Privacy Policy
Version 1.0 — in force from 30 October 2026. This policy is also published in Spanish; if the two differ, the Spanish version prevails.
This Policy explains which personal data Felix Daniel Coca Calvimontes, trading as Bastion Solutions (the "Provider"), processes when running Ramphast, its website ramphast.io and its panel app.ramphast.io, and in what capacity.
1. Two different roles
- As the partners' processor. A partner uses Ramphast to manage its Clients' Odoo. The data of those Clients and their users belongs to the partner, and the Provider processes it on the partner's instructions and under the Data Processing Agreement the partner accepts in the panel. If you are a partner's Client, the partner is the controller of your data, and the one you should contact first.
- As controller. The Provider processes on its own account the data it needs for its relationship with the partners. This Policy is mostly about that data.
2. Data the Provider processes as controller
| Data | Why | Basis |
|---|---|---|
| Name, email, language and role of each partner's staff | giving access to the panel, notices and support | the contract with the partner |
| IP address, browser, date and time of each sign-in and action | security and audit | legitimate interest and contractual obligation |
| The partner's billing data that Paddle passes on (name, email, country, payment status) | charging and keeping track of subscriptions | the contract and tax law |
| Support conversations with the partner | helping it | the contract |
| Usage indicators of the Service per partner (counts, durations and sizes) | running and improving the Service; kept for three months and never sold or passed on | the contract |
The panel uses no advertising or third-party tracking cookies: only the session cookie and the CSRF protection cookie it needs to work. The website ramphast.io uses no cookies and no analytics.
3. Payments
Payments are processed by Paddle.com Market Ltd. ("Paddle") as merchant of record. Paddle collects card and billing details as an independent controller, under its own privacy policy. The Provider never receives card details.
4. Who it is shared with
With the subprocessors that provide the Service, and with authorities when a competent order requires it. The Provider does not sell personal data.
| Subprocessor | Why | Location |
|---|---|---|
| Contabo GmbH | hosting the panel and its database | Germany |
| Cloudflare, Inc. | serving the website and the panel, and storing the panel's encrypted backups | United States and global network |
| Mailtrap (Railsware) | sending the panel's email | United States and European Union |
Some of them process data outside Bolivia, under the contractual safeguards they offer.
5. How long it is kept
For as long as the relationship with the partner lasts and thirty (30) days after it ends, the period it has to export its data. It is then deleted, except the records of payments, subscriptions and acceptance of the Terms, which are kept as evidence and for as long as the law requires. Usage indicators, three months. Audit logs, one year.
6. Rights
Anyone can ask for access to their data, its correction, deletion or portability, and object to its processing, by writing to privacy@ramphast.io. Where the Provider processes the data as processor, it forwards the request to the partner that is the controller and helps it answer. The Provider answers within 15 business days.
7. Security
The panel encrypts the credentials it stores and its backups, requires a second verification to sign in, and records every action of the partners' staff.
8. Changes
Changes are published here with their date. Those that affect partners are announced as clause 17 of the Terms of Service says.
9. Contact
Felix Daniel Coca Calvimontes, trading as Bastion Solutions. Santa Cruz de la Sierra, Bolivia. privacy@ramphast.io.