Privacy Policy

We do not store card numbers or bank details. Payments are handled by our payment processors and card data never reaches our servers. What we do hold:

• Account details you give us: name, email address, and any billing address or company details needed to invoice you.
• Records of transactions between you and us — invoices, payments, credits and refunds.
• Service data needed to run the platform: which apps and subscriptions you own, their hostnames, resource usage and bandwidth totals.
• An audit log of actions taken on your account, including the action, its target, and the IP address it came from. You can read your own audit records in the panel.
• Support tickets and their contents, and any correspondence you send us.
• Standard server logs, which include IP addresses and are kept for a limited period for security and abuse investigation.

• We do not run third-party analytics, advertising trackers, or session-recording tools on this site.
• We do not read your app data or your databases in the ordinary course of business. We may need to inspect a service to investigate an abuse report, to respond to a legal demand, or to resolve a fault you have asked us to look at.
• We do not sell your personal information, and we do not share it for advertising.

Cookies are small files stored by your browser. We use only what the service needs in order to function — there are no advertising or tracking cookies on this site.

• A cookie indicating you are signed in, so the panel knows to show you your account rather than the login page.
• Cookies set by our bot-protection provider during sign-up and sign-in, to tell a person from an automated script.
• Session cookies are removed when you close your browser. Persistent cookies remain until they expire or you delete them.

Most browsers can reject cookies entirely. Doing so will prevent you signing in, because the signed-in state is a cookie.

We share personal information only where providing the service requires it:

• Payment processors, to take payment and to detect fraud.
• Our email delivery provider, to send transactional email such as invoices, renewal notices and password resets.
• Our infrastructure and datacenter providers, to the extent operating your service requires it.
• Our bot-protection provider, for the sign-up and sign-in challenge.

We may also disclose personal information without your consent where:

• It is required by law.
• It is needed in connection with actual or prospective legal proceedings.
• It is needed to establish, exercise or defend our legal rights, including in cases of fraud or abuse.
• We reasonably believe a court or other competent authority would order the disclosure.

• Service data is deleted when the service is. A cancelled service and its data are permanently removed 7 days after the cancellation is processed; a service terminated for nonpayment is removed at termination.
• Invoices, payments and other financial records are retained after an account closes, because we are required to keep them.
• Support tickets are retained so the history is there if you contact us again.
• Server and audit logs are retained for a limited period for security and abuse investigation, then discarded.

• You can view and correct your account details in the customer portal at any time.
• You can export your data — snapshots, database exports, and file access over SFTP — without asking us and without a fee.
• You can ask us to delete your account by opening a ticket. We will remove what we are not required to retain, and tell you plainly what we must keep and why.
• You can opt out of non-essential email. Transactional email about your services and invoices cannot be opted out of while you hold an account.

Credentials the platform holds on your behalf — application environment variables, generated database passwords, stored keys — are encrypted at rest. Access to production systems is restricted and logged. Two-factor authentication is available on every account and we recommend enabling it.

No system is perfectly secure. If we become aware of a breach affecting your personal information we will notify you, and describe what happened, what was affected, and what we are doing about it.

The service is not directed at children. You must be at least 18, or the age of majority where you live, to hold an account, and we do not knowingly collect personal information from anyone under 13. The Children’s Online Privacy Protection Act places control of such information with parents; if you believe a child has provided us with personal information, contact us and we will delete it.

We may update this policy. Material changes will be announced in the customer portal or by email, and the date at the top of this page will change.