Name: Glass Desktop Box™
Brand: Glass Desktop Box™

One-time purchase administration distinguishes the purchase reference, licence and device assignment, first successful activation and online entitlement expiry. ProBox Duo activation periods are recorded separately per licence. Online expiry does not automatically erase all contract data: evidence needed for continuing local usage rights, statutory retention and legal claims remains purpose-bound. Actual technical processing and deletion periods must be verified before publication.

Order and licence records also identify the selected Standard or XXL variant and its monthly relay allowance. ProBox Duo assigns the allowance separately to each licence. These details support delivery and administration of the chosen service. Choosing XXL does not permit additional access to your local files or settings or additional storage of file contents. The stated purposes, legal bases and retention rules continue to apply; technical implementation and deletion periods must be verified before publication.

This one-time offer applies to new purchases. Existing contracts and acquired rights are not automatically changed. Starter Plus is no longer offered for new purchases. Earlier subscriptions retain their agreed terms and cancellation routes.

1. Controller

controller within the meaning of the General Data Protection Regulation (GDPR) is:

Michael Hans-Josef Höhne, trading under the trade name “Rangsdorfer Software Company”

Sole proprietorship

Akazienweg 13

15834 Rangsdorf

Germany

Email: support@glassdesktopbox.com

Website: https://glassdesktopbox.com ↗

The most current published version of this Privacy Policy is available at https://glassdesktopbox.com/privacy ↗.

2. Scope

This privacy policy applies to:

the glassdesktopbox.com website including download, pricing, support, FAQ, P2P and cancellation / cancellation features;
the desktop application Glass Desktop Box™ for the supported operating systems;
License activation, license verification and usage-based quota management;
Remote invitations, signaling, direct peer-to-peer connections, and technically required relay/TURN connections;
Support, contract processing, withdrawal, termination and refunds.
Desktop Experiences, public experience and animation links, and the selection of external sharing destinations;

Third-party websites and services that are merely linked are not included. The data protection information of the respective provider applies to these.

3. Principles and legal bases

We process personal data for a specific purpose, transparently and limited to the necessary extent. Depending on the processing, we rely on:

Art. 6 Paragraph 1 Letter a GDPR – Consent;
Art. 6 Paragraph 1 Letter b GDPR – Initiation or fulfillment of a contract;
Art. 6 Paragraph 1 Letter c GDPR – Fulfillment of legal obligations;
Art. 6 Para. 1 lit. f GDPR – legitimate interests, in particular secure operation, error analysis, protection against misuse and fraud as well as legal defense;
§ 25 TDDDG – Storage of information or access to information in the end device, unless absolutely necessary or expressly consented to.

4. Website provision and server logs

The website available at glassdesktopbox.com is operated on Hostinger infrastructure. Our contractual hosting processor is Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. Hostinger's Data Processing Addendum supplements the hosting agreement and is accepted electronically within the customer relationship.

When the website is accessed, Hostinger and the involved web servers may process technical request and security data, including the connection IP address, date and time, requested URL and HTTP method, HTTP status, data volume, referrer, browser and user-agent details, device or operating-system information, routing information and security events. The purposes are website delivery, stability, error diagnosis and protection against attacks. The legal basis for our processing is Article 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of the website.

Hostinger determines the retention of infrastructure access and security logs under its contractual, security and legal requirements. We have not activated any additional advertising, marketing or personalised analytics logging on the website. The separate, data-minimised reach measurement is explained below and does not replace these infrastructure log notices.

5. Hosting, license and connection infrastructure at Hetzner

For server, license, signaling and TURN/Relay services, Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Depending on the service, Hetzner processes data as processor; Hetzner may be responsible for its own legal or security purposes.

Connection and server protocols, IP addresses, timestamps, technical session and license data as well as temporarily encrypted data packets for relay connections may be affected. The basis is Article 6 Paragraph 1 Letters b and f GDPR; If necessary, agreements are concluded with processors in accordance with Art. 28 GDPR.

The specific technical configuration of the productive Hetzner project, the contractual order processing regulations, server locations, backups, sub-processors and deletion periods are documented in the internal directory of processing activities and in the technical security documents and updated in the event of changes.

6. Technically required device storage, cookies and similar technologies

Privacy-friendly reach measurement

We measure visits when our server delivers a page. The browser sends no additional analytics request. We use no analytics cookies, device storage, persistent identifiers, cross-site tracking or visitor profiles. Automated requests are filtered using technical request information; one network connection is counted at most once per day. This is an estimate of likely human visits, not an exact count of people.

