Who we are
NanoPing is made by Steinwurf ApS, a company registered in Denmark. We are the data controller for the personal data described in this policy.
Steinwurf ApS
Niels Jernes Vej 10
9220 Aalborg Ø, Denmark
CVR 33576641
contact@nanoping.com
This policy covers our website at nanoping.com, the NanoPing portal at user.nanoping.com, and the NanoPing software you install on your devices ("nodes"). It explains what we collect, why, and what you can do about it. Our Cookie Policy has the details on cookies, and our Terms and Conditions cover the use of NanoPing itself.
The short version
- We collect what we need to run your account, license your nodes, bill you and support you.
- The traffic your nodes carry goes directly between your own systems and never passes through our servers.
- Our portal, hosted hub and database are hosted by Google Cloud in Frankfurt, Germany.
- The website counts visits without cookies. Marketing tools load only if you allow them.
- We do not sell personal data.
What we collect
When you visit our website
- Visit statistics. We use Plausible to count page views, referring sites and clicks. Plausible uses no cookies and stores no IP addresses or other personal identifiers, so we see totals, not individuals.
- Requests to our servers. Like any website, our hosting provider (Cloudflare) processes your IP address, browser type and the pages you request in order to deliver the site and protect it against attacks.
- Chat. If you write to us in the chat, we receive what you type, any email address you leave, the page you are on, the site that sent you there, your browser type and the country you are in. The chat passes your messages to our team in Slack, where we answer them. The chat window keeps the conversation for 24 hours after it was last used.
- Contact form. If you use the form on our contact page, we receive your name, email address, company and message.
- Marketing tools. Only if you allow marketing cookies: Leadfeeder tells us which companies visit our site based on the network they visit from, and Reddit and Google Ads tell us whether people arrived through our ads.
When you create an account and use the portal
- Account details: your name, email address and password (stored only as a secure hash), your organization's name, your role, and whether you have turned on two-factor authentication. If you sign in with Google, GitHub or Microsoft, we receive your name and email address from them.
- Team and invitations: email addresses of people you invite and who invited them.
- Billing details: if you subscribe to a paid plan, your billing name and address, billing email addresses and tax ID. Card details go directly to Stripe, our payment provider. We never see or store your full card number.
- Agreements: which agreements your organization has signed, when, and by whom.
- Security records: the IP address used to request and use a password reset, and technical logs of requests to the portal (IP address, browser type, the page requested and the time).
From your nodes
When you install NanoPing on a device and connect it to your organization, the software sends us:
- Licence checks: every minute, the node sends its licence key, name and hostname to our servers. We record the IP address and software version of each check and the time, so we can confirm the licence is valid and show you which nodes are online.
- Hub information: if your nodes are connected to our hosted hub, the hub keeps each node's identifier, name, online status, when it was last seen, the services it offers and any labels you give it.
- Error reports: only if you allow error reporting in the node's settings, the software sends reports of crashes and errors to our error tracking provider, Sentry. A report contains the error, recent log lines, the configuration of the pipelines that were running with keys, passwords and tokens removed, and technical details such as the hostname and operating system. A report from the dashboard can include a recording of the dashboard leading up to the error. When you send feedback or a report yourself, it includes your name, email address and anything you attach.
- Library files: pipeline and blueprint files you choose to save to your organization's library.
- Connection and version checks: the dashboard checks whether it is online by contacting nanoping.com, and asks our servers whether a newer version is available.
Traffic and the hosted hub
The traffic your nodes carry goes directly between your own nodes and systems. It never passes through our servers, and we do not inspect, store or analyse it.
Our hosted hub at hub.nanoping.com lets your nodes find each other and lets you open and manage a node's dashboard remotely. Licensed nodes connect to it by default. You can disconnect a node from it in the node's settings, or run your own hub instead. When a node is not connected to our hosted hub, we cannot reach it, and its dashboard, settings and logs do not pass through our servers.
When you use the hosted hub, remote dashboard sessions, including the settings, logs and status information they show, pass through our servers so they can reach the node. We do not keep them.
When you contact us
If you email us, write in the chat or fill in the contact form, we keep the conversation and the details you give us so we can reply and follow up.
Why we use it and our legal basis
Under the EU General Data Protection Regulation (GDPR), we need a legal basis for each use of personal data. These are ours:
| What we do | Legal basis |
|---|---|
| Create and run your account, license your nodes, provide the portal and support you | Performance of our contract with you (Art. 6(1)(b)) |
| Bill you and keep accounting records | Legal obligation under Danish bookkeeping law (Art. 6(1)(c)) |
| Keep the service secure, prevent abuse and fix problems | Our legitimate interest in a secure, working service (Art. 6(1)(f)) |
| Receive error reports from the software | Our legitimate interest in finding and fixing faults (Art. 6(1)(f)) |
| Reply to your questions and follow up on sales conversations | Our legitimate interest in answering and growing our business (Art. 6(1)(f)) |
| Send you product news and offers by email | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
| Count website visits with Plausible | Our legitimate interest in understanding how the site is used (Art. 6(1)(f)) |
| Use marketing cookies | Your consent (Art. 6(1)(a)), given in the cookie settings |
Emails about your account, such as sign-up confirmation, password resets, invitations, trial and billing notices, are part of running the service. You cannot opt out of them while you have an account.
