Privacy

The NuGetKeep server you run doesn't send us anything. Licence validation is offline and your server never phones home, so we hold no data about your packages, your feeds or your developers. This page is about the website — specifically, the one form on it that asks for your email address.

Last updated 2 October 2026.

Who we are

Atypical Consulting SRL, a company registered in Belgium, is the controller for the personal data described on this page.

Atypical Consulting SRL — Rue de la Fauvette 29, 4300 Waremme, Belgium — Enterprise/VAT number BE 0744.517.956

For anything on this page — a copy of your data, a correction, a deletion, or an objection — email sales@nugetkeep.com. A person reads it.

What we collect, and when

One form on this site collects personal data: the evaluation-licence request on the home and pricing pages. Nothing else on nugetkeep.com asks you for anything.

When you submit that form, we receive:

Your email address. Required — it's the thing we need in order to reply.
Your company name. Optional, free text. Leave it blank and nothing is lost.
The UTM parameters on the link that brought you here (utm_source, utm_medium, utm_campaign), if there were any. These tell us which post or README someone arrived from. They're recorded exactly as received.
Which page you submitted from — / or /pricing/.

That's the whole list. No cookie is set by the form, no profile is built, no tracking pixel is embedded in the confirmation email.

Nothing is stored until you click the link

The form is double opt-in, and the mechanism is worth describing precisely because it's unusual.

Submitting the form writes nothing, anywhere. Your submission is signed into a single-use confirmation link and emailed to the address you typed. The link is valid for 48 hours. If you never click it, we never record you — there's no "unconfirmed leads" list, because there's nowhere for one to live.

Clicking that link is the only action that records anything. Since clicking it requires access to the mailbox, nobody can put your address on our list but you.

One thing worth knowing: to send you that confirmation email at all, we have to hand your address to our email provider (Resend) at the moment you submit — before you've clicked anything. Resend keeps its own delivery logs. So "nothing is recorded until you click" is true of our records and not of theirs. If you submit the form and never confirm, your address still passed through Resend's logs and ages out under their retention, not ours.

Why we're allowed to do this

Your consent, under Article 6(1)(a) GDPR. Clicking the confirmation link is the consent, which is why we bother with the two-step flow instead of just writing the address down.

You can withdraw it at any time by emailing sales@nugetkeep.com, and withdrawing is as easy as giving it — one email, no form, no account, no reason required. Withdrawal means deletion: we don't keep a suppression copy of your address.

What we use it for

To email you about a NuGetKeep evaluation licence, and to have the conversation that follows if you want one.

That is the entire purpose. Specifically, it is not:

a newsletter — there isn't one, and you won't be added to one later
a marketing automation sequence, a drip campaign, or a scoring model
data for sale, rent, or sharing with anyone outside the processors listed below

No licence key is issued automatically. A person reads your request and replies.

Where it's stored, and who else touches it

A confirmed request is stored as a customer record in Stripe, tagged so we can find it. Stripe already handles NuGetKeep payments, so this is the same system of record we were using before — there is no separate lead database and no second copy of your address.

The processors involved:

Processor	What it handles	Where
Stripe	The stored record: your address, company name, UTM values, which page converted, and the dates you submitted	United States
Resend	Delivery of the confirmation email, and its own delivery logs	United States
Fly.io	Runs `billing.nugetkeep.com`, which receives the form and handles the confirmation click	Paris, France
Netlify	Serves every page of this website. To do that it receives each request: your IP address, your browser's user agent, the page URL and the time. Your email address never reaches it — the form posts straight to Fly.io	United States, served from a global edge network
Umami Cloud	Counts page views, and an event when you click the evaluation-request button or a pricing plan button. Cookieless, and the events carry a name only — no email address, no company name, no form contents	United States, with servers in the United States and the EU

Two of these touch the website rather than you: Netlify serves the pages, and Umami counts the visits. The other three only come into it once you have actually used the form.

