Kennel

Privacy policy

Information on how we handle personal data on this website.

kennel.blueshoe.io

Introduction

Thank you for your interest in Kennel. Protecting your personal data is important to us. Below you will find information about how we handle data collected through your use of this website and our analysis service. Your data is processed in accordance with applicable data protection law, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

Controller within the meaning of the GDPR

Blueshoe GmbH
Bahnhofstraße 3a
82166 Gräfelfing
Germany

Phone: +49 (0)89 54197872
Email: kennel@blueshoe.io

Data Protection Officer

Proliance GmbH / www.datenschutzexperte.de
Data Protection Officer
Leopoldstr. 21
80802 Munich
Germany
datenschutzbeauftragter@datenschutzexperte.de

Definitions

This privacy policy uses the terms of the GDPR. The official definitions are set out in Art. 4 GDPR.

Web hosting

This website and the related backend services are hosted by an external service provider. Hosting takes place in Germany with:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany

Personal data collected via this website or the analysis pipeline is stored on the hoster’s servers. This may include IP addresses, meta and communication data, access data, and data submitted or generated in the course of an analysis.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing our service securely, reliably, and within the EU). Where processing is necessary to perform a contract or take pre-contractual steps, Art. 6(1)(b) GDPR also applies.

We have concluded a data processing agreement with the hoster pursuant to Art. 28 GDPR.

Further information: https://www.hetzner.com/legal/privacy-policy

Server log files

When you visit our website, data is technically transmitted from your browser to our web server. The following data may be recorded during an active connection:

  • Date and time of the request
  • Name of the requested file or resource
  • Page from which the file was requested (referrer)
  • Access status / HTTP status code
  • Browser and operating system used
  • IP address of the requesting computer
  • Amount of data transferred

We collect this data to ensure a stable connection, secure operation, and for administrative purposes. The legal basis is Art. 6(1)(f) GDPR.

For technical security reasons, in particular to defend against attacks, this data may be stored temporarily. As a rule, after 30 days at the latest the data is anonymised by shortening or deleting the IP address, or deleted, unless longer retention is required for security reasons. The data is not combined with other personal data to create profiles.

Use of Kennel (container / SBOM analysis)

Kennel allows you to analyse container images (including software bills of materials, vulnerabilities, and end-of-life information). Analysis is performed via our backend pipeline (“Bones”), operated under our control and connected through this website.

Data processed

Depending on the scan you initiate, we may process in particular:

  • the image reference you provide (registry URL, tag, architecture)
  • optional registry credentials (pull secret) you provide, solely to fetch the image once
  • technical scan metadata and analysis results (e.g. SBOM, vulnerability, and EOL data)
  • the resulting report URL / job ID

Purpose and legal basis

The purpose is to provide the analysis and related report you request. The legal basis is Art. 6(1)(b) GDPR (performance of a usage contract / pre-contractual measures at your request) and, where lit. b does not already apply, Art. 6(1)(f) GDPR (ensuring and improving a stable analysis service).

Credentials / pull secrets

Private registry credentials are, by design, processed only ephemerally in memory during image retrieval and are neither persisted nor logged. Please prefer short-lived credentials limited to the retrieval purpose.

Retention of scan results

Scan metadata and reports are cached only temporarily as needed to deliver your report URL and complete the scan. They are then deleted or purged automatically. Please save any results you need permanently yourself.

No marketing tracking, no AI training

We do not use advertising or marketing tracking and do not build user profiles for advertising. Your scan data and container contents are not used by us to train AI models. Where third-party providers are involved for specific analysis features (see Google Gemini below), this is not done for the purpose of training their models on your data, to the extent contractually and/or by product configuration assured to us.

Contact by email

On this website you can start an email to kennel@blueshoe.io via a contact button. This is a local `mailto:` link; no external chat, CRM, or booking tool (in particular no HubSpot) is embedded.

If you contact us by email, we process your details, including any personal data you provide, to handle your request and any follow-up questions.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in responding to your enquiry) and, where applicable, Art. 6(1)(b) GDPR if the enquiry aims at concluding a contract. Your data will be deleted after the matter has been fully resolved, unless statutory retention obligations apply.

Cookies and local storage

We do not set marketing cookies and do not use a cookie banner for advertising tracking. Technically necessary storage may still occur:

Technically necessary cookies / storage

  • Language preference: A cookie (`i18n_redirected`) may be set to detect or store your language preference.
  • Display settings: Display preferences may be stored locally in your browser (e.g. `kennel-color-mode`).
  • Scan history: Recent scans may be stored in your browser (`localStorage`) so you can find previous reports again.
  • Report cache: Analysis results may be cached temporarily in your browser’s IndexedDB to improve load times.

These processing activities are based on Art. 6(1)(f) GDPR and, where applicable, Section 25(2) TDDDG, insofar as they are strictly necessary for a service you expressly requested.

You can delete or block cookies and local storage via your browser settings. Some features (e.g. language preselection or scan history) may then be limited.

