Privacy Policy

Last updated: June 1, 2026

This Privacy Policy describes how Aaltilis Systems LLC ("Aaltilis", "we", "us", or "our") collects, uses, and protects personal information in connection with Olsbox, a browser-based statistical analysis application.

1. Who We Are

Aaltilis Systems LLC is a limited liability company organized under the laws of Wyoming, USA. We are the data controller for personal information processed in connection with Olsbox.

2. Information We Collect

We collect different categories of information depending on how you use Olsbox.

Two kinds of logging are described below, and they are not the same thing. Server access logs are the automatic, request-by-request records a web server typically keeps of general browsing (such as which pages were requested, from which IP address, and when); as explained in Section 2.1, our application servers do not keep these. Authentication activity records are a separate, deliberate log of account security events only. This includes sending a one-time password, logging in or out, and failed login attempts described in Section 2.2. They exist solely to secure your account and detect abuse, and they store a hashed (not raw) IP address.

2.1 If you use Olsbox without registering (free tier)

We do not collect any personal information that identifies you as an individual, and our own application servers do not write access logs of your browsing (no IP address, browser User-Agent, or referring URL is stored by us).

Our network security provider, Cloudflare, processes connection metadata such as your IP address and request headers at the network layer in order to provide DDoS mitigation, bot protection, and aggregate analytics. This processing is governed by Cloudflare's own retention practices; see Section 4.1.

We also record an anonymous measure of how long the application was open during a visit. When you close the application, your browser sends us the duration of that session with no identifier, account, cookie, or IP address attached to it. We use this only to understand overall usage patterns and cannot link it back to you.

2.2 If you register for an account

In addition to the above, we collect:

• Your email address (required for authentication)
• Your name (if you provide it)
• A record of authentication activities, which includes the sending of one-time passwords, logging in, logging out, and failed login attempts. Each record holds a timestamp, your email address, and an irreversible, salted hash of the IP address the request came from. We store the hash (not the IP itself) so we can detect abuse such as repeated failed logins from the same source; we cannot recover the original IP address from it. We do not store the browser User-Agent. These records are kept in a separate database and are not included in our backups.
• Your marketing communication preferences (optional, opt-in)
• Any feedback you choose to submit through the application. This includes the category and the text content of your message, tied to your account so we can follow up if needed.

2.3 If you purchase or redeem a license

In addition to the above, we collect:

• A Stripe customer identifier linking your account to your purchase
• Records of your purchases, license status, and license-related events.
• If you activate a license using a redemption key, a record that links the key to your account and the time it was redeemed.

Payment card details are collected and processed directly by Stripe, Inc. We do not receive or store your full card number, CVV, or expiration date.

2.4 Information stored on your device, not on our servers

When you use Olsbox to perform statistical analyses, your datasets, analysis results, and saved workspaces are stored locally on your device using your browser's localStorage and IndexedDB. This data remains on your device and is not transmitted to our servers.

3. How We Use Your Data

• Provide Olsbox to you, authenticate your account, and process your purchase.
• Send you transactional emails like receipts, security notices, and updates to these policies.
• Send you product updates and marketing emails, only if you have opted in. You can unsubscribe at any time using the link in any such email, or by contacting us.
• Detect and prevent abuse, troubleshoot issues, and protect Olsbox against attacks, using short-lived authentication activity records and our network security provider.
• Comply with our tax, accounting, and other legal obligations.

We do not use your data for advertising, profiling, or sale to third parties.

4. Third-Party Service Providers

We use third-party services to operate Olsbox, including payment processing (Stripe), server hosting, network security, and email delivery. These providers process data only as needed to deliver their services to us.

We do not sell your personal information. We do not share your personal information with advertisers or for advertising purposes.

4.1 Subprocessors

The following subprocessors may process personal information on our behalf in order to deliver Olsbox. Each processes only the data necessary for its function.

• Netcup (Germany). Server hosting and infrastructure. Our servers and database run on netcup's infrastructure, so any personal information we store is held on their systems.
• Backblaze (United States). Holds backup copies of our database. Our authentication activity records are kept in a separate ephemeral database, and so are not stored with Backblaze.
• Stripe (United States). Payment processing and license management. Receives your email address and purchase records. Card details are handled directly by Stripe.
• MailerSend (United States). Transactional email delivery (sign-in codes, security and policy notices). Receives your email address and the contents of those messages.
• Google (United States). Optional "Sign in with Google" authentication. If you choose this method, Google provides us your email address and processes the sign-in request.
• Migadu (Switzerland). Hosting of our support and correspondence mailboxes. Processes the email address and contents of any messages you exchange directly with us.
• Cloudflare (United States). Network security, DDoS mitigation, bot protection, and aggregate web analytics. Processes connection metadata such as your IP address and request headers. We do not use Cloudflare as a content delivery network for your data.

5. Cookies and Local Storage

Olsbox uses the following technologies:

Authentication cookies: A session cookie is set when you log in. This cookie is necessary for the Service to function.

localStorage and IndexedDB: We use your browser's local storage APIs to save your workspaces, datasets, and analysis state on your device. This data is not transmitted to our servers. Clearing your browser data will remove these workspaces.

We do not use cookies for tracking, analytics, advertising, or profiling.

Cookieless analytics: Any usage analytics we and our subprocessors collect are cookieless. They do not set cookies, do not store identifiers in your browser, and are not used to track you across sites or sessions.

6. Data Retention

Application server access logs: not retained — our application servers do not log your browsing. Network-layer connection metadata is handled by Cloudflare under its own retention practices.

Authentication activity records (timestamp, email, hashed IP): 30 days, after which they are automatically deleted.

Account data (email, name): while your account is active.

License and purchase records: while your license is active, plus any period required by applicable tax or accounting law.

Marketing consent records: until you withdraw consent.

Data on your device (workspaces, datasets): controlled by you; cleared when you clear your browser data.

6. Security

We use HTTPS (TLS) to encrypt data in transit between your browser and our servers. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

8. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify registered users by email at least 30 days before the changes take effect. The "Last Updated" date will reflect the most recent revision.

9. Contact

If you have any questions about these Terms, please contact us at [email protected].