Privacy Policy
Last updated: 18 October 2026
1. Who we are
ENSOBIT d.o.o., Ulica Savezne Republike Njemačke 4, 10000 Zagreb, Croatia (OIB 62091873389, MBS 081668648) is the controller of personal data processed through this website. You can reach us at info@ensobit.com.
2. Data and sources
Contact forms and email: name, email, organisation, enquiry type and message. Accounts and trials: verified email, first and last name, company, language, optional phone, authentication information and manual approval status; download records contain user, file and time. When you choose Google or Microsoft SSO, the provider supplies identity, name and email according to the authorised scopes. Support processes the ticket title, description, product version, impact, status, author and public replies. Supabase also retains the original request and the Jira mapping. Hosting and security services process technical connection and access information. Do not submit passwords, private keys, access tokens or unnecessary third-party personal information.
3. Purposes and legal bases
We provide accounts, requested trials, pre-contractual steps and contractual support under GDPR Article 6(1)(b) where you are the contracting party. For business representatives, business enquiries, security, abuse prevention and limited download auditing, we rely on Article 6(1)(f): our legitimate interests in providing business services and protecting systems. Applicable legal obligations fall under Article 6(1)(c). Optional analytics relies on consent under Article 6(1)(a). Submitting an enquiry or opening an account is not marketing consent. These actions do not subscribe you to a newsletter.
4. Cookies, local storage and your choice
Necessary authentication cookies (sb-…-auth-token and its chunks) maintain sign-in; sb-…-code-verifier completes authentication or recovery. The authentication library sets a lifetime of up to 400 days, but session validity depends on authentication settings and sign-out. NEXT_LOCALE remembers the selected language as a session cookie. ens0key-theme in localStorage retains your explicit theme choice until changed or browser data is cleared. ens0key.privacy.v1 stores the analytics choice, notice version and decision time for 180 days, after which we request a new choice. It contains no email or unique user identifier. Necessary storage remains available with “Necessary only”. Deleting authentication cookies may sign you out. Cloudflare Turnstile protects forms against automated abuse; any security storage depends on its configuration.
5. Optional analytics
Vercel Web Analytics loads only after you choose “Allow analytics”. It processes public-page visits, referral source, device, browser and approximate location. It uses a temporary request-derived identifier rather than an analytics cookie; Vercel states that the visitor-session identifier is discarded after 24 hours. Account, login, administration, password recovery and support pages are excluded. Query parameters and fragments are removed from page URLs sent to analytics. Withdraw consent by choosing “Necessary only” in Privacy settings in the footer. This stops future sending without affecting the lawfulness of previous processing. We use no advertising pixels or custom analytics events containing form data.
Vercel Web Analytics — privacy6. Recipients and international transfers
Authorised ENSOBIT staff handle requests. We use Vercel for hosting and consented analytics, Supabase for accounts and database storage, Cloudflare R2 for downloads, Cloudflare Turnstile for form protection, Resend for transactional email and Atlassian Jira Service Management for support. Our business email system retains correspondence. Google and Microsoft also process SSO information under their own policies. Each provider’s role depends on the service; not all its processing is on our behalf. Data may be processed outside the EEA. Such transfers must have an applicable basis, such as an adequacy decision or standard contractual clauses with necessary assessment and supplementary measures. Request information about recipients, the applicable mechanism and a copy of safeguards at info@ensobit.com. An EU database region alone does not mean all provider data processing and support remain in the EU.
Cloudflare Turnstile Privacy Addendum7. Retention
We set a 12-month retention period for completed enquiries and trials that do not lead to a business relationship, measured from closure or the last substantive communication. Closed support tickets are retained for 24 months after closure. Accounts are reviewed after 24 months without a login or active contractual relationship; before closure we send a notice allowing 30 days to respond. Download records are retained for 12 months. We implement these periods through a monthly review covering the database, Jira and business email. Records needed for an active contract, legal retention duty or specific dispute are separated with a documented reason and applicable period. Technical logs and backups follow the provider’s contracted settings and service limits; deleted data may remain temporarily until a backup cycle expires. Deleting an account does not automatically delete separate Jira and email records. Contact us for a category-specific period or an erasure request.
8. Your rights and contact
Subject to GDPR conditions, you may request access and a copy, correction, erasure, restriction and portability. You may object to processing based on legitimate interests and withdraw consent without affecting earlier lawful processing. Contact info@ensobit.com; sign-in is not required. We respond without undue delay, normally within one month. If a permitted extension of up to two further months is needed, we inform you within the first month and explain why. Identity checks are proportionate; we do not routinely request an identity-document copy. You may complain to the Croatian supervisory authority AZOP, Selska cesta 136, 10000 Zagreb, azop.hr, or another competent supervisory authority.
AZOP9. Required information and decisions
Required fields are needed for a response, account or requested service; without them that action cannot be completed. The trial phone number is optional. Analytics is not a condition of account, trial or support access. Trial approval is a manual administrator decision. This website does not make solely automated decisions with legal or similarly significant effects or perform marketing profiling. AI features described in the documentation belong to the ens0key product; this website does not send web forms or tickets to an AI model.
10. Scope and changes
This policy covers ens0key.com and its account, trial and support portal. Processing inside the ens0key application installed on a customer’s infrastructure is governed separately according to the customer’s role and contract. The revision date appears above. We will seek consent again for a materially changed optional analytics purpose.