We do not use your personal data for automated decisions that have legal or similarly significant effects on you.
Your organization's data
Your organization decides who gets access to its account and nodes and what data it stores in the portal. For personal data that your organization stores in the service, for example in node settings, labels or library files, we act as a data processor on your organization's behalf. If your organization needs a data processing agreement, contact us at contact@nanoping.com.
Access by our staff
A small number of Steinwurf employees can access customer accounts. They do this only to give support you have asked for, to investigate security problems or abuse, or when the law requires it. This gives them access to your account in the portal, but not to your nodes. Every access is logged with the reason.
Who we share it with
We use the following service providers. They process personal data only on our instructions and under data processing agreements.
| Provider | What they do for us | Where |
|---|---|---|
| Google Cloud (Google Cloud EMEA Ltd) | Hosts the portal, the hosted hub, the database and files | Frankfurt, Germany |
| Functional Software, Inc. (Sentry) | Receives error reports from the NanoPing software | Germany |
| Cloudflare, Inc. | Hosts the website and its chat, runs our DNS and protects the sign-up form and chat against bots | Global network |
| Mailgun (Sinch) | Sends account emails | EU |
| Stripe Payments Europe Ltd | Takes payments and sends invoices | Ireland, with transfers to the US |
| Pipedrive OÜ | Our customer records and contact form | Estonia |
| Slack Technologies Ltd | Passes website chat messages to our team | Ireland, with transfers to the US |
| Plausible Insights OÜ | Cookieless website statistics | Germany |
| Google, GitHub and Microsoft | Sign-in, only if you choose to sign in with them | United States |
| Leadfeeder (Dealfront) | Company-level visit insights, only with your consent | Finland |
| Reddit, Inc. | Ad measurement, only with your consent | United States |
| Google Ireland Ltd (Google Ads) | Ad measurement, only with your consent | Ireland, with transfers to the US |
We may also share personal data with professional advisers such as auditors and lawyers, with authorities when the law requires it, or with a buyer if our business or part of it is sold. If an authority asks us for a customer's data, we will tell the customer unless the law prevents us.
We do not sell personal data, and we do not share it with others for their own marketing.
Transfers outside the EU
We keep the portal, the hosted hub and their data in the EU. Some of the providers above are based in, or use sub-processors in, the United States or other countries outside the EU and EEA. When that happens, the transfer is covered by the EU-US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.
How long we keep it
| Data | How long |
|---|---|
| Account, organization and team details | While your account is open, then deleted or anonymised 90 days after it is closed |
| Unfinished sign-ups | 30 days |
| Licence check records | 90 days |
| Removed nodes | The node's name, hostname and identifier are removed 90 days after it is removed. We keep its licence key so it stays locked out |
| Hosted hub records of a node | Until the node has been offline for 30 days |
| Error reports | Up to 90 days |
| Billing records and invoices | 5 years from the end of the financial year, as Danish bookkeeping law requires |
| Server and security logs, including password reset requests | Up to 12 months |
| Records of staff access to accounts | Kept, so we can always account for every access |
| Contact form, chat and email conversations | Up to 3 years after our last contact, unless you become a customer |
| Consent choices for cookies | 12 months, then we ask again |
We may keep data longer if we need it to establish or defend a legal claim.
Your rights
You have the right to:
- access the personal data we hold about you and get a copy of it
- correct data that is wrong or incomplete
- delete your data, when we no longer have a reason to keep it
- restrict how we use your data while a question about it is being resolved
- port data you gave us to another service in a common format
- object to our use of your data based on legitimate interest, including direct marketing at any time
- withdraw consent at any time, without affecting what we did before you withdrew it
To use any of these rights, email contact@nanoping.com. We may need to confirm your identity first. We reply within one month.
If your account belongs to an organization, some requests, such as deleting the account, may need to go through your organization's administrator.
You can also complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk, or to the data protection authority where you live or work.
Security
We protect your data with encryption in transit, passwords stored only as secure hashes, optional two-factor authentication, access controls for our staff and hosting in secure data centres. Nodes connect to our hosted hub over an encrypted connection and check its certificate. No system is perfectly secure, so we cannot guarantee that data will never be accessed without permission. If a breach affects your personal data and puts your rights at risk, we will tell you without undue delay.
Children
NanoPing is a service for businesses and is not meant for children. We do not knowingly collect personal data from anyone under 16.
Changes to this policy
We may update this policy when our service or the law changes. The date at the top shows when it last changed. If we make important changes, we will tell account holders by email or in the portal before they take effect.
Contact
Questions about this policy or your data: contact@nanoping.com, or write to Steinwurf ApS, Niels Jernes Vej 10, 9220 Aalborg Ø, Denmark.