Privacy policy
Last changed 31 October 2026.
This policy covers apps.devolent.com, Devolent's customer portal for desktop tools and device software. It says what we keep about the people who use it, why, on what legal basis, and for how long.
Who is responsible
Devolent AB (company number 559408-7503), Scheelevägen 15, 223 70 Lund, Sweden, is the controller. Write to support@devolent.com.
Your account
There is no sign-up. We create each account by hand, so your name and email address come from you or from the organisation you work for.
- What we keep: your name and email address, a hash of your password (never the password itself), which apps your account may download, and when the account was created and last changed. If you turn them on, we also keep your authenticator secret, encrypted, your recovery codes as hashes, and each passkey's public key, its name and when it was last used.
- Why: to give you the software and keep your account safe.
- Legal basis: the contract with you (GDPR Art. 6(1)(b)). If your organisation is our customer, our legitimate interest in delivering to it and keeping its accounts safe (Art. 6(1)(f)).
- How long: until the account is deleted, which we do when you or your organisation ask us to, or once the customer relationship has ended. A deactivated account cannot sign in, but it stays until it is deleted. Deleting an account also deletes its sessions, download log and licence acceptances.
We need your name and email address to give you an account. Without them we cannot give you access to the portal.
Signing in
- What we keep: for each session, your IP address, what your browser says it is (its name, version and system), how you signed in, when the session started and when it was last used. You can see your sessions on your account's Security page and end any of them.
- Why: to keep you signed in, and to let you and us spot a session that should not be there. To stop password guessing we also count failed attempts by email address and by IP address. That count is held in memory only, for at most 15 minutes after the last attempt.
- Legal basis: our legitimate interest in keeping accounts safe (Art. 6(1)(f)).
- How long: signing out deletes a session at once. Otherwise it ends after 30 days at most, and its record is deleted within a day of that.
Cookies
The portal sets two cookies, and only when you sign in. session_token keeps you signed in for up to 30 days. login_pending lasts five minutes, while you enter a code from your authenticator app. Both are needed for signing in, so they need no consent. There are no analytics, advertising or tracking cookies, and every page loads its fonts, scripts and pictures from the portal itself.
Downloads
- What we keep: for each download, your account, the app and version or file, the time, your IP address and what your browser says it is. We also keep the file's SHA-256 checksum, which shows exactly which bytes you got. Your account's download history shows you this log, without the IP address and browser.
- Why: to know what was delivered to whom, so that we can support you, warn you about a faulty release, and notice an account being misused.
- Legal basis: our legitimate interest in delivering software safely and securing it against misuse (Art. 6(1)(f)).
- How long: the IP address and browser are erased after 12 months. The rest stays until the account is deleted.
Licence acceptance
An app can come with a licence that you accept before your first download.
- What we keep: your account, which version of the licence you accepted, and when.
- Why: to be able to show that the licence was accepted.
- Legal basis: the licence agreement (Art. 6(1)(b)), and our legitimate interest in being able to show it (Art. 6(1)(f)).
- How long: until the account is deleted.
Server logs
These cover everybody who visits, with or without an account.
- What we keep: the web server writes a line for each page or file it sends: the IP address, the time, the address of the page, the page you came from if your browser says so, and what your browser says it is. The portal itself also logs refused sign-ins, lockouts and administrator actions, with the IP address and account number, never an email address.
- Why: to keep the portal running, find faults and stop attacks.
- Legal basis: our legitimate interest in running a safe service (Art. 6(1)(f)).
- How long: web server logs are deleted after at most 15 days. The portal's own log is limited to 30 MB and is emptied each time the portal is updated, so how long a line stays depends on how much is logged and how often we update.
What Devolent can see
Our administrators can see each account, which apps it may download, and its download log with IP addresses. To help you, an administrator can view the portal the way you see it. They cannot see your password or open your Security page, and they cannot accept a licence for you. Anything an administrator downloads while viewing as you is logged under their own account.
Where the data is, and who else handles it
The data is hosted on a server in Sweden, by a hosting provider working for us.
The server is backed up every night. Backups are replaced as new ones are made: on the server within about a month, and on our own computers each time we fetch new copies. Data deleted from the portal disappears from the backups as they are replaced.
Invitation links and support go by email, which passes through our email provider. That provider may process email outside the EU, under the safeguards the GDPR requires.
We do not sell personal data or use it for marketing. Apart from these providers, we hand it to others only if the law requires us to.
When you write to us
Email to support@devolent.com comes to our mailbox. We use what you send to answer you and to fix what went wrong, which is our legitimate interest in supporting our customers (Art. 6(1)(f)). We keep it until you ask us to delete it.
LDAP Viewer
LDAP Viewer itself sends nothing to Devolent. It has no analytics or crash reporting and does not check for updates. It connects only to the directory servers you set it up for and, when you sign in with Kerberos, to your own organisation's sign-in service. Your profiles and search results stay on your computer unless you choose to share or export them.
Downloading LDAP Viewer from the portal is logged as described above.
Blippstation
Blippstation itself sends nothing to Devolent. It has no analytics or crash reporting and does not check for updates.
Blippstation Flasher connects only to Canonical's server cdimage.ubuntu.com, to list the Ubuntu images and download the one you pick. What you enter for a station, such as the Wi-Fi name and password, and the SSH public keys you choose, goes onto the SD card and nowhere else. It is stored there unencrypted, so treat the card with the same care as the password.
A station sends each scan to the address your organisation set up for it, usually your organisation's ServiceNow instance: the card's number, the station's name and the time. It also writes the card's number to the station's own system log. Its settings, including the credentials for that address, are kept on the station. Ubuntu on the station connects to services of its own, for example to set its clock and to fetch software.
A card's number can identify the person who carries it. Your organisation decides what its stations are used for and what happens to the scans, so it is the controller of that data, and questions about it go to your organisation. Devolent never receives it.
Downloading Blippstation from the portal is logged as described above.
Your rights
Under the GDPR you can ask us what we hold about you, and have it corrected or deleted. You can also ask us to limit how we use it, ask for a copy in a form you can take elsewhere, and object to anything we do on the basis of legitimate interest. Write to support@devolent.com. If we have to keep something, we will tell you why.
We make no automated decisions about you and do no profiling.
If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection, IMY.
Changes
If this policy changes, the new version is posted on this page with its date.