Reach measurement processes IP addresses and browser identifiers to detect automated requests and estimate city and country. The private dashboard at Hostinger does not store raw IP addresses or full browser identifiers in its statistics fields. Daily pseudonyms prevent duplicate counting. These visitor identifiers are pruned when statistics are written or read, retaining today and yesterday by Berlin time; independent deletion within 48 hours is not guaranteed. Daily and overall counts, rounded location data and last-recorded timestamps are retained separately; these data and purchase-deduplication identifiers currently have no automatic expiry. They should not all be regarded as anonymous. Separate infrastructure logs are covered in section 4. The legal basis for reach measurement is Article 6(1)(f) GDPR, the legitimate interest in data-minimised measurement of usage and regional demand.

You may object to this measurement at any time by emailing support@glassdesktopbox.com with the subject ‘Privacy – reach measurement objection’. We will review your request and explain the available options. Already aggregated figures cannot generally be assigned to an individual or removed individually.

According to the tested development status, simply opening the new Next.js website does not require cookie consent for your own analysis, advertising or marketing purposes. The fonts mentioned in Section 7 are delivered from your own website files. External YouTube content will only be loaded after the express consent described in Section 8.

If a new function saves or reads cookies or other information in the end device in the future, it will be evaluated before use in accordance with Section 25 TDDDG and GDPR. Non-essential technologies will only be activated after consent; This declaration is then supplemented with name, provider, purpose and term.

7. Locally provided fonts

The new Next.js website uses the Inter and Dancing Script fonts through Next.js' built-in font management. When the website is created, the font files are included in your own website files and then delivered by your own web server. When you visit the finished website, no connection is established to Google Fonts or Google servers. No IP addresses or other visitor data are transmitted to Google for the display of the fonts. Consent in accordance with Article 6 Paragraph 1 Letter a GDPR or Section 25 Paragraph 1 TDDDG is not required for this.

8. YouTube videos

Videos from YouTube can be embedded on individual pages. The provider in the EEA is generally Google Ireland Limited. When loading an embedded player, IP address, device and browser data, page accessed, times, cookie identifiers and, for logged in users, account data may be transmitted to Google.

The embedding only takes place with consent in accordance with Article 6 Paragraph 1 Letter a GDPR and Section 25 Paragraph 1 TDDDG. Consent can be revoked in the future.

YouTube videos are integrated via a two-click solution. No YouTube player is loaded before an explicit selection. After consent, the player is loaded from youtube-nocookie.com; consent can be revoked in the future.

External YouTube links do not establish a connection before they are selected. Embedded players remain technically blocked and use a locally hosted poster until voluntary consent is given. Only then is the player loaded from youtube-nocookie.com to play the requested video. Google Ireland Limited may process IP address, device, browser, page, time, cookie identifiers and usage information; transfers outside the EEA cannot be excluded. The legal basis is consent under Article 6(1)(a) GDPR and, where information is stored on or read from the device, Section 25(1) TDDDG. Consent can be withdrawn at any time through the permanently accessible privacy settings. Further information: https://policies.google.com/privacy ↗ · https://www.youtube.com/howyoutubeworks/user-settings/privacy/ ↗

Links to YouTube, LinkedIn, X or other third-party sites generally do not transmit any data to these providers when they are simply displayed. Users only leave our offer when they click on it; The target provider then processes data under its own responsibility. According to current testing, we do not use any social plugins that transmit data when the page is accessed.

External links from the software

After the user's explicit confirmation, Glass Desktop Box can open the official website https://glassdesktopbox.com ↗ in the default browser. This function does not establish a connection to the website before confirmation and does not transfer files or file contents from any Box.

When the website is opened, the browser sends the connection data technically required for the page request to our web server and hosting provider. This may include the IP address, date and time, requested address, browser and operating-system information and, where applicable, referrer information. The information in this Privacy Policy concerning website operation and server logs applies.

10. Nox Support Assistant

To prevent excessive requests, the Nox server keeps an identifier formed from the connection IP address and a shortened browser identifier, request counters and timestamps in memory. These counters contain no questions or answers. Entries are removed during request-driven cleanup or when the server process ends; closing your browser does not immediately delete these server-side security counters. This processing prevents abuse under Article 6(1)(f) GDPR.

Nox Support Assistant processes the entered question and, if applicable, the previous question to generate an answer from a local knowledge base. No external AI models or AI APIs are addressed. Prompt content, questions, IP assignments, answers and conversation histories are not permanently stored by us or merged into a user profile. The visible messages only exist temporarily in the memory of the opened browser page and are discarded when closed or reloaded. Entries are limited to a technical maximum length.

Please do not enter special categories of personal information, passwords, license keys or sensitive content there. Technical web server and security logs can capture request metadata. The legal basis is Art. 6 Para. 1 lit. b GDPR for product-related inquiries, otherwise Art. 6 Para. 1 lit. f GDPR.

