Privacy Policy
In short: we collect what we need to run your account and your deployments, we do not sell personal information, we do not run advertising or tracking on this website, and we process your data on Amazon Web Services and Cloudflare in the United States and Australia.
- 1. Who is responsible
- 2. What we collect
- 3. Visitors to sites you host
- 4. How we use it and why
- 5. Who we share it with
- 6. Where your data and code are processed
- 7. How long we keep it
- 8. Your choices and rights
- 9. Cookies and tracking
- 10. Security
- 11. Children
- 12. Changes
- 13. Contact and complaints
1. Who is responsible
Vantrex is operated by [Operator legal name], an unincorporated business run by an individual, based in [Country] (“we”, “us”). For information about you as a customer (your account, projects, usage and communications with us) we decide how and why it is processed, so we are the controller (the “business” under some laws). For information about visitors to the sites you host on Vantrex, you are the controller and we process it on your behalf (see section 3). This policy covers the Vantrex dashboard, API, command-line tool, this website and the deployed-site serving infrastructure.
2. What we collect
| Information | What it includes | How we get it |
|---|---|---|
| Account | Name, email address, profile picture or avatar choice, a salted hash of your password, whether you have verified your email address, passkey public keys, two-factor authentication settings, and the identifiers GitHub gives us if you sign in with GitHub (and the access tokens GitHub issues to do so). | From you, and from GitHub when you use it to sign in. |
| Sessions and keys | Sign-in sessions with the IP address and browser or device description they were created from (so you can see and end them), and API keys (stored as hashes; the secret is shown to you once). | Automatically when you sign in or create a key. |
| Your projects and code | Project names and settings, source files you upload or that we fetch from repositories you connect, build output, the commit details of deployments (branch, author name, message), build and runtime logs, screenshots of deployments, domains you add, firewall rules, and environment variables (encrypted at rest). | From you, from your repository on GitHub, and from your builds. |
| Account activity | An audit trail: what you did and when (for example sign-ins, password and two-factor changes, creating a token, creating or deleting projects, changing environment variable names). | Automatically. |
| Service usage | Counts of builds, deployments, requests and data transferred for your projects, for limits, reliability and the analytics you see in the dashboard. | Automatically. |
| Communications | Messages you send us, and the emails we send you (password resets, security notices, release and incident notices). | From you; from our systems. |
| Technical data | IP addresses and request details in server logs and security events for our own systems (dashboard, API, edge), used for operation, abuse prevention and debugging. | Automatically. |
We do not ask for payment card details; if we begin charging, payments will be handled by a payment processor and this policy will be updated before we do. We do not intentionally collect sensitive categories of information (such as health or political opinions); do not put them in a project’s metadata. We do not use your code or content to train machine-learning models.
3. Visitors to sites you host
When someone visits a site served by Vantrex, our edge servers handle the request and record limited information to deliver, protect and measure it: the visitor’s IP address, the requested address, the response status, size and time, the browser and device description, the referring address, and the country the IP address is in (found with a local database, so the address is not sent to anyone for this). The data is rolled up into the statistics you see in Observability. Individual IP addresses are used for the firewall and for a ranked list of top visitors, and are kept for a shorter time (section 7). The firewall can also record the details of requests it blocked.
You are the controller of this data and responsible for telling your visitors about it, including in your own privacy notice. We use it only to provide the Service to you, to protect the platform and to comply with law. Applications you run on Vantrex can collect their own data in their own way; that is between you and your visitors, not covered by this policy. If you need a data processing agreement, contact us.
4. How we use it and why
Where the law requires a legal basis (for example in the UK and EU), we rely on:
- Contract: to create your account, build, store and serve your projects, show you logs and analytics, and provide support.
- Legitimate interests: to secure and keep the Service reliable (abuse and fraud prevention, rate limiting, firewall, debugging), to improve it, and to tell you about incidents and maintenance. We balance this against your rights and keep it to what is needed.
- Legal obligation: to meet legal duties and to respond to lawful requests.
- Consent: where we ask for it. You can withdraw it at any time.
We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not make decisions about you by automated means that have legal or similarly significant effects.
5. Who we share it with
We use these service providers (“subprocessors”), each only for the purpose shown, and they may process your data only under their agreements with us:
| Provider | Purpose | Data |
|---|---|---|
| Amazon Web Services | Servers that run the control plane, builds, your server-side code and the edge (Ohio, United States and Sydney, Australia) | Everything the Service handles |
| Cloudflare | DNS, network protection and proxying for the dashboard and API, object storage (R2) for deployment files and logs, the status page, and bot protection (Turnstile) on sign-up, log-in and password reset | Traffic to proxied hostnames, deployment files, logs |
| Neon | Managed PostgreSQL database for accounts, projects, deployments, settings and aggregated statistics (United States) | Account, project and usage data |
| GitHub | Sign-in with GitHub and access to repositories you connect, commit statuses and comments | Account identifiers; repository contents you authorise |
| Resend | Sending transactional email | Your email address and the message |
If you use the optional IP lookup in the dashboard, the address you look up (never a private address, and never your own visitors in bulk) may be sent to a public network-information service. Features that use other providers will be added to this list before they are switched on.
