Draft of 13 November 2026, not yet reviewed by a lawyer. Version privacy-2026-11.
Privacy notice for the sandbox
This notice explains which personal data we process when you sign up for and use the sandbox at https://sandbox.hub.linnerprogramming.com, why, for how long, and what rights you have.
Who is responsible
Linner Programming, [legal form and address], stefan@linnerprogramming.com. [Review: a data protection officer, if one is required.]
What we process
- Your sign-up: your work email address, name, company and country, the time of the sign-up, the IP address and browser (user agent) it came from, and the versions of the terms of use and of this notice that you accepted.
- Your login: your email address and password in our user directory. We never see your password.
- Your use of the sandbox: when you log in and start sessions, what you deploy and when (the platform's audit trail), the logs of your sessions and apps, and the host names your code connects to through the sandbox's proxy.
- What you create in the sandbox: your files, apps and their data. Please use demo data only (terms of use, section 3).
The check on the sign-up page (ALTCHA) runs in your browser and on our server. It sets no cookie and sends nothing to anyone else. The sign-up page sets no cookies. The sandbox itself sets the cookies its login needs.
Why, and on what legal basis
- To provide the sandbox you asked for, send you your login, a reminder before the end and a note at the end: Art. 6(1)(b) GDPR.
- To keep the sandbox secure and free of abuse (limits per network, the record of what you accepted, logs, the proxy's log): our legitimate interest, Art. 6(1)(f) GDPR.
- To answer if you reply to one of our mails: Art. 6(1)(b) or (f) GDPR.
We do not use your data for advertising, do not sell it, and make no automated decisions about you. We may write to you once about the platform after your sandbox ends; you can tell us not to. [Review: whether this needs consent.]
How long
- What you create in the sandbox and your session data: deleted when the sandbox ends, after 14 days.
- Your login: disabled when the sandbox ends, deleted 30 days later.
- Logs of the sandbox: 90 days; the audit trail of deploys: one year.
- The record of your sign-up and acceptance: three years after the sandbox ends, as proof of what was agreed. [Review: the period.]
Who receives it
The sandbox runs on a server of Hetzner Online GmbH in [Review: the data centre's country, Germany or Finland]. Logins are managed by Amazon Cognito and mails sent through Amazon SES, both in the AWS region Frankfurt (eu-central-1), under our data processing agreement with Amazon Web Services EMEA SARL. Amazon is part of a US group; transfers to the US, should they occur, rely on the EU-US Data Privacy Framework and the standard contractual clauses. If you use Claude Code or Posit Assistant, what you send to them goes to Anthropic or Posit under your own agreement with them; they are responsible for it.
Your rights
You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable form, and to object to processing based on our legitimate interest. Write to stefan@linnerprogramming.com. You may also complain to a data protection authority, [Review: the one responsible for us].