# Privacy Policy > **Related:** [Administration: admin console and Admin REST API](https://issuerd.org/administration.md) · [Agentic IAM: securing MCP tool calls with DPoP and token exchange](https://issuerd.org/agentic-iam-mcp.md) · [Backup, restore, and upgrade](https://issuerd.org/backup-and-upgrade.md) · [Human step-up approval for agent actions: CIBA](https://issuerd.org/ciba-step-up.md) · [Client integration](https://issuerd.org/client-integration.md) · [Clustering — Multi-Node Issuerd](https://issuerd.org/clustering.md) · [Configuration](https://issuerd.org/configuration.md) · [Deployment](https://issuerd.org/deployment.md) · [Issuerd operations documentation](https://issuerd.org/docs-overview.md) · [Getting started: installation and first login](https://issuerd.org/getting-started.md) · [Identity brokering](https://issuerd.org/identity-brokering.md) · [LDAP Group Mapping and Token Claims](https://issuerd.org/ldap-group-mapping.md) · [One approval, one exact operation: securing agent-native IAM administration with MCP](https://issuerd.org/mcp-exact-operation-approval.md) · [MCP server](https://issuerd.org/mcp-server.md) · [Monitoring: health probes, metrics, logging, and audit events](https://issuerd.org/monitoring.md) · [Passing the OpenID conformance suite with zero unexpected warnings: what it actually takes](https://issuerd.org/openid-conformance.md) · [Issuerd Performance](https://issuerd.org/performance.md) · [Provisioning](https://issuerd.org/provisioning.md) · [Security](https://issuerd.org/security.md) · [Issuerd Trademark Policy](https://issuerd.org/trademark.md) · [Troubleshooting](https://issuerd.org/troubleshooting.md) · [User federation: LDAP, Kerberos, and Active Directory](https://issuerd.org/user-federation.md) > **Also:** [HTML version](https://issuerd.org/privacy) · [Docs index](https://issuerd.org/llms.txt) --- **Last Updated: October 2, 2026** At issuerd.org, we are deeply committed to privacy, transparency, and data minimization. This website is a static informational resource hosted on [Cloudflare Pages](https://pages.cloudflare.com). This Privacy Policy explains how we handle technical infrastructure data. We do not use cookies, we do not track you across the web, and we do not collect personal identifiers (such as names or email addresses) when you browse this website. --- ## 1. Controller The controller responsible for data processing on this website within the meaning of Art. 4(7) GDPR is: > **Controller:** The individual entrepreneur operating the website issuerd.org. > Email: privacy@issuerd.org *The controller processes no personal data through this website beyond the transient technical data described in Sections 2–3. Under Art. 13 GDPR, the controller's full identity is disclosed upon any substantiated data subject request via the email above.* --- ## 2. No Cookies — and What Your Browser Stores for This Site - **No cookies:** This website does not place any cookies on your device; no script on this site reads or writes cookies. - **Theme preference (`localStorage`):** If you explicitly choose a light or dark theme in the site's theme selector, that single choice is stored in your browser's `localStorage` under the key `starlight-theme` (value: `light` or `dark`). It contains no identifier, is never transmitted to us or to anyone else, and persists until you clear your browser storage or switch the theme back to the system setting. If you never touch the theme selector, nothing is written. - **Sidebar state (`sessionStorage`):** The documentation sidebar remembers its scroll position and which sections you expanded, using your browser's `sessionStorage`. This state is limited to the current browser tab, is deleted automatically when you close the tab, and is never transmitted. - **No tracking storage:** We do not use `localStorage`, `sessionStorage`, IndexedDB, or any other browser storage to track you, and nothing on this site fingerprints your browser. - **No third-party trackers:** Our pages load no advertising pixels, social widgets, external web fonts, or third-party tracking scripts. Every site asset and script is served from our own domain. The single exception is the cookieless Cloudflare Web Analytics beacon described in Section 3. - **Client-side search:** The documentation search runs entirely in your browser against an index downloaded from our own domain; your search queries are never sent to a server. - **No forms, no accounts:** This website offers no contact forms, comment sections, newsletter subscriptions, or user accounts. We therefore hold no personal data about you beyond the transient technical data described in Section 3. The functional storage entries above exist solely to provide a