Approved version
- Version
- 2026-10-24.v2
- Version date
- Language
- English
iDeployed Application Privacy Notice
Version: 2026-10-24.v2
1. Controller and scope
The controller for our own processing described here is ideployed UG (haftungsbeschränkt), Torgauer Straße 231–233, 04347 Leipzig, Germany, represented by managing director Hamid Wakili. Contact our privacy function at [email protected], by telephone on +49 172 6282363 or by post at this address. Support and technical security reports: [email protected]. The privacy contact is not a designated data protection officer.
This Notice covers platform accounts, the dashboard, deployments and platform operation. It supplements the separate marketing-website notice. Customers generally determine the purposes of personal data processed in their applications. Where we act as processor, we handle that data under their instructions and the DPA. Users of a hosted application should initially contact its operator about that processing. Our account administration, abuse prevention and legal obligations are distinct.
2. Sources and categories of data
We receive information from you, your use of the service and services you authorise. This includes:
- email address, optional display name, account and organisation associations, verification and agreement records, selected plan and voluntary consents;
- password hash, session and verification information, and optional multi-factor authentication and recovery codes; passwords are not stored as plain-text passwords;
- project, app, build and deployment identifiers, resource requests, capacity reservations, domains, image/version information, status and technical errors;
- for GitHub connections, authorised repository and installation details, commit information, webhooks and source code required for builds;
- support and security correspondence, and technical connection information such as IP address, browser details and timestamps where processed by the relevant network, security or application layer;
- application and build logs, measurements and stored failure-log excerpts. Their contents also depend on your application and may include personal data.
Do not deliberately write secrets into logs or public support requests. Restricting certain log fields does not eliminate the risk of customer software logging personal data.
3. Purposes and legal bases
| Purpose | Data and basis for our own processing |
|---|---|
| Registration, login, email verification, account recovery and requested services | Necessary account, security and service data; GDPR Article 6(1)(b) where you are the contracting person. For business customers' staff, generally Article 6(1)(f): administering and securely performing that business relationship. |
| Operation, troubleshooting, capacity management, abuse and attack prevention | Necessary operational and security data; Article 6(1)(b) for necessary contractual performance, otherwise Article 6(1)(f) for reliable, secure operation and preventing abuse, subject to balancing interests. |
| Support and communication | Request information and necessary account links; Article 6(1)(b), or Article 6(1)(f) for an organisation's contacts. |
| Evidence, legal obligations and legal claims | Necessary agreement, evidence and event records; Article 6(1)(c) for specific legal duties, Article 6(1)(f) for necessary establishment or defence of claims. This does not permit blanket indefinite retention. |
| Voluntary marketing communications, where offered | Contact and consent records; Article 6(1)(a) where consent is required. Consent may be withdrawn for the future without affecting earlier lawful processing. |
Processing customer data on their behalf follows the DPA and the customer's legal basis, rather than a blanket legitimate-interest claim of our own.
