Privacy

Controller

IT-Trail GmbH, Schärdinger Straße 15, 4061 Pasching, Austria (FN 642899s, Landesgericht Linz). Managing director: Markus Furtlehner. Privacy contact: datenschutz@ittrail.at. See the imprint.

The short version

• This marketing site sets no cookies, runs no analytics or trackers, and loads no third-party resources — every font, stylesheet and script, the drop component on the landing page included, is served from this domain.
• The interactive demo on the landing page runs entirely in your browser: it is the real component in demo mode, so dropped files are not transmitted anywhere and the claim ticket it shows is simulated.
• The hosted service works without an account; accounts are optional and store the minimum needed to run them.
• Paid plans are charged through Stripe; card details never reach us. Accounts are held on our own identity platform, not on a third party's.
• To keep phishing and scams off the service, uploads are checked automatically, and where sites and accounts are created and changed from is recorded for 90 days — on our own servers, seen only by us.

This website (sitebin.io)

Server logs

When you visit, the web server processes your IP address, access time, requested page, transferred bytes and browser/OS information. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in operating and securing the service. Logs are deleted automatically after 14 days. Hosting: Hetzner Online GmbH, on servers in the EU.

The hosted service (app.sitebin.io)

Anonymous sites

Publishing needs no account. We store the files you upload, the site's settings, and an Argon2id hash of the edit password (the password itself is never stored and cannot be recovered). Server logs as above. Legal basis: Art. 6(1)(b) GDPR — providing the service you request. Anonymous site creation is rate-limited per IP address; the counters exist only in memory and are not kept. Like every site, an anonymous one records the address and browser it was created and changed from, for 90 days — see Provenance below.

Accounts and sign-in (the IT-Trail SaaS Stack)

Accounts for app.sitebin.io are held on the IT-Trail SaaS Stack, the identity, consent and billing platform we operate ourselves at auth.ittrail.cloud. It is run by IT-Trail GmbH — the same controller as this policy — and is not a third party. You sign in there with an email address and password, or through one of the social sign-in providers offered on the login page; if you use a social provider, that provider tells us your email address and name and we store which provider it was and the identifier it uses for you. The identity platform stores:

• your email address and name, and whether the address is verified;
• a hash of your password (for email/password sign-in) — never the password itself;
• the linked social identity, if you use one (provider and provider-side user id);
• your consent records: which version of the platform terms, the Sitebin terms and, for business customers, the DPA you accepted or declined, with date and time;
• your active sessions and devices (browser, IP address, last access), and second factors you set up;
• which applications on the platform you have access to and which OAuth clients (for example an AI agent connected over MCP) you have authorised.

app.sitebin.io itself stores the account identifier issued by the identity platform, your email address, your current plan, the sites you own, your API tokens (as SHA-256 hashes), and when the account was created and last changed. A sign-in session is a signed cookie your browser holds, not a record on our side, and signing out invalidates every session of the account at once; what is recorded about sign-ins is only the abuse-prevention record described under Provenance. Legal basis for all of this: Art. 6(1)(b) GDPR — the account contract; for the consent records, Art. 6(1)(c) in conjunction with Art. 7(1) GDPR — our duty to demonstrate consent.

Transactional email

The identity and billing platform sends you the emails that running an account needs: address verification and password reset; subscription started, renewed, upgraded, downgraded, cancellation scheduled and ended; payment failed; and, for Enterprise customers, licence issued, renewed and expiring. Legal basis: Art. 6(1)(b) GDPR. There is no marketing email and no newsletter, and your address is not used for advertising.

Payments (Stripe)

Paid plans are charged by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. The checkout page is Stripe's: your card or bank details are entered there and go to Stripe only — we never receive or store them. Stripe receives from us your email address, the plan and amount, and the identifier of your account; it collects from you your name, billing address and, for businesses, VAT ID. We receive back the Stripe customer and transaction identifiers, the payment status, the card brand and last four digits, the billing country and address, and the invoices. Legal bases: Art. 6(1)(b) GDPR (performing the contract) and Art. 6(1)(c) GDPR (tax and bookkeeping obligations). Stripe acts as our processor for the checkout and as an independent controller for its own purposes — fraud prevention, regulatory obligations — as described in Stripe's privacy policy. Stripe may transfer data to its group companies outside the EU under the EU standard contractual clauses.