We also disclose information when the law requires it (for example a valid court order), to protect people and the Service from harm or fraud, and as part of a sale or transfer of the business, in which case we will tell you and the new operator will be bound by this policy. We only disclose the minimum needed and, where allowed, tell you.
6. Where your data and code are processed
The database is in the United States. The control plane and builds run on servers in Ohio, United States. Deployed sites and server-side code run in both Ohio and Sydney, Australia: each region keeps its own copy of your deployment so visitors are served from the nearest. Stored deployment files and logs are in Cloudflare’s object storage, and visitors anywhere may reach your site through Cloudflare’s or AWS’s networks. Staff and tooling that operate the Service may be in [Country]. So your data is transferred to, and processed in, the United States and Australia and possibly other countries from which you or your visitors connect.
Where the law requires safeguards for international transfers, we rely on our providers’ standard contractual clauses and data processing terms or other recognised mechanisms. Ask us if you would like a copy.
Where your code runs: builds run in isolated containers on our build server in Ohio; server-rendered applications run in isolated containers on runner servers in Ohio and Sydney. Containers have no access to our internal network. See the Security page.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account, projects, deployments, environment variables | While your account is open; deleted when you delete the account (backups roll off afterwards) |
| Audit trail | While your account is open |
| Build logs and runtime logs | Live logs are held for about 7 days after a build finishes, and the archived log is kept with the deployment |
| Traffic statistics (per minute / hour / day) | 7 days / 90 days / about 13 months |
| Lists of top visitor IP addresses | 30 days |
| Other ranked lists (paths, referrers, browsers and similar) | 90 days |
| Firewall counts / firewall events | 90 days / 30 days |
| Sessions | Until they expire or you end them |
| Emails and support messages | Up to 3 years, then deleted |
Uploaded file contents are stored under a hash of their content, which lets identical files be shared between deployments. After an account is deleted its files are no longer reachable and are removed by a periodic clean-up once nothing refers to them. Live build logs may remain for up to 7 days.
We may keep information longer where needed for a legal obligation, a dispute or to enforce our terms, and de-identified statistics that cannot identify you may be kept indefinitely.
8. Your choices and rights
Depending on where you live (including under the GDPR and UK GDPR, the Australian Privacy Principles, and US state laws such as in California), you may have the right to access the personal information we hold about you, correct it, delete it, restrict or object to its use, receive it in a portable format, withdraw consent, and not be treated worse for exercising your rights. In the dashboard (Settings → Your data) you can download all your data as a file and delete your account: we email a confirmation link, and following it removes your projects, deployments, domains, environment variables, firewall rules, activity log and sign-in records. You can also change your name, picture, password and two-factor settings, end sessions and delete projects there. For anything else, email privacy@vantrex.cloud from your account address. We will answer within 30 days (or sooner where the law says), may ask you to verify who you are, and will not charge unless a request is clearly excessive.
If you are a visitor to a site hosted on Vantrex and want to exercise rights over data about your visit, please contact the owner of that site first; we will help them respond.
9. Cookies and tracking
This website does not use cookies, advertising or analytics trackers. The dashboard uses a session cookie that keeps you signed in, and may remember preferences such as your theme; these are strictly necessary for the service you asked for, so they do not need a consent banner. The sign-up, log-in and password-reset pages of the dashboard may load Cloudflare Turnstile (from challenges.cloudflare.com) to tell people from automated bots. It receives your IP address and browser details, may set its own cookie, and is covered by Cloudflare’s privacy policy. Fonts and every other script come from our own servers. Sites you host choose their own cookies.
10. Security
We protect data with encryption in transit (HTTPS), encryption of environment variables at rest, hashed passwords and API keys, network isolation of customer code, least-privilege access, and an audit trail. No system is perfectly secure. If a breach affects your personal information we will notify you and the relevant regulator as the law requires, without undue delay. Report problems at our Security page.
11. Children
The Service is for people 16 and over and is not directed at children. If you believe a child has given us personal information, contact us and we will delete it.
12. Changes
We will update this policy as the Service changes (for example when we add a provider or begin charging). We will post the new version here with a new date and, for material changes, tell you by email or in the dashboard in advance.
13. Contact and complaints
[Operator legal name]
[Postal address]
privacy@vantrex.cloud
If you are not satisfied with our response you can complain to your data protection authority, for example the Office of the Australian Information Commissioner (oaic.gov.au), the UK Information Commissioner’s Office (ico.org.uk), or your EU supervisory authority.