LicenseSeat and the GDPR: how we handle EU data protection
Software licensing involves processing your end users' personal data, so your licensing provider is a GDPR data processor. Here's exactly how LicenseSeat handles that, written for the compliance review you're about to run.
If you sell software into the EU and use a licensing service, that service processes personal data on your behalf: license keys tied to your customers, device fingerprints, activation IP addresses, sometimes emails. Under the GDPR that makes you the controller and your licensing provider a processor, and Article 28 says you need a written contract with that processor before any of it is lawful.
This page answers the questions your data protection officer (or your own compliance checklist) will ask about LicenseSeat, in the order they usually get asked. It exists because EU companies evaluating LicenseSeat kept asking the same seven questions, and they deserve public answers rather than an email exchange.
Do you provide a Data Processing Agreement (DPA / AVV)?
Yes. Our Data Processing Agreement is published, incorporated into our Terms of Service by reference, and automatically binding for every customer whose use of LicenseSeat involves personal data subject to the GDPR. No signature is needed on either side: it's already in force for your account the moment you use the service, the same deemed-execution mechanism used by Anthropic, Vercel, and Supabase (Art. 28(9) GDPR permits electronic form).
What we don't do is sign customer-specific copies, third-party templates, or custom data processing terms. We're a small, focused team, and one consistent, carefully maintained, always-current DPA for all customers is how we keep the service reliable. In German terms: the DPA serves as the Auftragsverarbeitungsvertrag (AVV) under Art. 28 DSGVO.
What personal data do you process?
For your end users, exactly what a licensing service needs and nothing more:
- License data: license keys, license status, activation status, seat usage
- Device data: hardware ID / device fingerprint, so licenses can be node-locked
- Network data: IP address at activation and validation, for fraud prevention
- Contact data: your end users' email addresses, only if you provide them (for license delivery and the customer portal)
- SDK telemetry: device model and type, OS name and version, CPU cores, RAM, app and SDK version, language, locale, timezone, and screen properties
The full inventory, in contractual form, is in Annex I.B of the DPA. Two things we deliberately don't do: we never collect precise GPS location (the approximate city-level location you see in analytics is derived from the IP address, locally on our servers, see below), and the DPA contractually prohibits putting special-category data (Art. 9 GDPR) into LicenseSeat, including through free-form metadata fields.
Where is the data stored and processed?
In the United States, and we'd rather tell you that plainly than bury it. Our servers run in Hetzner's Ashburn, Virginia datacenter (operated by Hetzner Online GmbH, a German company, through its US subsidiary), transactional email goes through Amazon SES in AWS us-east-1, our CDN is Cloudflare's global network, and encrypted nightly backups are stored with Backblaze in Reston, Virginia.
Is personal data transferred outside the EU/EEA, and on what legal basis?
Yes, and the transfer mechanism is the EU Standard Contractual Clauses. Our DPA incorporates the SCCs (Commission Implementing Decision (EU) 2021/914), Modules Two and Three, deemed executed together with the DPA, plus the UK International Data Transfer Addendum (B1.0) and the Swiss FADP adaptations. Every subprocessor in our chain processes data under a written agreement incorporating the SCCs or equivalent safeguards.
Are you certified under the EU-U.S. Data Privacy Framework?
No, and here's the honest context. The DPF never replaces the Article 28 DPA (the European Commission and the EDPB both state that a DPA is required regardless of a processor's DPF participation), so certification wouldn't change what you need from us. Like most infrastructure companies our size (and some much larger, including Anthropic), we rely on the Standard Contractual Clauses, which the EDPB confirms as a valid Chapter V transfer mechanism, and which don't depend on the political durability of any adequacy decision. Several of our subprocessors additionally hold their own DPF certifications; under our agreements with them, that's a supplement to the SCCs, not a substitute.
Can I review your subprocessors before signing?
Yes: the full list is public at licenseseat.com/legal/subprocessors: legal entities, purposes, and processing locations, with a last-updated date. We commit in the DPA to updating that page at least 10 business days before a new subprocessor touches customer personal data, and you can object on data-protection grounds. There are four subprocessors in the chain. That's the whole list.
How long do you keep the data?
Retention is enforced by scheduled jobs in code, not by policy documents:
- IP addresses on device activations: deleted 90 days after the activation is deactivated
- Telemetry IP addresses: deleted after 90 days
- Inactive dashboard sessions: removed after 12 months
- Download events: recorded without IP addresses or device identifiers at all, by schema
- Everything else: kept for the duration of your subscription, then deleted or returned per the DPA when you leave
What about data subject requests?
Most requests you can handle yourself, immediately, through the dashboard or API: access, correct, or delete licenses, activations, and end-user records. For anything you can't self-serve, the DPA commits us to assist, including with data protection impact assessments and supervisory-authority consultations, if your assessment of a rollout ever needs input about our side of the processing.
The short version for your compliance file
| Question | Answer |
|---|---|
| DPA / AVV | Published, auto-incorporated, in force on use, no signatures |
| Controller / processor roles | You: controller. LicenseSeat: processor (Modules Two & Three covered) |
| Processing location | United States (Hetzner Ashburn VA, AWS us-east-1, Cloudflare, Backblaze Reston VA) |
| Transfer mechanism | EU SCCs (2021/914) + UK Addendum + Swiss adaptations, incorporated in the DPA |
| DPF certification | No; SCCs relied on instead (DPA required either way) |
| Subprocessor list | Public, dated, advance change notice |
| Special-category data | Contractually prohibited |
| Breach notification | Without undue delay |
| Retention | Code-enforced; activation and telemetry IPs gone after 90 days |
If your DPO has a question this page doesn't answer, email [email protected], you'll get an answer from the people who actually run the infrastructure, usually the founder.