10a. No AI processing in the delivered application

Glass Desktop Box™ and the Nox support assistant do not use a generative AI model, an external AI API, an emotion recognition or a biometric categorization at runtime according to the currently confirmed product status. Nox answers questions based on rules or knowledge from locally provided content. User files, chat messages, and support questions are not used to train general AI models.

AI-supported tools were used in development, text, image and video creation. This does not result in user data being processed by AI within the delivered application. For publicly provided, significantly AI-generated or AI-manipulated media, a separate identification and provenance process will be set up in accordance with Article 50 of Regulation (EU) 2024/1689 from August 2, 2026. Artistic and fictional content is marked in an appropriate manner that does not impair use.

For supplied and publicly displayed media, the provider maintains an internal media and rights inventory with time of creation, tools used, degree of processing, release and chain of rights. To the extent that Article 50 of Regulation (EU) 2024/1689 is applicable, artificially generated or manipulated content will be marked in a suitable, visible and - if technically necessary - machine-readable form from August 2, 2026. The application itself does not process user data using generative AI.

11. Downloads and updates

The application can retrieve a version file served over HTTPS at startup, at specified intervals, or upon explicit command. In particular, the IP address, time, HTTP request data, current program version, update channel and - if technically included in the retrieval - operating system, platform architecture and language can be processed. File names, box contents and user files are not included in the update check. The legal basis is Article 6 Paragraph 1 Letter b GDPR for contractual provision and Article 6 Paragraph 1 Letters c and f GDPR for legally required security updates, secure operation and protection against misuse.

Installation packages are checked before execution using published checksums and - as soon as they are available in production - a digital signature. Server logs are only created in accordance with Section 4. A personal usage or update history is not created for advertising or profile creation.

Bug, security and feature updates are not limited to a fixed six-month period. They can be published at any time. The application may request a running instance to safely save and exit; License and box data should remain outside the program folder.

The production version file is retrieved via https://glassdesktopbox.com/updates/stable.json. It can include version, channel, release time, tiered release quota, mandatory status, release notes, and platform-specific installer metadata with file size and SHA-256 checksum. The usual server data including IP address, time and HTTP information are required for the HTTPS request. The local rollout mapping is hashed from device name, user name, and target version; this local initial value is not transmitted to the update server. A package will only be installed within the allowed size limit, after a complete download and a successful checksum check; The digital signature is also checked in the productive Windows channel. If a check fails, the installer will not start.

12. Local processing in the desktop application

Box states, positions, display options, selection tabs, local references, recovery information, transfer journals and temporary protection copies are generally processed on the end device. The application is not intended to upload files to a general cloud without a user-triggered remote function.

Local data is under the control of the respective device owner. For shared or company-used devices, the operator is responsible for access rights, backups and the admissibility of the content.

Under Windows, productive user-related configuration, box, session, recovery and license data resides separately from the program folder in the Windows areas for roaming and local application data, respectively, under the application name GlassDesktopBox; Test installations use a separate test area. Temporary update packages are only in the local temporary area. Uninstalling the Program Files does not automatically delete user data unless the user specifically chooses to remove it. macOS and Linux have not yet been published as of this statement; their final storage locations will be supplemented in the respective product documentation and this declaration before they are made available.

12a. Desktop Experiences, animations and sharing function

Desktop Experiences consist of locally supplied or user-selected backgrounds, colors, box arrangements and animations. Applying an experience is generally done locally. The user's own images and videos are not automatically transmitted to Glass Desktop Box or social media platforms.

The share function is currently intended solely for the supplied Desktop Experiences and animations. It creates a public, language-specific link to a page on glassdesktopbox.com and, at the user's request, opens the sharing interface or web address of a third-party service selected by the user, such as WhatsApp, Telegram, Facebook, LinkedIn, X or email. Glass Desktop Box does not sign the user in to that platform, receive access tokens or transmit a recipient list. The selected platform determines which data it processes under its own service.

When the public link is opened, the usual server data in accordance with Section 4 is created on glassdesktopbox.com. As of now, no personalized share codes, recipient profiles, opening, download or purchase assignments are created. A later reach or conversion measurement may only be activated after a separate data protection and consent check.

User-uploaded images or videos will not be branded with Glass Desktop Box or published via this marketing sharing feature. The user can only share media outside the application with the operating system or third-party functions they have chosen and remains responsible for this.

