Privacy

Privacy Policy

Last updated: November 9, 2026

Deckpa is software installed on your own server; the content of your sites, your files and your databases are not sent to us. This policy describes separately the data that reaches us today, the data that will reach us once license verification and payments start, where and for how long it is processed, and the rights you have over it. Deckpa is currently in private beta; account sign-in and payment are not open yet.

Who we are

Deckpa is provided by Moserra Software LLC, a limited liability company organized under the laws of the State of Missouri, USA. Moserra Software LLC decides how the personal data described in this policy is processed and is responsible for it; in the terms of the GDPR it is the controller. Its registered address is 117 S Lexington St, Ste 100, Harrisonville, MO 64701-2444, USA. That is the address of the registered agent; it is not a physical office open to visitors. You can reach us at info@moserra.com.

Data processed today

Marketing site: deckpa.com sets no cookies of its own and uses no advertising tools. Google Analytics is used to measure how the site is used; it loads only if you accept on the cookie notice. The site is served through Cloudflare; Cloudflare sees standard connection details such as the IP address in its own infrastructure. The site's application log does not record requests, IP addresses or browser details.
Google Analytics (only if you accept): the Google Analytics 4 script sends Google the pages you visit, where you came to them from, your browser and device type, your approximate location and the browser ID in the _ga cookies. By the nature of a network connection your IP address reaches Google; according to Google, Google Analytics 4 does not log or store IP addresses. Google's Consent Mode is not used: if you do not accept, Google's script does not load at all and this data is not sent to Google. Google signals and ads personalization are turned off in our Google Analytics account; analytics data is not used for advertising.
Update check: described in the "License verification and update check" section below.
Google Drive connection (optional): if an administrator connects Google Drive, the authorization passes through connect.deckpa.dev. At that point the panel's address, your Google account e-mail address and the refresh token issued by Google reach this service. The refresh token is held as a single-use record for at most 5 minutes and is deleted once it is collected. Before each backup operation the panel sends the refresh token to this service to obtain a short-lived access token. The service's application code does not log this data; Cloudflare's own platform logs may be kept separately. The backup files themselves do not pass through this service and are uploaded directly to Google.
E-mail: when you write to info@moserra.com, we receive your e-mail address, the name you send and the content of your message.

License verification and update check

Current status: license verification is turned off in the released panel version. The panel sends no requests to the license server (license.deckpa.dev), does not ask for a license key and restricts nothing because of the license; see the license documentation for details. The update check does run today.

Update check (runs today): when it starts and then at regular intervals, the panel requests the latest version information from get.deckpa.dev. The request carries no body; it does not send your panel version, operating system or server name. By the nature of a network connection, your server's IP address is visible to the distribution infrastructure. This distribution is served from Cloudflare's storage service; we run no application of our own that records these requests, and Cloudflare keeps its own records under its own policies. The panel settings have no option that turns the update check off.
License activation (once verification is on): the license key, the server fingerprint and, if present, your cloud provider's instance ID or the motherboard identifier. This instance ID is sent as it is, without hashing.
License renewal (once verification is on; once a day, more often after an error): the license ID, the server fingerprint and a verification value from the previous response.
Source IP address: the IP address that license requests come from is visible to Cloudflare and the license server.

The server fingerprint is a one-way SHA-256 digest of your machine ID (/etc/machine-id), the lowest MAC address among the non-virtual network cards and, if present, the cloud instance ID. The IP address is not an input to the fingerprint. The panel version, operating system, server name, site list, files, databases and actions inside the panel are not part of license requests.

The retention period for license verification records, including the source IP address, will be set when the service is enabled and published on this page. Once verification is on, the panel will have no setting that turns it off, because the license depends on it. If the license server cannot be reached, the panel does not lock and keeps running with its last known license status; when a license expires, a 7-day grace period applies (see the Terms of Service).

Data processed once payments start

When account sign-in and payment open, the following data will also be processed:

Account: e-mail address and session details.
Payment: subscription ID, payment status and invoice details. Payments are collected through Stripe; you enter your card details on Stripe's page and they do not reach this server.
License record: a hash of the license key, the fingerprint of the linked server, license status and period end. The raw license key will not be stored on our servers, only its hash.
Support: support request conversations and attachments you send. Information such as license status and the time of the last renewal may be attached to a support request.

Data that stays with you

The panel's own records stay on your server and are not sent to us: login attempts, the audit log, site access and error logs, panel cookies and browser preferences. The raw form of your license key also stays in the license file on your server. You are responsible for this data and decide how it is processed. Moserra Software LLC is not a processor of the data on your server. You are also responsible for the data transfers you make from your server to third parties such as Google Drive.