Content you publish (sitebin.app and custom domains)

Sites you publish are stored on our servers and served from *.sitebin.app — a domain separate from the application, so that published content cannot read or set anything on the app — or from a custom domain you attach. They are served to whoever requests the URL according to your settings: view passwords and expiry are under your control, and a random site URL is hard to guess but not secret. Visitors of your sites generate server logs as above (14 days). You are responsible for the content you publish; where it contains other people's personal data and you act as a business, we process it on your behalf under the Data Processing Agreement. When you attach a custom domain, we request a TLS certificate for it from a publicly trusted certificate authority, which records the domain name in public certificate-transparency logs.

Forms on your sites

On paid plans a site can have forms whose submissions we email to an address the site's owner chose and which confirmed, by clicking a link we sent it, that it wants those messages. When a visitor submits such a form, we receive what they typed and the files they attached and send it as one email to that address. We keep no copy of a submission: it is not stored on our servers, and our logs record only that a form was used — the site, the form, the size and the number of files, and, as for every request, the time and the sender's IP address, kept for 14 days. The recipient's address and the form's settings are stored with the site until the owner deletes the form or the site. The site's owner decides what the form asks and is responsible for informing their visitors; where the owner acts as a business, we process submissions on their behalf under the Data Processing Agreement. Until the recipient confirms, nothing is forwarded to them; every forwarded message carries a link with which they stop the messages at any time.

Provenance: where sites and accounts are changed from

Phishing and scam pages are published by people who come back under a new account or a new site within hours. To recognise them, and to show that several accounts are one operator, we record for every site creation and every write to a site — an upload, an edit, a settings, domain or form change, a file deletion — the client IP address, the user agent (browser or tool), the time, the surface it came through (web, API, MCP, upload link, WebDAV or FTP), the kind of credential used, what changed (a file count and the first file names, which settings) and, where there is one, the account. For accounts we record the IP address, user agent and sign-in method of the sign-up and of recent sign-ins, the IP address and user agent that created each API token (with the token's name), and which sites the account created and deleted. This applies to anonymous sites as well. Merely viewing or reading a site is not recorded, and each log keeps at most its last 100 entries.

Each record is kept for 90 days after its latest entry and then deleted. A site's records are deleted earlier together with the site, and an account's together with the account — except that the account's own record of having created and deleted a site stays for its 90 days, and an entry made on someone else's site with that site's edit password stays with that site. The records made under your account are part of its data export. While a site is locked, or an account is suspended, for abuse, their records are kept longer — at most 180 days, and beyond that only while a case is still open (see Locked sites). Only the operator sees them, in the instance's administration console; they are never shown to visitors or to other users. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in preventing abuse of the service, keeping it secure, and answering abuse reports from hosting providers and authorities. You may object (Art. 21 GDPR); we then weigh your particular situation against that interest.

Automated abuse checks

What is uploaded to a site is checked automatically, on every write and before it goes live, for the signatures of known phishing and scam kits — for example a password field combined with a way of sending it to another server, or a payment-app link to a third party's account. The check runs on our own server; no content is sent to anyone else for it. What matched — the rule, the file name, a short excerpt and a fingerprint of the file — is stored with the site. On the free tiers a clear match locks the site automatically: it is no longer served and cannot be changed until a person has reviewed it; on paid plans a match is only flagged for review. The operator is notified of every match by email. A person reviews every automatic lock and lifts it when it was wrong; the lock is never a final decision about you. If you believe your site was locked by mistake, write to abuse@sitebin.io — you can always ask for a person to look at it and state your point of view. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in protecting visitors and the service from fraud.

Abuse reports

Anyone can report a site through the report form, the report endpoint described in the API documentation, or to abuse@sitebin.io — see report abuse. A report stores the reported address, the reason and what the reporter wrote, the time, and only the reporter's network — the first 24 bits of an IPv4 address or 48 bits of an IPv6 address, never the full address. The reporter's email address is optional; when given, it is stored with the report and used only to ask about it or to answer. Every report is forwarded by email to the people who handle abuse. The stored report is deleted after 14 days; the email copy, and whatever became part of an abuse case, is kept as long as handling that case needs (see Locked sites). Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in keeping the service free of abuse.

