Data Portability and Switching (EU Data Act Register)

Voidhash s.r.o. · Version 1.0 · Effective from 14 October 2026

Provider: Voidhash s.r.o., ID No. 23738944, Chudenická 1059/30, Hostivař, 102 00 Prague 10, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 432083. Register URL: https://voidhash.com/legal/data-portability

1. About this register

1.1. This page is the online register referred to in Article 26 of Regulation (EU) 2023/2854 (the "Data Act"). It describes which data you can take with you when you leave the Voidhash hosted cloud service (the "Service"), in which formats and through which methods, the procedure and timelines for switching to another provider or to your own infrastructure, the applicable charges, and the known limitations.

1.2. This page forms part of the Terms of Service ("Terms"), which contain the binding switching provisions (Articles 23 to 31 of the Data Act). The lists in sections 3 and 6 are the exhaustive specifications required by Article 25(2)(e) and (f) of the Data Act. Capitalised terms have the meaning given in the Terms.

1.3. We keep this register up to date. When the data model or the available methods change, we publish a new version and record it in the table above.

2. Who this applies to

2.1. This register applies to all Customers of the Service, on all plans (Free, Grow and Enterprise), regardless of where they are established.

2.2. It does not apply to software you run yourself (the self-hosted Community edition or an Enterprise self-hosted or bring-your-own-cloud deployment), because Voidhash does not hold that data.

3. Exportable data

The following categories of data and digital assets generated by you or relating to you directly ("Exportable Data") can be exported. The API is described in the OpenAPI specification referred to in section 4.

Data marked "on request" are provided on request, free of charge, in a structured, machine-readable format (JSON), within the transitional period (section 7.4). The register covers all exportable data, including non-personal data and digital assets such as paywall designs and components. Personal data within these categories can also be exported under the Data Processing Addendum. Persons you have erased are not exportable after erasure.

Retention affects which historical data exist. Event-level analytics data (row 3.8) are kept for at least the retention period of your plan (Free 3 years, Grow 5 years, Enterprise as agreed in the order form), counted from when each event occurred. After that period we may delete them or replace them with aggregated statistics that no longer identify End Users, so older events may no longer be available for export in event-level form. Aggregated reports, purchases, transactions, subscriptions and entitlements are kept for the life of the account. Persons with no activity for longer than the retention period may have been deleted. We notify you at least 30 days before we first delete data of a project under these rules, so that you can export it. The retention rules are set out in the Terms of Service.

4. Methods, formats and standards

4.1. API. The management API at https://api.voidhash.com/api/v1 returns JSON. A machine-readable OpenAPI 3 specification is published at https://api.voidhash.com/api/docs/openapi.json (management and SDK API) and https://api.voidhash.com/i/docs/openapi.json (event capture). Lists use cursor pagination. You authenticate with a secret API key of the project. During switching we will raise rate limits on request so that a bulk export is not slowed down.

4.2. Server libraries. Open-source libraries for Node.js, Go, PHP and Rust wrap the API and webhook verification.

4.3. Webhooks. HMAC-signed webhooks deliver person, purchase and subscription events (for example purchase.completed, subscription.renewed, purchase.refunded, person.deleted) to your endpoint as they happen. You can use them to keep a destination system in sync while you switch.

4.4. Exports on request. For categories marked "on request", or for a complete export of your organisation, write to legal@voidhash.com. Exports are delivered as downloadable files or via the API.

4.5. Standards used. JSON (RFC 8259), with newline-delimited JSON for large bulk files; timestamps in ISO 8601, in UTC; currency codes in ISO 4217; country codes in ISO 3166-1 alpha-2; identifiers as UUIDs (RFC 9562) or strings; App Store transactions as JSON Web Signatures (RFC 7515) as issued by Apple; components as WebAssembly modules; the API described in OpenAPI 3.

5. Moving to your own infrastructure (Community edition)

5.1. The core of Voidhash ("Community edition") is open source and can be run on your own infrastructure or in a cloud of your choice. It uses the same data model as the Service, Exportable Data, paywalls, flows and components keep their structure there, and the same SDKs keep working once they are pointed at your server.

5.2. Exports for this purpose are made through the API and on request under section 4. Features that are only available in the hosted Service or under the Enterprise licence are not included in the Community edition.

6. Data excluded from export

The following data are specific to the internal functioning of the Service and are excluded from export because exporting them would risk a breach of our trade secrets or the security of the Service. Their exclusion does not prevent or delay switching.