After a conscious selection, the current sharing function opens public sharing channels from WhatsApp, Telegram, Facebook, LinkedIn and X, creates an email or uses the clipboard or the available operating system share. The official experience or animation link and the message text approved by the user are transferred. No platform credentials, OAuth tokens, or recipient lists are sent to Glass Desktop Box. Your own user images and videos are excluded from this official recommendation function.

12b. ProBox animation synchronization

During a shared ProBox session, a technical identifier for an included animation, along with playback speed and loop mode, can be transmitted to the authorized participants in the session. Each participant starts the media file that is already supplied locally on their own device; the large video file is not transferred over the session. When joining, the current animation state can be resubmitted.

Own uploaded videos remain local and are not streamed or copied to ProBox participants. The host receives a message about this; Depending on the version, other participants see a still image, the static box background or no animation. Changes and removals of a supplied animation can be communicated to connected participants as session state.

The legal basis is Article 6 (1) (b) GDPR. Only the technical information required for the shared status as well as session and connection data in accordance with Sections 14 to 18 will be processed; Your own video content is not part of this synchronization.

13. Licence activation and permanent device binding

For activation, device binding, function activation and misuse prevention, the following can be processed:

cryptographic hash and masked representation of the license key;
internal customer and license identifier, tariff, status and validity;
Device identifier and device name reported by the device;

On first successful activation, a single-seat licence is permanently assigned to exactly one device. Transfer to another device, parallel use or self-deactivation for reactivation is not currently provided. Activation and verification events are processed to prevent misuse and maintain a traceable licence status. Support may investigate a demonstrably incorrect technical assignment; this does not create an entitlement to a device change or an additional seat.

Activation, change and check times;
Software version, platform and required technical metadata;
IP address and security-related events;
Activation events and number of allowed devices.

The legal basis is Article 6 Paragraph 1 Letter b GDPR and Article 6 Paragraph 1 Letter f GDPR. Our legitimate interest is to protect against license abuse and the integrity of the service.

The license level used during activation and the associated quota are managed as contract and authorization status. The technical information required for activation, runtime, device assignment, function release and quota is processed. A single-user license is assigned to exactly one active device; Raw license keys are not stored on the server side, but are managed as a checksum value and masked representation.

14. Remote invitation and signaling

To establish a remote connection, the signaling service processes, depending on the function, in particular:

Session identifier, role as host or guest and expiration time;
hashed PIN or hashed session token;
License and eligibility status;
Device identifier, device name and optional display name;
public IP address, connection times and socket /connection status;
requested function, log messages and error / security events.

The data is used to set up, authorize, maintain and terminate the session as well as to prevent misuse. The legal basis is Article 6 Paragraph 1 Letters b and f GDPR.

15. Direct P2P connections (WebRTC)

As far as technically possible, files and collaboration data are transferred directly between the end devices involved. ICE, STUN, TURN, SDP and RTCPeerConnection can be used for WebRTC. For technical reasons, the public IP address is known to the connection partner or their end device and is processed by signaling /STUN systems.

With a direct connection, our servers generally do not receive the complete file content. Signaling, license, quantity and security metadata can still be processed on the server side. Host and guest decide for themselves what content they share with each other.

Website, license, update and signaling connections are protected via HTTPS and TLS respectively. Supported direct transfers use the transport encryption provided by the WebRTC-/P2P method; If relay is technically required, data packets are only processed for forwarding. This does not promise general zero-knowledge or uniform end-to-end encryption across all functions. The specific protection depends on the function, platform and connection path.

16. TURN/Relay as an alternative connection

If a direct P2P connection is not possible or unstable, encrypted data packets can be temporarily routed via a TURN-/ relay server. The server processes IP addresses, ports, session and authentication data, times, data volume and temporarily the packets to be transported. Permanent cloud file storage is not the purpose of this function.

The legal basis is Article 6 Paragraph 1 Letter b GDPR; Security and capacity protocols are also based on Art. 6 Para. 1 lit. f GDPR.

Transfer relay buffers are distinct from connection logs, session state, usage counters and backups. Ending a transfer does not automatically delete these other data. See section 27 for retention details.

17. Files, chat, workspaces and file metadata

Remote functions allow content such as files, folder structures, file names, sizes, types, modification times, hashes, selection tabs, messages and status messages to be transferred between host and guest. The users involved determine the content and legality. We do not use this content for advertising, profiling or content analysis purposes.

Depending on the connection type, content is transmitted either directly by P2P or temporarily via a relay. It is not intended for permanent storage on our servers.

Users may not transmit unlawful content, malware, unauthorized personal data or content that violates the rights of third parties.

