KoaPanel
IT Try it free

Privacy

Privacy policy

This notice explains how we process personal data collected through the koapanel.app website, the checkout, customer area and console at console.koapanel.app, Prime Software ID and the KoaPanel panels that communicate with our servers, under Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003.

Data controller

PRIME SOFTWARE S.R.L.S., registered office Via General Cantore 33, 58100 Grosseto (GR), Italia, VAT and tax code 01784750539, REA GR-236550, certified email (PEC) primesoftwaresrl@arubapec.it, represented by its legal representative pro tempore. For any privacy request you can contact us by writing to privacy@koapanel.app, to the certified email primesoftwaresrl@arubapec.it or through the contact form.

The group also includes KOAGRP, LLC, a limited liability company formed in the State of Delaware (USA), File No. 10784683, registered office 131 Continental Dr, Suite 305, Newark, DE 19713, USA (registered agent Legalinc Corporate Services Inc.), which sells the licenses to customers with a billing address outside the European Union: for their orders it is the controller of the order and billing data, which it processes with its own Stripe account (payments, receipts and invoices) and keeps for US tax obligations. The checkout and the invoice always state who sold. For everything else (customer area, support, license server) the data stays with Prime Software S.r.l.s.; the rights described below are exercised at the same contacts, towards KOAGRP, LLC too.

What data we process

  • Contact and support forms, emails to support: name, email, country and, if you provide them, company, VAT number, website, message text and attachments. Emails to supporto@koapanel.app (and privacy@koapanel.app) become support requests in our console.
  • Purchases: customer type (business or private), name, company name, billing address, email, VAT number or tax code, Italian e-invoicing code or PEC, plan and period, amounts and VAT, consumers' request for immediate activation, the IP address the order was placed from (as evidence of the customer's country for VAT). Card data is processed directly by Stripe: we never see or store it.
  • Customer area account (console.koapanel.app/account, also required for the Free plan): email, name, your Prime Software ID account identifier, creation and last sign-in dates; for each open session the IP address, browser, and start and last-use dates; the log of actions taken in the area (for example moving a license to another server or changing billing details) and the servers connected to the account through the code shown by the panel.
  • Prime Software ID (account.1primesoftware.it): the single sign-in service for Prime Software products, operated by us, under the same controller. There we process email, name, password (stored only as a non-reversible hash), optional two-step verification and technical sign-in data. The KoaPanel customer area receives only the account identifier, the verified email and the name.
  • VAT number check: for EU businesses the VAT number is checked on the European Commission's VIES system; we keep the result, date and consultation number.
  • Licenses and updates: the installed panel sends our servers the license code, a random server identifier, host name, IP address and version, to activate the license, check its status once a day and deliver updates.
  • Automatic error reports from the panels: when something breaks (an unexpected crash, a failed operation or update, a user-interface error, a service that stays down) the panel sends us technical data: error type, code location, a message from which the panel removes email and IP addresses, domain names, paths and codes, panel version, operating system, how many times and when it happened, and the random server identifier. They contain no data about websites, their users or visitors. Sending can be turned off in the panel settings; the IP address the report comes from is used only to limit abuse and is not stored.
  • Licenses sold by partner providers: if you buy KoaPanel from a partner hosting provider, the provider gives us the name, email and country the license is issued to, and its own service reference.
  • Business contacts: if you work for a hosting provider or an agency, we may write to you using the business contact details published on your company's website (company name, website, email, contact name if available). We record the emails sent, clicks on the links they contain (each link goes through console.koapanel.app, which records the click and takes you to the page) and your replies. We don't use pixels to know whether you open the email unless you consent.
  • Technical data: web servers log IP address, date and time, requested page and browser (technical logs), for security and operation.

Purposes and legal bases

  • Answering requests and preparing quotes: pre-contractual measures requested by you (Art. 6.1.b GDPR).
  • Selling, activating and managing licenses and subscriptions, providing updates and support: performance of a contract (Art. 6.1.b).
  • Creating and managing your account (customer area and Prime Software ID) and giving you access to licenses, invoices and support requests, including on the Free plan: performance of a contract (Art. 6.1.b).
  • Tax and accounting obligations, including VAT determination and keeping evidence of the customer's location: legal obligation (Art. 6.1.c).
  • Security of the services and abuse prevention (for example using one license on several servers): legitimate interest (Art. 6.1.f).
  • Finding and fixing panel errors and telling the people who hit them (automatic error reports): legitimate interest (Art. 6.1.f) in providing reliable software. You can object by turning sending off in the panel's Settings.
  • Issuing and managing licenses sold by partners and invoicing the partners: performance of the contract with the partner (Art. 6.1.b) and tax obligations (Art. 6.1.c).
  • Offering KoaPanel to companies in the hosting industry and knowing which contacts are interested: legitimate interest (Art. 6.1.f). You can object at any time by replying to the email or writing to privacy@koapanel.app: we won't write to you again.

The data requested for a purchase is necessary to conclude the contract and for tax obligations; without it we cannot provide the license.

Recipients

Prime Software ID is not an external provider: it is a service of the controller itself. Data is processed by the controller's authorized staff and by the following providers, as processors or independent controllers:

  • Stripe (Stripe Payments Europe, Ltd., Ireland): payments and subscription management;
  • Vultr (Vultr Holdings LLC): servers hosting the website and the console, in the Frankfurt data center (Germany, EU);
  • Hetzner (Hetzner Online GmbH, Germany): server hosting Prime Software ID, in the Falkenstein data center (Germany, EU);
  • European Commission (VIES system): EU VAT number checks;
  • Anthropic (Anthropic, PBC, United States): generates the answers of the virtual assistant in the website's live chat; it receives only the text of the messages, which we do not link to you (the name and email left with "Talk to a person" stay in our console);
  • the email service used to send emails (license codes, support replies);
  • tax and accounting advisers, for legal obligations.

If a provider processes data outside the European Economic Area, the transfer relies on the safeguards of Articles 44 and following of the GDPR. Data is never sold or used for profiling or advertising.

How long

  • Orders, billing data and accounting records: 10 years, as required by Article 2220 of the Italian Civil Code.
  • Support requests: 24 months after closure.
  • Contact form requests that don't become a purchase: 24 months.
  • License activation and check data (including licenses sold by partners): for the duration of the license, then 24 months.
  • Automatic error reports: 90 days after the error last occurred, then deleted.
  • Customer area and Prime Software ID account: as long as the account exists. You can ask for its deletion at any time by writing to privacy@koapanel.app, to the certified email primesoftwaresrl@arubapec.it or through the contact form: we delete the account and its sessions, while orders, invoices and support requests are kept for the periods above.
  • Customer area sessions: at most 30 days (7 days without use), then deleted.
  • Server technical logs: 30 days.
  • Business contacts: 24 months after the last exchange; if you object, we keep only the email address so we don't write to you again.

Cookies and analytics

The koapanel.app website uses no cookies and no tracking tools. We count visits in aggregate form from our own web server logs (pages viewed, referrer, country, browser), with IP addresses anonymised and no scripts or cookies: the data stays on our server and identifies no one. The customer area and Prime Software ID use only technical cookies needed to sign in (session and login protection), never profiling cookies: see the cookie notice.

Your rights

You can request access to your data, rectification, erasure, restriction of processing, portability, and object to processing based on legitimate interest (Articles 15-22 GDPR), by writing to privacy@koapanel.app, to the certified email primesoftwaresrl@arubapec.it or through the contact form. We reply within one month. You also have the right to lodge a complaint with the Italian data protection authority, Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority of your country.

Last updated: 9 October 2026