1. the source code, build artefacts and internal configuration of those parts of the Service that are not published under an open-source licence, and of our infrastructure;
2. internal data structures, indices, caches and pre-computed aggregates that we derive from your data to operate the Service (your underlying data remain exportable under section 3);
3. fraud, abuse and risk signals, rules and models, and rate-limiting data;
4. security logs, telemetry, traces and monitoring data about the operation of the Service;
5. anonymised and aggregated statistics across customers that do not identify you or your End Users; and
6. third-party components installed from other publishers (we export the reference to the component and its version; the component itself remains subject to the publisher's licence).

7. Switching process

7.1. You can start switching at any time, without giving reasons, to another provider, to your own (on-premises) infrastructure, or you can request erasure of your Exportable Data.

7.2. Step 1 — Request. The account owner or an organisation admin sends a switching request by email to legal@voidhash.com. State whether you want to (a) switch to another provider (and give the details of that provider needed for the transfer), (b) switch to your own infrastructure, or (c) erase your data, and the date on which you want the transitional period to start.

7.3. Step 2 — Notice period. The transitional period starts on the date you choose, at the latest two months after we receive the request. You can choose to start it immediately. We confirm the request and the dates in writing.

7.4. Step 3 — Transitional period (up to 30 days). For up to 30 calendar days, the Service continues under your contract and we:

1. provide reasonable assistance to you and to third parties you authorise, including field mapping questions and raised rate limits;
2. act with due care to maintain business continuity and keep providing the Service;
3. inform you clearly of known risks to continuity; and
4. maintain a high level of security of your data during the transfer and the retrieval period.

7.5. If 30 days are not technically feasible, we will tell you within 14 working days after your request, with the reasons, and propose an alternative transitional period of no more than seven months. The Service continues throughout.

7.6. Extension. You may extend the transitional period once, for a period you consider more appropriate, by notifying us before it ends.

7.7. Step 4 — Completion. Please tell us when the switch has been completed. Your contract ends when the switch is successfully completed, or, if you only asked for erasure, at the end of the notice period. We will confirm the end of the contract to you.

7.8. Step 5 — Retrieval period (30 days). For at least 30 calendar days after the end of the transitional period, you can still retrieve your Exportable Data. Exports are delivered as downloadable files or via the API.

7.9. Step 6 — Erasure. After the retrieval period (or a later date we agree), we erase all Exportable Data and digital assets generated by you or relating to you directly, within 30 days, and confirm the erasure to you in writing. We keep only what the law requires us to keep, such as our invoices and accounting records, as described in the Privacy Policy. Backups are kept for a limited period and are deleted on their regular rotation.

8. Charges

8.1. Switching, data export, assistance during the transitional period, and erasure are free of charge. We do not charge switching or data egress fees.

8.2. You continue to pay the regular fees for the Service you use during the notice and transitional periods, under the Terms. There is no early termination fee for monthly plans. Early termination fees for Enterprise contracts with a committed term are stated in the Order Form, if any.

9. Known limitations

9.1. Store and payment provider data. Apple, Google and Stripe remain the source of the original purchase records. We hold copies and our own derived records. Your new provider can obtain store history directly from those platforms with your credentials.

9.2. Server notifications. You must repoint the App Store Server Notifications URL in App Store Connect, the Google Play real-time developer notifications (Pub/Sub) and any Stripe webhooks to your new provider. Until you do, notifications keep coming to Voidhash; after your contract ends they are not processed.

9.3. Apps on End Users' devices. Installed app versions keep using the Voidhash SDK and its on-device identifiers (such as anonymous IDs and cached entitlements) until End Users update the app. Plan the transitional period, or its extension, so that most End Users have updated. Purchases made through the SDK carry an account token derived deterministically from your user ID (sent to StoreKit as appAccountToken and to Google Play as obfuscatedAccountId); on request we explain the derivation so that your new system can match these purchases.

9.4. Paywalls and components. Flow packages and components use the Voidhash paywall format and run on the Voidhash runtime included in the SDKs and the Community edition. Other providers may not be able to import them; we do not guarantee functional equivalence in a destination system.

9.5. Credentials and secrets. We do not return store keys, service-account keys, push credentials, webhook signing secrets or API key secrets, because they are stored encrypted and returning them would weaken security. You hold the originals with Apple, Google, Stripe and your push providers; generate new secrets for your new system.

9.6. Derived reports. Dashboards and reports are computed from raw data. We export the raw data and query results, not the dashboard itself.

10. International access to data

Information on the jurisdiction of our infrastructure and our safeguards against unlawful governmental access is available on the International Access to Data page.

11. Contact

Switching requests, export requests and questions: legal@voidhash.com.