Privacy Policy (Datenschutzerklärung)

Effective Date: October 19, 2026

This Privacy Policy explains how CCBlueX ("we", "us", or "our") processes personal data when you visit, register for, or use Veil Obfuscator ("Veil") at veil-obfuscator.com, in accordance with the European Union General Data Protection Regulation (GDPR / DSGVO) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

1. Data Controller (Verantwortlicher)

The controller responsible for data processing on this website within the meaning of Art. 4 (7) GDPR is:

2. Client Accounts & Activation Keys

When you register for a Veil Obfuscator account in the Client Area, we process your email address, salted password hash, account identifier, activation key, and subscription status strictly to provide your account and enforce license terms.

Legal Basis: Art. 6 (1) (b) GDPR (performance of a contract) and Art. 6 (1) (c) GDPR (statutory obligations).

3. Self-Hosted CAPTCHA Bot Protection (Cap)

To protect our authentication and registration endpoints against credential stuffing and automated spam without relying on third-party tracking networks, we use our self-hosted proof-of-work and browser verification service at captcha.ccbluex.net. No personal data is sold or transmitted to external advertising providers.

Legal Basis: Art. 6 (1) (f) GDPR (legitimate interest in protecting service integrity and preventing automated abuse).

4. Java Archive (JAR) Processing & Zero Permanent Archive Storage

Veil Obfuscator is architected to protect the confidentiality of your software artifacts:

• Standard Browser Execution: When using the Standard Browser Edition, your Java archives (.jar) and class files are transformed directly inside your web browser's local memory sandbox.
• Cloud & CI/CD Pipeline Processing: Where the Cloud Pipeline or CI/CD API endpoints are used, uploaded JAR files are processed in memory to generate the protected archive. Temporary output archives are deleted immediately upon download or automatically purged after a maximum retention window of 30 minutes.
• No Third-Party Sharing: We do not index, archive, sell, or share your source code, bytecode, class names, or software artifacts with any third party, nor do we use submitted archives to train machine learning or artificial intelligence models.

Legal Basis: Art. 6 (1) (b) GDPR (performance of a contract initiated at your request).

5. Server Log Files, Cloudflare Edge Proxy & Security

To deliver veil-obfuscator.com securely, mitigate distributed denial-of-service (DDoS) attacks, and enforce license compliance, traffic is routed through our reverse proxy infrastructure and Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA / Cloudflare Germany GmbH).

When you access the website, the following technical connection data is processed automatically:

Legitimate Interest: Processing is necessary under Art. 6 (1) (f) GDPR for our legitimate interest in ensuring the stability, integrity, security, and intellectual property protection of our web application and infrastructure. International transfers by Cloudflare are safeguarded under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses (Art. 46 GDPR).

6. Session Cookies

Veil Obfuscator does not use third-party advertising trackers or behavioral profiling cookies. When you sign in to the Client Area, we set a strictly necessary first-party veil_session HTTP-only cookie to authenticate your session pursuant to § 25 (2) No. 2 TDDDG and Art. 6 (1) (b) GDPR.

7. Your Rights Under the GDPR (Betroffenenrechte)

Under the GDPR, you have the following statutory rights regarding your personal data:

• Right of Access (Art. 15 GDPR): Request confirmation of whether we process your personal data and obtain a copy of that data.
• Right of Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete personal data.
• Right to Erasure (Art. 17 GDPR): Request deletion of your personal data where no statutory retention obligation or overriding legitimate ground applies.
• Right to Restriction of Processing (Art. 18 GDPR): Request restriction of processing under statutory conditions.
• Right to Data Portability (Art. 20 GDPR): Receive personal data you provided in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21 GDPR): Object at any time to data processing based on Art. 6 (1) (f) GDPR on grounds relating to your particular situation.

To exercise any of these rights, contact us at [email protected].

8. Right to Lodge a Complaint with a Supervisory Authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR. The competent supervisory authority for our registered seat in Lower Saxony, Germany is: