PrivacyPolicy.

1. Data we collect

• Account data: your name, email address, password hash, and - if you sign in or deploy with GitHub - your GitHub username and the repository access you grant.
• Workspace data: projects, environment variables, domains, team members and settings you create in the dashboard or CLI.
• Hosted content: the code, container images, databases and files you deploy. We process this only to run the Services for you.
• Usage and log data: deploy and runtime logs, resource usage, IP addresses, browser and device information, and timestamps.
• Security check results: when you deploy, and while your apps run, we automatically check your code and the programs running in your apps for known abuse tools (see section 4 of our Terms of Service). We keep what matched and when, linked to your account and project.
• Billing data: plan, invoices and billing address. Card details are collected and stored by Paddle, our merchant of record - we never see your card number.

We only collect what we need. If a field is optional, we say so.

2. Why we process your data (legal bases)

• To perform our contract with you: building and running your apps, provisioning databases, issuing TLS certificates, routing traffic and sending billing messages.
• For our legitimate interests: keeping the platform secure, preventing fraud and abuse (including the automated checks described above, which can refuse a build or stop an app), enforcing our Acceptable Use Policy and improving the Services with aggregated, de-identified analytics. Automated checks never close an account on their own: a person reviews every suspension, and you can ask us to look at any decision through a support ticket.
• To comply with law: keeping the records we are legally required to keep, such as invoices and tax documents.

Where we rely on consent - for example optional marketing communications - we ask for it first and make it just as easy to withdraw.

We do not sell your personal data, and we do not use your hosted content or personal data to train AI models.

3. Who we share it with

We share personal data only with the people who help us run DockHosting, under contracts that limit how they may use it:

• Paddle: payment processing, invoicing and tax compliance. Paddle is the merchant of record for payments.
• Infrastructure providers: the data centers and networks (in the EU) that host your apps and databases.
• Let's Encrypt: the domain names you add, so we can issue TLS certificates.
• GitHub: when you connect a repository, to read the code you choose to deploy.
• Discord: when an automated check stops an app, the project name and the owner's email are posted to our private team alert channel so a person can review it.

We may also disclose data where a law, court or regulator requires it, or to protect the rights and safety of our users, the platform or the public. We aim to tell you when we do, unless the law stops us.

4. Where your data is stored

Your apps, databases and hosted content are stored in our eu-central-1 region (Frankfurt, Germany) in the European Union. We aim to keep your data in the EU.

A few supporting providers are based outside the EU (for example GitHub in the United States). When personal data is transferred outside the EEA, we rely on appropriate safeguards recognised by the GDPR, such as the European Commission's standard contractual clauses, and on measures that protect your information to an equivalent standard.

5. Cookies

We use only essential cookies - to keep you signed in and to secure your session. We do not use advertising cookies, and we do not build advertising profiles.

6. How long we keep data

We keep account and workspace data while your account is active. If you delete a project, database, or your account, the related data is deleted from our systems within 30 days, except where we must keep records longer - for example invoices, which we keep as tax law requires (typically a few years).

Operational and security logs are kept on a rolling basis and deleted when they no longer serve a purpose. Security check results and the records of suspended accounts are kept for up to 12 months after the last match, so we can stop the same abuse from coming back.

7. Security

Traffic to the Services is encrypted with TLS, databases are reachable only over a private network by default, and access to production systems is restricted. No system is perfectly secure - see section 5 of our Terms of Service for your responsibilities - but if we ever experience a breach affecting your data, we will notify you and the relevant authorities as the law requires, and help you respond.

8. Your rights

You have the right to access your personal data, to correct it, to ask us to delete it, to restrict how we process it, to object to processing, and to receive a portable copy. You can manage most of this from the dashboard; for anything else, email legal@dockhosting.dev and we will respond within 30 days.

If you are in the EU or UK you also have the right to lodge a complaint with your local data-protection supervisory authority - the body for Germany is the BfDI. We would appreciate the chance to solve it with you first.

9. Children

The Services are for people aged 16 and over. We do not knowingly collect data from children under that age. If you believe a child has given us personal data, email legal@dockhosting.dev and we will delete it.

10. Changes to this Policy

We may update this policy from time to time. For significant changes we will email you or show a notice in the dashboard before they take effect. Minor, non-substantive rewording may be published here directly.

11. Contact

Email legal@dockhosting.dev - we are happy to answer questions about your data, any time.