Reach measurement with Simple Analytics

To measure website usage in a privacy-friendly way, we use Simple Analytics. The service does not set cookies, does not store IP addresses, and does not create personal user profiles. It records page views and coarse technical metadata (e.g. referrer, device type, approximate country based on time zone).

Analytics scripts are delivered via our domain `iris.blueshoe.io`. Processing is carried out via Simple Analytics; according to the provider, related data is processed in the EU (Netherlands).

Service provider: Simple Analytics B.V., Jacob van Lennepstraat 78 H, 1053 HM Amsterdam, The Netherlands
Further information: https://www.simpleanalytics.com/privacy and https://docs.simpleanalytics.com/data-collection

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly reach measurement and improving our service). As Simple Analytics states that it does not collect personal data from website visitors, cookie consent is generally not required. Visitors with “Do Not Track” enabled are, by the provider’s default, not recorded.

Error monitoring with Sentry

To detect, analyse, and fix technical errors we use Sentry. Technical information such as error messages, stack traces, browser and device information, the URL accessed, and to a limited extent interaction data (Session Replay) may be transmitted to Sentry. Session Replay is configured to mask text content and block media.

Service provider: Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA
EU representative: Sentry Software Netherlands B.V., Schiphol Boulevard 359, 1118 BJ Amsterdam Schiphol, The Netherlands
Privacy policy: https://sentry.io/privacy/
DPA: https://sentry.io/legal/dpa/

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the stability, security, and reliability of our service).

As data may be transferred to the USA, we rely on appropriate safeguards under Art. 46 GDPR (in particular Standard Contractual Clauses under the Sentry DPA) and, where applicable, Sentry’s certification under the EU-U.S. Data Privacy Framework.

AI support for end-of-life information (Google Gemini)

For certain end-of-life / lifecycle evaluations, our analysis pipeline may use Google Gemini to enrich or classify public or scan-derived component information. Technical package/component details (e.g. names and versions) may be transmitted to Google. Your scan data is not used to train AI models, to the extent assured by the chosen configuration and/or contractual terms.

Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Parent company: Google LLC, USA
Privacy policy: https://policies.google.com/privacy

The legal basis is Art. 6(1)(b) GDPR (providing the analysis feature you requested) and Art. 6(1)(f) GDPR (improving and classifying lifecycle information). Any transfer to the USA is based on appropriate safeguards under Art. 46 GDPR (including Standard Contractual Clauses) and, where applicable, the EU-U.S. Data Privacy Framework.

Fonts

Fonts used on this website are served locally from our own infrastructure and are not loaded from Google servers. Visiting the site therefore does not trigger a connection to Google Fonts.

External links

Our website may contain links to third-party websites (e.g. Blueshoe’s company website). After you click a link, you are redirected to the respective provider. Only then may user information be transmitted to that provider. Their privacy policies apply to any processing there.

Disclosure and recipients

Your personal data is disclosed to third parties only if

  • we have expressly stated this in this privacy policy,
  • you have given consent pursuant to Art. 6(1)(a) GDPR,
  • disclosure is necessary pursuant to Art. 6(1)(f) GDPR to assert, exercise, or defend legal claims and no overriding legitimate interests of yours prevail,
  • there is a legal obligation pursuant to Art. 6(1)(c) GDPR, or
  • disclosure is necessary pursuant to Art. 6(1)(b) GDPR to perform a contract with you.

We use carefully selected processors (in particular hosting, error monitoring and, where used, analysis support services) and conclude Art. 28 GDPR agreements where required.

Data security

In accordance with Art. 32 GDPR, we take appropriate technical and organisational measures to ensure a level of security appropriate to the risk. This website uses TLS/SSL encryption for transmission.

Retention period

Unless a more specific period is stated above, retention follows the respective processing purposes and statutory retention periods. After the purpose ceases or the period expires, data is deleted or anonymised unless legitimate reasons for longer retention apply.

Your rights

You have the following rights vis-à-vis the controller in particular:

  • Access pursuant to Art. 15 GDPR
  • Rectification pursuant to Art. 16 GDPR
  • Erasure pursuant to Art. 17 GDPR
  • Restriction of processing pursuant to Art. 18 GDPR
  • Data portability pursuant to Art. 20 GDPR
  • Complaint with a supervisory authority pursuant to Art. 77 GDPR
  • Withdrawal of consent pursuant to Art. 7(3) GDPR with effect for the future

The competent supervisory authority for Blueshoe GmbH is generally the Bavarian Data Protection Authority (BayLDA). You may also contact the authority at your habitual residence or place of work.

Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR, you have the right under Art. 21 GDPR to object on grounds relating to your particular situation. Where the objection concerns processing for direct marketing, you have a general right to object without stating particular reasons.

To exercise your right of withdrawal or objection, an email to kennel@blueshoe.io is sufficient.

Legal obligations / obligation to provide data

Personal data for using Kennel is provided to the extent required for the respective scan or for contacting us. Without the necessary details (e.g. an image reference), the analysis cannot be performed.

Automated decision-making

No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place.

Changes

We reserve the right to update this privacy policy if the legal situation, technology, or our service changes. The version current at the time of your visit applies.

Status of this privacy policy: 22 September 2026