feature you explicitly request (your chosen theme) and to keep navigation consistent within a tab. They fall under the "strictly necessary" exemption of Art. 5(3) of the ePrivacy Directive and therefore do not require consent. --- ## 3. Data Processed by Our Infrastructure When you visit issuerd.org, our hosting provider, [Cloudflare, Inc.](https://www.cloudflare.com), processes basic technical connection data in order to securely deliver our pages. This processing occurs at Cloudflare's edge network and is governed by [Cloudflare's Privacy Policy](https://www.cloudflare.com/privacy-notice/) and the EU Standard Contractual Clauses. The data categories involved are: - **Infrastructure Metrics:** HTTP request types (e.g., GET, POST), response status codes (e.g., 200, 404), and data volume transferred. - **Cookieless Web Analytics:** We use Cloudflare Web Analytics to understand aggregate site usage. A lightweight measurement beacon served by Cloudflare reports page-view events — page URL, referrer (the external site you arrived from, if your browser transmits it), approximate country of origin, device class (desktop, mobile, tablet), browser/operating system type, and performance metrics (Core Web Vitals: page load and responsiveness timings). Cloudflare Web Analytics is explicitly privacy-preserving: it uses **no cookies and no client-side state**, does not fingerprint visitors, and does not make full IP addresses available to us. - **Security Processing:** Transient edge processing of connection data (including IP addresses) by Cloudflare for delivery, bot mitigation, and DDoS protection, limited to what is technically necessary. **Retention:** Aggregated metrics are retained by us for up to 12 months. Transient connection logs retained by our hosting provider are deleted according to Cloudflare's standard retention periods (typically within 30 days). --- ## 4. Legal Basis for Processing (GDPR) To the extent that network-level data constitutes personal data under the GDPR, the legal basis for processing is **Legitimate Interest (Art. 6(1)(f) GDPR)**. This technical processing is necessary to: 1. Ensure the stability, speed, and global availability of the website; 2. Protect the website infrastructure against malicious network traffic, bots, and DDoS attacks; 3. Measure aggregate, anonymized site usage in order to improve the documentation; and 4. Diagnose and fix technical errors. We have weighed these interests against your rights and freedoms and concluded that no less intrusive means are available to achieve the same purposes. No automated decision-making or profiling (Art. 22 GDPR) takes place. --- ## 5. Data Subject Rights Under the GDPR, you have the right to: - **Access** (Art. 15) — request information about any personal data we process about you; - **Rectification** (Art. 16) and **Erasure** (Art. 17) — request correction or deletion; - **Restriction** (Art. 18) and **Data Portability** (Art. 20); - **Object** (Art. 21) — object to processing based on legitimate interest; - **Lodge a complaint** with a supervisory authority (Art. 77) — in particular in the EU member state of your habitual residence. Because we do not store personal identifiers, we may not be able to associate technical log data with you directly; please include approximate visit timestamps when exercising access rights. Contact: privacy@issuerd.org. --- ## 6. International Data Transfers Cloudflare processes technical data on servers located globally, including outside the European Economic Area. Such transfers are safeguarded by Cloudflare's adherence to the EU-U.S. Data Privacy Framework and/or EU Standard Contractual Clauses. --- ## 7. Third-Party Links Our website includes links to external platforms, notably our public codebase on GitHub. Once you leave issuerd.org, your interactions are governed by the privacy policy of that specific third-party platform. --- ## 8. Security Vulnerability Reports As an open-source security project, we take vulnerabilities seriously. If you discover a security issue, please reach out to us privately at security@issuerd.org. *Note: Any information provided during voluntary security disclosures will be processed strictly for the purpose of remediating the reported issue and then deleted.* --- ## 9. Changes to This Policy We may update this policy to reflect changes in our infrastructure or legal requirements. The "Last Updated" date above indicates the current version. --- *This policy reflects our current technical setup — a static site with no cookies, only strictly functional browser storage, and cookieless aggregate analytics — and should be reviewed by qualified legal counsel if issuerd.org begins collecting personal data in any form.*