Privacy Policy

LAST UPDATED · JULY 21, 2026

The short version. DockMDM exists to manage devices, not to monetize data. We collect what the service needs to run and nothing more. Your data lives in a German data center. We don't sell it, we don't run ads, and our website analytics are cookieless and self-hosted. Managed devices report telemetry, and their location when an administrator asks for it; informing the people who carry those devices is your organization's responsibility.

1. Who we are

DockMDM is a mobile device management service for rugged Android devices, operated by Ahmet Safa Orhan ("DockMDM", "we", "us"). For anything in this policy, contact [email protected].

Two roles matter here. For account and billing data we act as the data controller. For data collected from the devices your organization enrolls, your organization is the controller and we process that data on its behalf.

2. Data we process

Account data. Organization name, administrator email addresses, and a password we store only as a salted hash. Subscription state and a customer reference from our payment provider.

Device and fleet data, collected by the DockMDM agent from enrolled devices on your organization's behalf:

Enrolled devices are typically carried by employees or contractors of your organization. Your organization is responsible for having a lawful basis for this monitoring and for informing device users, in line with applicable employment and privacy law.

Website and product analytics. This site and the dashboard use Umami, a cookieless analytics tool that we self-host on our own infrastructure. We do not use advertising trackers. Our servers keep standard request logs, including IP addresses, for security and troubleshooting, and only as long as needed for those purposes.

Payment data. Payments are handled by Lemon Squeezy as merchant of record. Card numbers never reach our servers.

3. Where your data lives

DockMDM runs in a data center in Germany. Traffic is encrypted in transit with TLS, and passes through Cloudflare's network. Device credentials are stored only as hashes, never in plaintext, and every request to our API is scoped to your organization.

4. Who we share data with

We do not sell personal data and we do not share it for advertising. We use these service providers to run DockMDM:

We may disclose data if required by law. If that happens, we will tell you unless we are legally prevented from doing so.

5. Retention and deletion

We keep your data while your account is active. Retiring or deleting a device removes it from your fleet views. When an account is terminated, we delete its data within 90 days. You can request deletion of your account and data at any time at [email protected].

6. Your rights

You can request access to, correction of, export of, or deletion of your personal data by emailing [email protected]. If you are a device user rather than a DockMDM customer, your employer or the organization that manages your device controls that data; contact them first, and we will support their response. A data processing agreement is available to customers on request.

7. Security

TLS everywhere, hashed credentials, organization-scoped access on every endpoint, and server-side logging of administrative actions. No system is perfectly secure, but minimizing what we store is part of the design: we collect what fleet management needs, and nothing else.

8. Changes

If this policy changes in a way that matters, we will note the new date at the top of this page and, for significant changes, notify account holders by email.

9. Contact

Questions about privacy: [email protected].