Content-security reports

Sites on the free tiers are served with a content-security policy that stops a page from sending what visitors type to another server. When a page tries, the visitor's browser sends us a violation report about the site. We keep, per site, the number of reports, the distinct destinations that were blocked, and the number of distinct reporting networks — not the reporting addresses, and nothing else from the report. A report that shows a page trying to reach a known collection point of phishing kits — and whose destination the site's own files really name — locks the site automatically and notifies the operator, as described above. These figures are kept with the site and deleted with it. Legal basis: Art. 6(1)(f) GDPR — protecting visitors and the service.

Locked sites

A site that is locked for abuse is kept, with its provenance records, as evidence — for as long as handling the case, establishing, exercising or defending legal claims (Art. 17(3)(e) GDPR), or answering an authority requires, and at most 180 days after the lock unless a case, investigation or proceeding is still open then. While it is locked, neither it nor the account that owns it can be deleted by its owner; once the site is deleted, the account can be. The provenance records of an account we have suspended for abuse, or of one that owns a locked site, are kept past their 90 days only up to 180 days after each entry, and longer only while a case about one of its locked sites is still open. Legal basis: Art. 6(1)(f) GDPR; where we are obliged to preserve or hand over data, Art. 6(1)(c) GDPR.

Cookies on the app

Only what the service needs to function: a session cookie when you sign in — valid for 7 days, renewed while you use the dashboard, and invalidated for every session of the account when you sign out — a short-lived cookie when you unlock a view-protected site, and the identity platform's own session cookies on auth.ittrail.cloud while you sign in. No marketing or tracking cookies.

Retention

• Server logs: 14 days.
• Abuse reports: 14 days, holding only the reporter's network prefix and, if given, their email address — longer only as part of an open abuse case.
• Provenance records (IP address, user agent and surface of site creations and writes; sign-up, sign-in and API-token addresses): 90 days after the latest entry, or until the site or account is deleted — up to 180 days while a lock or suspension for abuse holds them, and longer only while a case is still open.
• Content-security report figures: with the site.
• Locked sites and their records: as long as the abuse case needs them, at most 180 days unless a case is still open.
• Sign-in sessions: 7 days from last use, held only in your browser's cookie.
• Anonymous sites: removed after 24 hours; expired sites of any tier: files deleted 24 hours after expiry; backups rotate within 30 days.
• Account data: for the life of the account, then 30 days after deletion. Consent records survive deletion only as an anonymous count per document, version and day.
• Billing records and invoices: 7 years (statutory retention, §132 BAO).

Recipients

Our processors are Hetzner Online GmbH (EU hosting of the service and your sites) and, for paid plans, Stripe Payments Europe, Ltd. (payments, as described above). Beyond those, personal data leaves us only when the law requires it — for example on a lawful request by an authority — when a site's visitors request the content you chose to publish, or in an abuse case: then we may report the site, its content and the data we hold about it to the competent authorities (Art. 6(1)(c) or (f) GDPR), and report the infrastructure it relies on — a collection server, a bot, a mailbox, a payment account — to the registrars, hosting, messaging and payment providers involved. We do not sell or share personal data for advertising. All processing is in the EU, with the exception noted for Stripe.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and to withdraw any consent with effect for the future (Art. 7(3) GDPR).

Most of it is self-service: in the account console (reachable from your dashboard) you can correct your name and email, see and end your sessions, unlink a social identity, download an export of your personal data including your consent records, and delete your account. Every site can be exported as a ZIP and deleted from its edit page or the dashboard at any time. Deleting the account removes your identity, your sessions, your sites and their provenance records; invoices stay for the statutory retention period, and a site locked for abuse stays for the period described above, which holds the account's deletion until it ends.

For anything else, or if you do not have an account, contact datenschutz@ittrail.at. You may also lodge a complaint with the Austrian Data Protection Authority: Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, dsb.gv.at, or with the supervisory authority of the country where you live.

Status: 29 September 2026. This policy will be updated when the hosted service adds processors or processing activities. Related documents: terms of service · data processing agreement · imprint.