Stripe, Resend, Netlify and Umami process personal data in the United States. Our data processing agreement with each of them incorporates the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), which is the safeguard for those transfers. Stripe and Resend are additionally certified under the EU–U.S. Data Privacy Framework.

Because Stripe already processed NuGetKeep payment data before this form existed, adding the form introduced no new transfer of personal data outside the EU.

Our application logs deliberately omit your email address. When a request is confirmed we log the Stripe customer ID and the UTM values, so that the logs are not a second, unmanaged copy of somebody's email.

Your IP address

Three different things see your IP address, and they are worth separating, because only one of them is ours.

Loading any page on this site. Netlify serves nugetkeep.com, so every page you open is a request to Netlify's edge, and that request carries your IP address — that is simply how the page reaches you. Netlify records it in its own server logs. Those logs are Netlify's, kept under Netlify's own retention policy rather than ours, and we have configured no export of them, so we never receive or hold a copy. This happens on a plain visit, before you have touched any form.

Submitting the form. The form posts directly to billing.nugetkeep.com, which runs on Fly.io in Paris — your email address never passes through Netlify. Fly.io's proxy terminates that connection, so it sees your IP address in the same unavoidable way.

The rate limit on the form. We rate-limit submissions to stop someone using the form to send mail in volume. That check is the only place we handle your IP address, and it handles it in memory only: it holds the address for up to ten minutes in order to count your submissions, writes it to no log and no database, never stores it alongside your submission, and loses it entirely whenever the server restarts.

So, plainly: your IP address is written down in Netlify's logs for the ordinary act of loading a page, and it is not written down anywhere by us.

Analytics

We measure page views with Umami Cloud. It is cookieless: no cookie is set, no identifier is stored on your device, and nothing is used to recognise you across visits or across sites. It counts pages, referrers and countries in aggregate.

Because it is a hosted service rather than something we run, the page view goes to Umami — cloud.umami.is — rather than to us. Two things on the site also send an event when you click them: the evaluation-request button, and the plan buttons on the pricing page. Those events carry a name and nothing else. No email address, no company name, and no part of what you typed into the form.

How long Umami keeps those counts is set by the plan we are on with them rather than by us, and we will state the period here once we have confirmed it. It is separate from the twenty-four months described below, which applies only to an evaluation request you submitted and confirmed.

There is no tracking profile to opt out of, because none is built.

How long we keep it

24 months after the date of your most recent request, then we delete the record.

The reason is the shape of the decision you're making. Choosing where an organisation's packages live is a long evaluation — it goes through a security reviewer, a procurement cycle and a renewal date on an existing contract. Someone who asked in March and went quiet is routinely still live in the following February. A 6-month window would delete people who are simply waiting for their Artifactory renewal.

Resubmitting the form restarts the 24 months from the new date. The clock runs from your most recent request, which is a date we actually store — not from "last contact", which we don't.

You don't have to wait for it. Ask and it's gone.

Your rights

Under the GDPR you can ask us to:

give you a copy of what we hold (access)
fix it if it's wrong (rectification)
delete it (erasure)
stop using it while something is disputed (restriction)
hand it over in a portable form (portability)
stop entirely (objection, and withdrawal of consent)

Email sales@nugetkeep.com. We'll action it within one month, as the GDPR requires, and in practice much faster — the record is a single Stripe customer, so deleting it takes one action.

If you think we've handled your data badly, you can complain to the Belgian Data Protection Authority — the Autorité de protection des données / Gegevensbeschermingsautoriteit — at dataprotectionauthority.be, or to the supervisory authority in your own EU country.

Two more things

Giving us your address is entirely voluntary. NuGetKeep Community is free to self-host and needs no account, so you can run the product without ever telling us who you are. The form exists because evaluating the paid features needs a licence key and a key needs somewhere to be sent. Nothing is withheld from you for leaving the form alone.

No automated decision-making. Nothing about your request is decided by a machine. There is no lead score and no automatic qualification — a person reads it.

Changes to this notice

If we change what we collect or why, we'll change this page and move the date at the top. The page is in version control, so the history is real.