18. Browser-based HTTPS transfer and local protection features

Browser-based HTTPS transfers serve file sharing, not permanent cloud file storage. Transferred contents are distinct from technical connection, allowance and reservation data. Completion or cancellation does not automatically delete all related metadata, counters, logs and backups. Sections 19 and 27 explain usage measurement and retention. Local resume, transfer-journal and recycle-bin data in the desktop application are separate; their cleanup depends on the respective local feature.

19. Transfer volume and quotas

To bill or enforce tariff-dependent transmission limits, license / customer ID, billing month, tariff and transferred byte quantities can be processed. It is not necessary to save file contents or file names for pure quantity measurement.

Your plan’s monthly relay allowance applies per UTC calendar month. Unused allowance does not carry over. The month changes at 00:00 UTC on the first day of the following month, not one month after activation.

Direct P2P transfers do not reduce your relay allowance. However, technical transfer data such as connection route, result, byte count and duration may also be reported to the server and aggregated for direct ProBox transfers. This telemetry contains no file contents and is separate from relay allowance accounting.

20. Abuse, fraud and attack detection

If necessary, to protect users, systems and licenses, we process IP addresses, timestamps, session, device and license identifiers, failed connection or activation attempts, unusual request sequences, data volumes, rate limit events, blocks and technical error data.

Purposes are in particular:

Detection and mitigation of automated attacks, brute force attempts and denial of service;
Prevention of unauthorized license transfer, manipulation and circumvention of quotas;
Protection against malware transmission and misuse of remote functions;
Resolving security incidents and preserving evidence;
Enforcement or defense of legal claims.

The legal basis is Article 6 (1) (f) GDPR; In the case of statutory reporting or information obligations, additionally Art. 6 Para. 1 lit. c GDPR. If there are specific suspicions, data can be transmitted to the necessary extent to security service providers, legal advisors, courts or responsible authorities. There is no general monitoring of the content of private files.

21. Orders and Paddle as Merchant of Record

New purchases are exclusively one-time purchases: no subscription is created, no automatic renewal is triggered and no subsequent charge is initiated. References to subscription or cancellation data in this section concern only the administration of earlier subscription contracts, where such data exists. For new one-time purchases, we instead process the necessary purchase, licence, activation, service-period, withdrawal and refund data. The twelve-month online service period ends without cancellation and does not trigger another purchase.

The sale of paid licenses takes place according to the intended checkout structure via Paddle as merchant of record and contractual partner of the buyer for payment. Paddle processes, under its own responsibility, in particular name, email address, billing address, country, tax /VAT information, shopping cart, price, currency, payment method, transaction, subscription, withdrawal, termination, refund, IP, device and fraud prevention data.

We receive from Paddle only the order, customer, tax, subscription and status data required for contract, license deployment, customer service, quota and entitlement management. We do not receive complete card or PayPal access data.

The Paddle company specified in the specific Paddle checkout, in the order confirmation and on the payment receipt is relevant. The current Buyer Terms linked there and the Paddle Privacy Notice apply to Paddle. The legal basis for our processing is Article 6 Paragraph 1 Letters b and c GDPR and Article 6 Paragraph 1 Letter f GDPR. To the extent that Paddle processes data under its own responsibility, Paddle decides on the relevant purposes, legal bases, recipients and international transfers.

Upon purchase, payment and billing information is processed within Paddle Checkout. Paddle acts as a merchant of record and handles payment collection, tax calculation, invoicing, refunds and chargebacks according to the conditions displayed in the checkout. The Paddle company specified in the respective checkout and receipt is relevant. Glass Desktop Box only receives the transaction, product, status and customer references necessary for license provisioning, contract management, support allocation and accounting; full card or PayPal credentials are not processed on proprietary systems.

22. Payment with PayPal within the Paddle checkout

If the buyer selects PayPal within the Paddle checkout, PayPal processes the account, device, financial and transaction data required for payment, identity / risk verification and legal compliance under its own responsibility. The PayPal Privacy Policy is relevant. We do not receive PayPal passwords and fundamentally no complete payment instrument data.

PayPal can process data worldwide and, according to its own statement, uses, among other things, intra-group agreements, standard contractual clauses or other legal transfer instruments.

23. Withdrawal, termination and refund functions

When you activate a cancellation or termination buttons or a refund request, we process and if necessary Paddle:

Name, email address and customer /Order number;
affected license or subscription;
Explanation, selected action and optionally communicated reason;
Time, confirmation and delivery status;
technical evidence such as IP address and log entry, to the extent necessary for secure assignment and evidence;
Refund, deactivation and communication status.

The purpose is to receive and implement the declaration, license / contract management, fulfill legal obligations and provide evidence. The legal basis is Article 6 Paragraph 1 Letter b and c GDPR and Article 6 Paragraph 1 Letter f GDPR.

