Privacy Policy

Last updated: 19 July 2026

1. Controller

DEKET OÜ (Westlume), Estonia, is the controller of personal data described here. Contact: hello@westlume.com.

2. What we process

• Account and order data: name, email, company details you provide when subscribing or contacting us.
• Billing: payments are processed by Stripe; we never see or store full card numbers. Stripe's privacy policy applies to payment data.
• Service metadata: for metering and support we log request timestamps, endpoint names and status codes of proxy calls.
• What we do not store: your service credentials (e.g. accounting API keys) live in your tenant's connections and are processed per request in memory only; request and response payloads are not stored.

3. Purposes and legal bases

We process data to provide and bill the service (contract), to respond to enquiries (legitimate interest) and to meet accounting obligations (legal obligation).

4. Retention

Account and billing records are kept as long as required by Estonian accounting law (generally 7 years). Service metadata is kept up to 12 months. Data is hosted on Microsoft Azure in EU regions.

5. Sharing

We share data only with processors needed to run the service: Stripe (payments), Microsoft Azure (hosting) and email delivery providers. We do not sell personal data.

6. Your rights

You may request access, correction, deletion or portability of your data, and object to or restrict processing, by emailing us. You may also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

7. Cookies

The website works without tracking cookies. If we add analytics, this policy will be updated first.