Purposes and legal bases

Data is processed for license verification, billing, security and update distribution, preventing misuse, and answering your messages and support requests. Where a law such as the GDPR requires a legal basis, we rely on the following:

Connection details and update distribution: our legitimate interest in delivering the site and the services securely.
Google Analytics: the consent you give by pressing "Accept" on the cookie notice. You can withdraw it at any time with the "Cookie preferences" button at the bottom of the page.
Google Drive connection: performing the service the administrator asks for.
E-mail: our legitimate interest in answering your message; where the message is about a purchase, performing the contract.
Once license verification is enabled: performing the license contract, and our legitimate interest in preventing license misuse.
Once payments start: performing the contract (license sale, subscription and support), complying with legal obligations (tax and accounting records), and our legitimate interest in preventing payment fraud.

The only processing based on consent is Google Analytics, and it does not start without your consent. If new processing that requires consent is added, your consent will be asked for in advance. We do not profile you for advertising, and we do not sell your personal data or share it for cross-context behavioral advertising.

Sharing

Cloudflare: the site, the license service, update distribution and the Google Drive connection service are delivered through Cloudflare infrastructure.
Stripe: will be used as the payment processor once payments start.
Google LLC: if you accept, processes Google Analytics data on our behalf as a processor.
Other providers: the providers we use for e-mail and the providers we will use for hosting will be named on this page once they are set.
Subprocessor list and data processing agreement: a current list of the providers that process data on our behalf will be published once payments start. A data processing agreement is available on request; send your request to info@moserra.com.
Third-party connections: for the services the panel optionally connects to, such as Let's Encrypt, the Cloudflare API, Google Drive and Telegram, data goes directly from your server; Deckpa is not an intermediary in that transfer (except for the Google Drive authorization described above).

Information may be given to competent public authorities where the law requires it.

Where data is processed

Moserra Software LLC is based in the USA, and the data described in this policy is processed in the USA. Cloudflare handles requests across its global network, so a request may also be processed in a data center outside the USA. Stripe, which will be used once payments start, is also US-based. Google Analytics data may be processed by Google LLC in the USA and in Google's data centers in other countries. Where our providers process data outside the USA, appropriate contractual and technical safeguards apply. If you are in the European Economic Area, the United Kingdom or Switzerland, your data is therefore transferred to the USA; the transfer mechanism relied on for each provider will be named on this page once it is set.

Retention

Site requests: the site's application log does not record requests or IP addresses, so the site keeps nothing about your visit. Cloudflare keeps its own connection records under its own policies.
Google Drive connection: the refresh token is held for at most 5 minutes and is deleted once the panel collects it.
Google Analytics: the _ga cookies in your browser have a default lifetime of 2 years. Data retention in our Google Analytics account is set to 2 months, the shortest period Google Analytics offers; user-level and event-level data is deleted at the end of that period. Aggregated reports are not affected by it.
Other records: retention periods for e-mail correspondence, license verification records, account and invoice data, and support conversations will be published on this page. The periods for license records will be set when the license service is enabled, and those for account, invoice and support records when payments start.

Until then, the following rule applies: we keep personal data until the purpose of processing no longer applies or the legal retention period ends; we then delete it, destroy it or make it anonymous. We may keep limited data where the law requires it (for example for tax, accounting or fraud prevention) or to resolve a dispute, only for as long as that purpose requires.

Your rights

Whatever country you live in, you can ask whether we process personal data about you, get a copy of it, and ask us to correct or delete it.

European Economic Area, United Kingdom and Switzerland: if the GDPR, the UK GDPR or a similar law applies to you, you also have the right to restrict processing, to object to processing based on our legitimate interest, to data portability, and to withdraw your consent at any time where processing is based on consent. You can also complain to the data protection authority where you live or work. You can withdraw the consent you gave for Google Analytics with the "Cookie preferences" button at the bottom of the page.
California and other US states: depending on the state you live in and the law that applies, such as the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), you may have the right to know which personal information we collect, use and disclose; to request its deletion or correction; to opt out of its sale or sharing; and not to be discriminated against for exercising these rights. We do not sell personal information or share it for cross-context behavioral advertising.

How to apply

Send your request by e-mail to info@moserra.com or in writing to the registered address above. To protect your data, we verify your identity before acting on a request. Requests are answered within the period set by the applicable law. When we receive a deletion request, we confirm receipt, delete your personal data from our active systems within 30 days, and let you know by e-mail; the data that we may keep under the rule in the retention section is excepted. When the portal opens, an application form will be announced on this page.

Children

Deckpa is software for managing servers and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has sent us personal data, write to info@moserra.com and we will delete it.

Security

The security principles for the license service and the payment flow will be applied when those services go live: the license signing root key is not kept on the server, webhook requests are not processed before their signature is verified, and passwords, tokens and payment secrets are not written to logs. These principles have not yet been applied on a running license server. If a security breach affects personal data, we notify the affected people and the competent authorities within the time and in the manner the applicable law requires.

Cookies

The browser storage used on this site is detailed in the Cookie Policy.

Changes and disputes

This policy may be updated for legal requirements or operational needs. The current text applies from the date it is published on this page, and the date at the top changes. Disputes about this policy are subject to the governing law and jurisdiction section of the Terms of Service. The mandatory data protection rules of the place where you live and your right to complain to a data protection authority are not affected.