For a contract concerning digital content not supplied on a tangible medium, a consumer's right of withdrawal expires under Section 356(6) of the German Civil Code (BGB) only if the consumer has expressly consented to performance beginning before the end of the withdrawal period, has acknowledged that the right of withdrawal is lost when performance begins, and has received a contract confirmation on a durable medium under Section 312f BGB. Merely accepting the Terms is not sufficient. For legal proof, we store the wording and version of the separate declaration, locale, UTC timestamp, product and price reference, Paddle transaction correlation, contract confirmation and time of supply, using only the personal data required for that purpose (Art. 6(1)(b) and (c) GDPR).

If these requirements are met and the software or license was provided immediately, a later withdrawal with regard to the provision that has begun is excluded. statutory remedies for defects remain unaffected. A termination, on the other hand, only ends a current contract extension at the legally relevant time; it is not a withdrawal and does not cancel a service period that has already been effectively provided and paid for.

24. Support and email

The twelve-month period stated here is an intended deletion policy. Its consistent implementation, including closure dates, exceptions and email backups, has not yet been verified; we therefore cannot promise technically assured deletion after twelve months. This does not permit indefinite storage or restrict your data protection rights.

New Light/Starter purchases do not include personal application support by email, including individual setup or usage advice. The published contact channels, including support@glassdesktopbox.com, remain available for defects, purchase or licence delivery problems, withdrawal and refund requests, and privacy, security and accessibility matters. Statutory claims and previously agreed rights remain unaffected. General references to term-bound support do not grant additional application support for Light/Starter.

When we contact you, we process sender and contact details, content and time of the message, associated customer-/License-/ order data as well as voluntarily transmitted screenshots, diagnostic or log files. Please remove any unnecessary personal or sensitive information prior to submission.

The legal basis is Art. 6 Para. 1 lit. b GDPR for contractual reference, otherwise Art. 6 Para. 1 lit. f GDPR. As far as legal evidence is concerned, Art. 6 Paragraph 1 Letter c GDPR applies.

Intended retention policy: general enquiries unrelated to a contract and resolved accessibility enquiries are scheduled for deletion no later than twelve months after closure. Individual records needed for contract performance, statutory retention, ongoing proceedings or legal claims remain subject to the relevant purpose-specific retention and limitation periods. The lack of verification of practical implementation explained above also applies to this policy. Contact: support@glassdesktopbox.com.

24a. Accessibility requests and support needs

If you report a digital barrier or request an accessible alternative, we process your name or alias, contact method, affected page or function, description of the barrier, date and status of processing, and voluntarily provided information about the device, operating system, browser or assistive technology. Screenshots, recordings and diagnostic information will only be processed if you submit them voluntarily and they are necessary for the review.

The purposes are to address and remove barriers, to provide an accessible alternative, to fulfill legal proof and accessibility obligations, and to improve the website, checkout, contract processes and software. The legal basis is Art. 6 Para. 1 lit. c GDPR in conjunction with BFSG and BFSGV, Art. 6 Para. 1 lit. b GDPR for contractual reference and Art. 6 Para. 1 lit.

25. Recipients and roles

Recipients can – only to the extent necessary – be:

Hetzner and other technical processor;
Paddle as Merchant of Record and independently controller;
PayPal if selected as payment method;
Email, signature, update or security service providers;
Tax advisors, legal advisors, auditors, banks;
Authorities and courts in the event of a legal obligation or for legal defense;
the remote communication partner selected by the user.

When used for operational purposes, the using company is generally responsible for its employee, customer and project data. Host and guest may each bear their own data protection responsibility for the content they select and transmit. If Glass Desktop Box processes personal data on behalf of a business customer, it must be checked before use whether an agreement in accordance with Art. 28 GDPR is required.

For business customers who process personal data of third parties on their own responsibility, an agreement in accordance with Art. 28 GDPR including technical and organizational measures as well as the sub-processors used is provided - insofar as Glass Desktop Box acts legally as processor. Where Glass Desktop Box only enables a direct P2P connection and does not provide access to the content, host and guest remain responsible for the choice, legal basis and content of their transmission.

Regional connection infrastructure and third-country processing

The processor for server infrastructure is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. In addition to the German default infrastructure, an isolated regional data node exists in Ashburn, Virginia, USA, at https://us-east.signal.glassdesktopbox.com ↗. Its public technical reachability does not mean regular customers are already routed there: customer routing is currently disabled and Germany remains the default region.

