Last updated: March 2026
Byte8 Ltd ("we", "us", or "our") is the data controller for the Cargoman service, a private Composer registry for PHP teams. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our website and services.
By using Cargoman, you acknowledge that your personal data will be processed as described in this policy. Where we rely on consent as a lawful basis, you may withdraw that consent at any time.
All payment processing is handled by Stripe, Inc., which is PCI DSS Level 1 certified. We do not store your full credit card number, CVC, or expiry date. From Stripe, we receive and store:
Author names and email addresses embedded in composer.json files and git commit history. This data is part of the cryptographic integrity of published packages and cannot be deleted without compromising the software supply chain. See Section 8 for details.
We process your personal data only where we have a lawful basis under GDPR Article 6(1). The table below sets out each purpose, the data categories involved, and the corresponding lawful basis.
| Purpose | Data Used | Lawful Basis (GDPR Art. 6) |
|---|---|---|
| Provide the Service | Account, Payment, Package data | Contract (Art. 6(1)(b)) |
| Process payments | Payment data | Contract (Art. 6(1)(b)) |
| Send service notifications | Contract (Art. 6(1)(b)) | |
| Improve the Service | Usage, Technical data | Legitimate Interest (Art. 6(1)(f)) |
| Analytics (website) | Cookies, Technical data | Consent (Art. 6(1)(a)) |
| Security & fraud prevention | Technical, Usage data | Legitimate Interest (Art. 6(1)(f)) |
| Legal compliance | All categories | Legal Obligation (Art. 6(1)(c)) |
| Package integrity | Package metadata | Legitimate Interest (Art. 6(1)(f)) |
These cookies are strictly necessary for the operation of our service and cannot be disabled.
| Cookie | Purpose |
|---|---|
better-auth.session_token | Authentication session |
cargoman_cookie_consent | Stores your cookie consent preference |
These cookies are only loaded after you accept analytics cookies via our consent banner.
| Cookie | Purpose |
|---|---|
_ga | Google Analytics 4 - Distinguishes unique visitors |
_ga_* | Google Analytics 4 - Maintains session state |
You can manage your cookie preferences at any time through our cookie consent banner, which is accessible from the footer of every page. You may also control cookies through your browser settings. Note that disabling essential cookies may prevent you from using the service.
We do not sell your personal data. We share data with the following third-party service providers (sub-processors) who process data on our behalf.
| Provider | Purpose | Location | DPF / Adequacy |
|---|---|---|---|
| Hetzner Online GmbH | Compute & Database | Germany (EU) | EU-native |
| Cloudflare, Inc. | CDN, DNS, DDoS protection | Global (EU processing) | DPF Certified |
| Cloudflare R2 | Package storage | EU (Frankfurt) | DPF Certified |
| Provider | Purpose | Location | DPF / Adequacy |
|---|---|---|---|
| Stripe, Inc. | Payment processing | United States | DPF Certified |
| Amazon SES | Transactional email | EU (Frankfurt) | DPF Certified |
| Google LLC | Website analytics (GA4) | United States | DPF Certified |
We maintain a current list of sub-processors at cargoman.io/legal/subprocessors. We will notify customers at least 30 days before adding any new sub-processor, giving you the opportunity to object.
Our primary infrastructure is located in Germany (EU). Where your data is transferred outside the UK or EU, we rely on the following safeguards:
You may request a copy of the relevant transfer safeguards by contacting [email protected].
We retain personal data only for as long as necessary for the purposes set out in this policy, or as required by law.
| Data Type | Retention Period | Reason |
|---|---|---|
| Account data | Account lifetime + 30 days | Service provision |
| Payment records | 7 years after last transaction | UK tax and accounting law |
| Usage / download logs | 90 days | Analytics and debugging |
| Audit logs | 90 days (1 year for Pro+) | Security and compliance |
| Package metadata | Indefinite | Software supply chain integrity |
| Support correspondence | 2 years | Service improvement |
This data is processed under Legitimate Interest (Article 6(1)(f)) for the following purposes:
Deletion of this data would compromise the security guarantees we provide to all users of the registry. This approach is consistent with industry practice established by GitHub, GitLab, npm, and Packagist, all of which retain commit metadata indefinitely.
We have conducted a Legitimate Interest Assessment (LIA) for this processing. You may request a copy of this assessment by contacting [email protected].
If you are located in the United Kingdom or European Union, you have the following rights under the UK GDPR and EU GDPR:
| Right | Description |
|---|---|
| Access (Art. 15) | Request a copy of your personal data. We will respond within 30 days. |
| Rectification (Art. 16) | Request correction of inaccurate or incomplete personal data. |
| Erasure (Art. 17) | Request deletion of your data. Subject to exceptions for immutable package metadata (see Section 8) and legal obligations. |
| Restrict Processing (Art. 18) | Request that we limit how we process your data in certain circumstances. |
| Data Portability (Art. 20) | Receive your data in a structured, machine-readable JSON format. |
| Object (Art. 21) | Object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds. |
| Withdraw Consent (Art. 7) | Withdraw consent at any time for processing based on consent (e.g., analytics cookies). This does not affect the lawfulness of prior processing. |
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. If we need additional time, we will inform you of the reason and extension period (up to 60 additional days).
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
To exercise these rights, contact [email protected].
If you are a Canadian resident, you have the following rights under the Personal Information Protection and Electronic Documents Act (PIPEDA):
To exercise these rights, contact [email protected].
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction.
| Measure | Implementation |
|---|---|
| Encryption in transit | TLS 1.3 |
| Encryption at rest | AES-256 |
| Password hashing | Argon2 |
| Access tokens | Hashed with SHA-256 |
| Access control | Role-based access controls (RBAC) |
| Security audits | Regular internal and external audits |
| Security guidelines | OWASP Application Security Verification Standard |
No method of electronic storage or transmission is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee absolute security. If you discover a security vulnerability, please report it to [email protected].
Our service is not intended for users under 16 years of age. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected] and we will take steps to delete that information.
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings.
We encourage you to review this policy periodically. The "Last updated" date at the top of this page indicates when the policy was last revised.
If you are unhappy with how we handle your personal data, we encourage you to contact us first at [email protected] so that we can resolve your concern.
You also have the right to lodge a complaint with a supervisory authority:
If you have any questions about this Privacy Policy or our data practices, please contact us using the details below.