4. Cookies, device storage and Turnstile
Login uses a session cookie. Browser storage also saves preferences, identifies ongoing creation attempts to avoid duplicate resources after a lost response, protects exact recovery of an online withdrawal request, and retains a non-secret indication of an expired unresolved withdrawal attempt so a new key is not used silently. Selecting a plan alone is not a payment. The platform uses the following first-party storage:
| Name / type | Purpose and storage duration |
|---|---|
session / cookie | Login; inaccessible to scripts (HttpOnly), SameSite=Lax and protected by Secure on HTTPS. Full sessions are valid for 24 hours by default; restricted email-verification sessions for 30 minutes. Earlier logout or invalidation ends access sooner. |
ideployed_locale / cookie | Chosen interface language; one year. |
ideployed.shell, ideployed.activeProject / local storage | Sidebar preference and active project; no automatic time expiry. |
idpl-pending-human-code / session storage | Continue a requested CLI authorisation; ten-minute logical validity, removed when handled or read as expired, otherwise browser session storage lifetime. |
ideployed:new-app:v1:*, including :operation / local storage | Saved deployment form and operation references. The draft serializer omits environment-variable values but retains names and configuration references. No automatic time expiry. |
ideployed:app-storage-create:v1:*, ideployed:redis-create:v1:*, ideployed:jtl-shop:v1:*, ideployed:jtl-shop-capacity:v1:* / local storage | Creation/reconciliation keys, state and resource references; clearing depends on the flow, with no general time expiry. |
ideployed:billing:changed / local storage | Random signal to refresh other tabs after a change; overwritten on change, no automatic time expiry. |
ideployed:account-withdrawal:v1 / local storage | During the active recovery period of at most 30 days, this entry contains the private receipt/retry key, a non-reversible fingerprint of the confirmed details, request state, logical expiry and, when confirmation is successfully persisted, the receipt reference. The submitted name, contract identifier and receipt email are not stored here in plain text. At the 30-day limit, the key and fingerprint are no longer logically usable for recovery. Physical cleanup is scheduled while iDeployed code can execute in this browser. If the page or browser is closed or suspended, or no iDeployed code is executing, actual replacement may wait until this origin next executes. As soon as cleanup can run, the private key and fingerprint are removed; for a marker in pending, unconfirmed, challenge-required or conflict state, only a minimal non-secret expired-unresolved tombstone remains. That tombstone has no automatic time expiry and remains until it is explicitly forgotten through the flow or removed with browser controls, so this browser cannot silently generate a fresh key for another submission. |
ideployed:account-withdrawal-recovery:v1:* / session storage | AES-GCM-encrypted name, contract identifier and receipt email for an exact same-tab retry after a lost or uncertain response. The details are logically usable for at most 30 days. Normally they are removed after confirmed receipt, explicit Forget or expiry; other open tabs are notified to clean their separate session storage when the marker transitions to confirmed or another terminal state. If this browser cannot persist or verify the confirmed marker after a confirmed response, the encrypted details may remain with the fail-closed pending marker solely to reconcile that exact same-key request; submission with a fresh key is blocked. This fallback ends when the confirmed marker is successfully persisted and cleanup completes, on explicit Forget or browser removal, at the ordinary end of the tab session, or at the 30-day logical expiry. At that limit the details become unusable and are physically removed as soon as cleanup can execute. Closed, suspended or browser-restored tabs clean up when they next execute. Once cleanup can run, the entry is not carried into the non-secret expiry tombstone. |
The asterisk represents account/project/release identifiers. Browser storage can be removed using browser controls. If creation is uncertain, first check existing resources or contact support; clearing saved attempts and resubmitting can lose the reference needed to reconcile the outcome.
Strictly necessary access to information on a device relies on the statutory exception for expressly requested services; non-essential access requires prior consent where required. The privacy basis for subsequent processing is assessed separately.
Cloudflare Turnstile is used for registration and—where the function is enabled—before creating a new receipt for an online withdrawal declaration to detect automated abuse. The browser widget communicates directly with Cloudflare. According to Cloudflare, it processes signals including the IP address, TLS fingerprint, User-Agent, sitekey and associated origin, as well as other technical browser/device signals, and generates a short-lived challenge token that can be validated only once. Of the form data, our server sends only this token to Cloudflare's Siteverify API; it does not additionally send the IP address as remoteip and, in this verification step, sends neither the name, contract identifier, receipt email nor information read from a platform account. For withdrawal the server locally checks the returned result for the action withdrawal and an allowed hostname. This abuse check is not an identity, account or legal-validity check; it does not search for a platform account or associate the declaration with an account. The token is removed before fingerprinting and is not stored as part of the declaration, receipt or browser recovery material. After an ambiguous attempt, a fresh token may be required for a new validation; the same private request key and the same declaration details remain controlling. If a receipt already exists for that key, it is returned without another Turnstile verification. Cloudflare describes both processing on our behalf and independent controller processing to improve bot detection. See Cloudflare's Turnstile Privacy Addendum (opens in a new tab).
5. Recipients and international processing
We use the following services in particular. The Provider Register explains purposes, roles and available provider information:
- Scaleway: compute, databases, registry, storage and self-hosted logs and metrics; our primary infrastructure is in France.