If a region is expressly approved and assigned later, technically necessary connection IP addresses, pseudonymous licence and device subjects, short-lived session and routing data, transport metadata, relay usage counters and, during TURN, HTTPS or emergency relay, encrypted transfer data in transit may be processed. Payment data, complete licence keys, email content and the writable commerce/licence database are not stored on the US node. Session state and relay payload are intended only for the current connection; data-minimised operational aggregates, infrastructure logs and backups are subject to separate operational deletion and backup cycles.

Use of the US node constitutes third-country processing. Customer data may be routed there only after the requirements of Articles 44 et seq. GDPR have been documented for the specific processing, including the applicable transfer mechanism, any necessary supplementary safeguards, the Hetzner data processing agreement and the current subprocessor list. Until that evidence and the complete signed end-to-end test are complete, regular customer routing to Ashburn remains disabled. Existing consents or contracts are not silently extended to a new processing location.

26. Third country transfers

We prefer processing in Germany or the European Economic Area. Paddle, PayPal, Google/YouTube or their subcontractors may be transferred to the United Kingdom, the USA or other third countries. It only takes place if the requirements of Article 44 ff. GDPR are met, for example due to an adequacy decision, suitable guarantees such as EU standard contractual clauses or a legal exception. Further details can be found in the data protection information of the respective recipient.

27. Storage period

During the twelve-month online term, we need the purchase, plan, licence and device association, activation and expiry times, and usage data needed to account for monthly relay usage. These allow us to provide your purchased services and check the remaining monthly allowance. A new allowance month does not mean all earlier usage records are deleted. After the online term ends, purchase and licence evidence may remain necessary for your continuing local usage rights, statutory retention and legal claims. This does not permit blanket indefinite retention of all usage data and logs. File contents are separate from these administrative data; licence and allowance management does not require permanent storage of your transferred files. Logs and backups are covered separately in this section.

We only store data for as long as the respective purpose exists and there are no legal or legitimate reasons to the contrary:

The following overview describes purposes and retention criteria, not verified automatic deletion processes. For session tokens and credentials, expiry means the end of usability, not deletion of all related records. Ending a signalling session does not automatically delete logs, usage counters or backups either. The actual technical limitations are explained below the table.

Data category	Principle
Ephemeral session tokens/PIN-/TURN credentials	until expiration or end of session
Active signaling data	basically until the end of the session plus the technically necessary short follow-up time
Local box, journal and protection data	until deletion, cleanup or uninstallation by the user according to the local product logic
License and contract master data	for contract duration; then according to legal proof and limitation periods
Invoice and accounting documents	according to statutory commercial and tax retention periods
Support communication	until completion and then after the required proof / limitation periods
Proof of cancellation, termination and refund	as long as necessary for legal fulfillment and defense of claims
Security and abuse-prevention logs	only as long as necessary for defense, investigation and legal defense
Proof of consent	for the duration of use and thereafter as long as proof is legally required

The current operation does not guarantee uniform automatic deletion of all technical logs after 14 days or activation events after 90 days. The German server also has weekly rotating log copies. Certain payment events and completed delivery jobs are currently configured for 3,650 days; purchase evidence has individually stored expiry dates. This does not mean that this period is required by law. No general automatic deletion period has been verified for licence records, activation events or monthly usage counters. Backups have separate retention cycles; deleting an active record does not simultaneously delete all backup copies. Statutory retention obligations and your data protection rights remain unaffected.

Manual file handling without automatic content analysis

The application does not automatically analyse or classify user files by their content, nor does it independently assign, move, remove or share them. You decide which files or folders are assigned to a Box or shared. This is distinct from technically necessary local background processes such as recovery, synchronization, licence checks and update checks; the data processed for those purposes is described in this privacy notice.

28. Automated decisions and profiling

According to the current product status, we do not make exclusively automated decisions with legal or similarly significant effects and do not create advertising profiles. Technical rate limits or security blocks can be automated; a legitimate review can be requested via support.

Paddle or PayPal may make automated risk, fraud, compliance or payment decisions under its own responsibility. Details and rights can be found in their data protection information.

29. Data security

We use appropriate technical and organizational measures in accordance with Art. 32 GDPR. This may include transport encryption, hashed license / session secrets, ephemeral credentials, access restrictions, security event logging, rate limits, updates and backup measures.

No transmission and no system can guarantee absolute security. Users are jointly responsible for their choice of content, device protection, access data, operating system updates, malware protection and independent data backups.

The technical and organizational measures include, in particular, role- and purpose-related access rights, separate test and production environments, secure management of environment variables and keys, TLS-protected transmission, size and misuse limits, logging of security-relevant events, checksum and signature verification of updates, secured recovery processes, regular updating of components used, and a procedure for receiving, evaluating and resolving reports Vulnerabilities. Details are maintained risk-related in internal security documents.

