitively canceled unpaid orders are removed during periodic cleanup starting thirty days after cancellation or last handling, including related resume links and recovery email. Payment and license entitlements, fiscal records, uncertain email delivery and explicit retention protection prevent deletion. This does not erase payment-provider records.

7. Cookies and local storage

The portal uses a functional session cookie for sign-in, CSRF protection and temporary order access. Your theme preference is stored locally in the browser. The current marketing page loads images and scripts locally and contains no advertising or analytics tracker. Mollie checkout and external services have their own privacy and cookie policies. Enabled gateway transports are separate from browser cookies.

8. Security

Administrator access and customer accounts use a password and authenticator code. Customer account records include email, a password hash, an encrypted MFA secret, hashed recovery codes, account status and security records. Activation links expire and are single-use; stored tokens are hashed. Registered installation IDs link a device to a paid order. Customers can access only their own orders and downloads. Password resets retain MFA; blocking invalidates existing customer portal sessions. Production requires HTTPS. Security reduces risk but does not guarantee incidents cannot occur. Report suspected misuse using the contact details below.

9. Your rights and complaints

You may request access, correction, deletion, restriction, portability or objection where the GDPR grants those rights in your situation. Any consent can be withdrawn. We may request information to verify your identity securely and generally respond within one month. Statutory retention can limit deletion. You may complain to the Dutch Data Protection Authority. For data on your employer or customer's gateway, first contact that organization.

10. Device licensing and Device ID

Aether generates a random installation ID in private app storage; licensing does not use IMEI. Activation sends Device ID, activation code, app and Android versions. Licenses hold edition, features and optional dates. Contact time is recorded on API actions, not a continuous location profile. Ordinary updates retain the ID; uninstalling/clearing data may replace it. Device replacement requires administrative reissue.

11. Diagnostics and local access

Sentry is disabled in the first commercial production release; that app does not automatically send errors to Sentry. Local technical logging remains available. Share only necessary sanitized support logs, never passwords or tokens. Local gateway accounts and roles do not use portal TOTP. Personal alarm messages are visible only to their owner and administrator. Shared messages require the appropriate permission. Use isolated networks for legacy protocols and HTTPS for administration.

12. Automated processing

This software does not make solely automated decisions with legal or similarly significant effects about individuals. Payment/license checks determine technical product access. Legitimate interest may apply to employees who are not personally contracting parties, after balancing interests. Acceptance of terms is not blanket privacy consent.

Questions or changes

Contact us using the details above. This page states its version date. Changes do not automatically apply retroactively to an existing agreement.