- Cloudflare: proxy, TLS and security functions for the platform and application addresses routed through Cloudflare, plus Turnstile. This can involve HTTP contents, domains, IP addresses and connection information. Processing can take place globally, including in the USA. The route used by custom customer domains may differ.
- Resend: delivery of account and security emails, including email addresses and message contents. The provider states that data is stored in the USA; a European sending region does not change this.
- Zoho Mail: receiving, sending and storing correspondence to our contact mailboxes, particularly [email protected] and [email protected]. This includes senders, recipients, messages, attachments and connection information. We use the EU environment through mail.zoho.eu. Zoho distinguishes EU storage from possible support access from India; the EU mailbox address does not exclude that access. Send only data needed for your request, and do not email passwords or complete customer databases.
- Slack: technical failure notifications with event, resource and support references and dashboard links. The intended event format contains no raw application logs, passwords, environment variables or registry credentials. Linkable identifiers may nevertheless be personal data.
- Better Stack: availability monitoring of public platform endpoints and operational notifications, rather than general collection of customer application logs.
- GitHub and selected registries: transfers through the connections you configure and image pulls you request; their own roles and privacy notices also matter.
Public application addresses, domains and certificate information may be publicly visible. Authorities or other recipients receive data only on an appropriate legal basis. Paid checkout and live billing are disabled; this offer does not collect payment-card data for active Stripe billing. We will supplement this information before introducing a payment service.
European hosting does not mean all processing remains in the EEA. Transfers outside the EEA require an applicable adequacy decision or another permitted safeguard for the recipient, particularly EU Standard Contractual Clauses with supplementary measures where necessary. The linked provider documents describe their intended mechanisms; they do not promise EU-only processing. You may request information about the safeguards applied to a particular transfer and a copy at [email protected].
6. Retention and deletion
Retention depends on the relevant purpose, an ongoing contractual retrieval period and legal duties. Where an exact duration cannot be determined in advance, relevant criteria include completion of a support or security case, ongoing reconciliation of resources and the need for specific legal evidence. Technical storage alone does not justify indefinite retention.
| Data category | Retention and deletion |
|---|---|
| Live application, build and ingress log streams | Configured retention: 72 hours; cleanup is asynchronous. Separately stored failure excerpts are not covered. |
| Other platform log streams and metrics | Configured retention: seven days; storage limits can shorten available history. |
| Stored failure-log excerpts | Stored separately from the live log stream to investigate the relevant deployment, a reported fault or an unresolved resource association. These excerpts have no fixed automatic expiry. Necessary retention depends on completion of the particular fault or resource investigation and any separate need for specific legal evidence; the 72-hour rule does not apply here. |
| Security and audit detail | Depends on the event and its purpose: preventing and investigating a particular abuse or security incident and necessary evidence of account access, agreements and resource actions. There is no single fixed deletion period. Longer retention of evidence depends on the particular legal duty or claim and its applicable period. |
| Support and legal correspondence | Depends on handling and closure of your request, outstanding follow-up questions or a particular dispute. If a message also constitutes a business or contractual record subject to mandatory retention, that statutory period applies. We do not promise general automatic deletion of contact-mailbox messages after a fixed number of days. |
| Slack failure notifications | Copies of technical incident notifications used to identify and investigate the particular incident. Relevant criteria are its resolution and any specific further need for evidence. No fixed expiry period is stated here for delivered Slack messages. Cleaning up notification metadata in our database does not delete these copies. |
| Platform database backups | Nightly backups with configured 30-day rotation. Expiry of older copies is currently delayed; older backups are being addressed with the storage provider as part of remediation. Thirty days is therefore not currently a guaranteed maximum storage period. These are not backups of your application volumes. |
| Browser drafts and creation attempts | Until removed by the relevant flow or your browser controls; no general automatic expiry. Uncertain creations should be reconciled before their references are removed. |