30. Data breaches

Data protection violations are assessed, documented and - to the extent required by Art. 33 GDPR - reported to the responsible supervisory authority within the statutory deadline. If the risk is expected to be high, affected persons will be informed in accordance with Art. 34 GDPR. Reports of suspected security incidents can be directed to support@glassdesktopbox.com.

30a. Security notifications and the Cyber Resilience Act

For reports of vulnerabilities and security incidents, name or alias, contact details, affected version and platform, technical description, dates, log excerpts and voluntarily submitted evidence may be processed. Please do not submit user files or personal content unless this is absolutely necessary for the review.

The legal bases are Art. 6(1)(c) GDPR for compliance with statutory cybersecurity, documentation and reporting obligations and Art. 6(1)(f) GDPR for secure error analysis, coordinated vulnerability handling, protection of users and the establishment, exercise or defence of legal claims. Where necessary, information may be disclosed to hosting or security service providers, the competent CSIRTs, ENISA, market-surveillance authorities or law-enforcement authorities. Data is retained only for as long as necessary for remediation, evidence, statutory reporting and applicable limitation periods.

The reporting obligations for actively exploited vulnerabilities and serious security incidents in accordance with Article 14 of Regulation (EU) 2024/2847 apply from September 11, 2026; The other main obligations of the regulation generally apply from December 11, 2027.

Security reports can be sent to support@glassdesktopbox.com with the subject “Security Report”. The provider documents receipt, criticality, affected version, remediation actions, and required notifications. The legal reporting processes for actively exploited vulnerabilities and serious security incidents will be converted into a formal coordinated vulnerability disclosure and escalation procedure at the latest when they come into force.

31. Rights of data subjects

Affected persons have the right to:

Information (Article 15 GDPR);
Correction (Art. 16 GDPR);
Deletion (Article 17 GDPR);
Restriction of processing (Article 18 GDPR);
Information of recipients (Art. 19 GDPR);
Data portability (Art. 20 GDPR);
Objection (Art. 21 GDPR);
withdrawal consent for the future (Art. 7 Para. 3 GDPR);
Protection against exclusively automated decisions (Art. 22 GDPR).

Inquiries should be directed to support@glassdesktopbox.com. To prevent unauthorized information, we may request appropriate proof of identity. Rights may be subject to legal restrictions.

32. Special note on objection

If data is processed on the basis of Art. 6 Para. 1 lit. f GDPR, you can object at any time for reasons arising from your particular situation. We will then no longer process the data unless there are compelling legitimate reasons or grounds for asserting, exercising or defending legal claims. According to the current status, direct advertising does not take place; Any use can be objected to at any time without giving reasons.

33. Right of appeal

You can complain to a data protection supervisory authority. The person responsible is in particular responsible for:

The Brandenburg State Commissioner for Data Protection and the Right to Inspect Files

Stahnsdorfer Damm 77

14532 Kleinmachnow

Email: Poststelle@LDA.Brandenburg.de

Website: https://www.lda.brandenburg.de ↗

34. Minors

The offer is not aimed specifically at children. Contracts for paid licenses may only be concluded by persons with legal capacity or with the necessary consent. If we become aware of children's data that has been processed unlawfully, it will be deleted after checking, unless there is an obligation to retain it.

35. No sale or advertising use of file contents

We do not sell personal information. Shared file, chat, or workspace content is not used to build advertising profiles, train general AI models, or provide personalized advertising.

36. Changes

We adapt this statement if functions, service providers or legal situation change. Significant changes will be announced in an appropriate manner. The published version with date is relevant.

Relay allowance and counting

Light includes 1 GB, Starter 5 GB and ProBox 25 GB of relay file transfer per month. ProBox Duo includes two independent licences with 25 GB each, not a shared pool. Direct P2P transfers do not consume this allowance; availability depends on connection conditions. Light and Starter share files through a browser; ProBox and ProBox Duo additionally support shared Boxes on each participant’s desktop. All participants need a ProBox licence for that feature. All four plans permit private and commercial use.

ProBox and ProBox Duo each offer Standard and XXL variants. Standard includes 25 GB of relay file transfer per month per licence; XXL includes 50 GB. ProBox XXL costs a one-time €99.00 net for one licence; ProBox Duo XXL costs €169.00 net for two independent licences with 50 GB each, not a shared 100 GB pool. These are total XXL prices before tax, not surcharges on Standard. The same twelve months from each licence’s first successful activation, local usage rights and other base-plan terms apply. The selection is shown before purchase. It does not change existing contracts or create an automatic switch or prorated upgrade entitlement.

37. Contact

Privacy requests: support@glassdesktopbox.com

Michael Hans-Josef Höhne

Rangsdorfer Software Company