| Browser withdrawal recovery | Normally, the encrypted same-tab recovery details are removed after confirmed receipt. If this browser cannot persist or verify the confirmed marker after a confirmed response, they may remain with the fail-closed pending marker solely to reconcile that exact same-key request; submission with a fresh key is blocked. This fallback ends when the confirmed marker is successfully persisted and cleanup completes, on explicit Forget in the flow or browser removal, at the ordinary end of the tab session, or at the 30-day logical expiry. The private receipt/retry key and fingerprint are logically usable for at most 30 days; after confirmation, they remain with the receipt reference solely for read-only receipt recovery until logical expiry, unless removed earlier through explicit Forget in the flow or browser controls. The platform schedules physical cleanup while iDeployed code is executing. If pages are closed or suspended, or no code is executing, cleanup may wait until the relevant origin or tab next executes; browser session restore may delay physical removal until then. Other active tabs are notified to clean their separate session storage. Once cleanup can run for a still-pending, unconfirmed, challenge-required or conflicted attempt, only the minimal non-secret expiry tombstone described above remains without automatic time expiry until explicit forgetting or browser removal; during any delay it continues to block reuse and a silent new-key submission. |
You may ask [email protected] about the retention applicable to your data and request access, erasure or restriction. Any necessary exception depends on its specific purpose, the affected data and the applicable duty or claim period.
Expired sessions and short-lived authentication records are periodically cleaned up under their particular expiry rules. Pending account-email content is time-limited and encrypted; completed content is removed and completed account-email metadata is cleaned up after seven days. This does not automatically determine email-provider retention.
General volumes follow the company-funded 30-day retrieval period in Terms section 6. It starts on the day after the associated storage service effectively ends, but not before the day after you receive notice of the start and deletion date. Advance termination notice or merely stopping an app does not start this period. Longer statutory retrieval and switching periods remain available. The JTL programme follows its separate Trial Terms.
After account termination, access credentials are invalidated and unnecessary direct account data is removed. During an applicable retrieval period, retrieval is provided through [email protected] after proportionate entitlement checks; an active account login is not required. Resource dependencies and necessary evidence are identified, restricted and retained only for a specific lawful purpose. Account termination does not mean every copy disappears immediately. Restoring backups must not permanently return deleted data to active use; deletion instructions must be reapplied. Technical dependencies or indefinite protective holds do not justify blanket refusal of erasure requests.
7. Security
The platform uses access controls, password hashing, optional multi-factor authentication, resource separation and network rules, and encrypted storage of selected authentication secrets. Some security audit records hash IP/browser information; this does not guarantee anonymity. Measures are developed according to risk.
This Notice does not claim full end-to-end encryption, verified encryption of every disk and backup, certifications or guaranteed recovery times. Agreed measures belong in the DPA annex.
8. Your rights and complaints
Subject to statutory conditions, you have rights of access, rectification, erasure, restriction and data portability. You may withdraw consent at any time for the future without affecting earlier lawful processing. We may request proportionate information to verify identity without collecting unnecessary data. Contact: [email protected].
Your right to object
You may object at any time, on grounds relating to your particular situation, to processing of your personal data based on GDPR Article 6(1)(e) or (f), including profiling based on those provisions. We then stop processing that data unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is for establishing, exercising or defending legal claims.
You may object to processing for direct marketing at any time without giving special reasons. This includes related profiling. Your data will then no longer be processed for those purposes. Objection is free and may be sent, in particular, to [email protected].
Complaints and further information
You may complain to a supervisory authority, particularly in your habitual residence, workplace or the place of the alleged infringement. For our registered office in Saxony, contact the Saxon Data Protection and Transparency Commissioner (opens in a new tab); its complaint page (opens in a new tab) explains submission. You remain free to approach another competent authority.
Necessary account and security information is required for the requested service; without it certain functions cannot be provided. Optional information and marketing consent are not required for Hobby. Technical capacity and abuse checks can reject actions. You may request human review, explain your position and contest a result; statutory rights concerning automated decisions remain unaffected.
9. Changes and related documents
We communicate material changes appropriately and make current and earlier versions available. Updating information does not replace required consent or contractual agreement.