GoedVPS
Sign in

Privacy policy

Last updated: [date]

Who we are

GoedVPS is run by [Company name], [Address], registered with the Dutch Chamber of Commerce under number [KvK]. We decide what happens with the data on this page. Questions go to [email protected].

What we store and why

  • Your account. Email address, display name, a hash of your password, when you signed up, last signed in and agreed to our terms, the codes we email you to confirm your address or an action, and the secret for two-step sign-in, stored encrypted. We need these to give you an account.
  • Your workspaces. Names, descriptions, icon links, who is a member and the email addresses you send invites to. We need these to run the service you asked for.
  • Your apps. Their settings, variables, uploaded code and build logs. We need these to build and run your apps.
  • API keys. The name of each key you create, a hash of it, and when it was last used.
  • GitHub, only if you connect it. Your GitHub user ID, username, profile and avatar links, and which repositories you gave access to.
  • Billing. Your billing email, the type of payment method, the card brand, its last 4 digits and expiry date, the IP address you paid from (if we did not get it, the last one you signed in from), the country of your card or bank, and your invoices. We need these to charge you, and Dutch tax law makes us keep invoices for 7 years.
  • Activity log. Who deployed, changed or removed which app, and when. We keep it to help you and to find abuse.
  • Active sessions. The IP address and browser of each device you sign in on, so you can see and sign out those devices on your account page. We delete them when you sign out there, or 30 days after the device was last used.
  • IP addresses. Besides the list above, they are held briefly in memory to stop too many sign-in attempts.

Cookies and browser storage

We only use what the panel needs to work. There are no analytics, advertising or tracking cookies, so we do not ask for consent.

  • __Host-session keeps you signed in. It lasts 30 days after your last visit.
  • goedvps_trusted_device skips the two-step code on a device you chose to trust. It lasts 30 days.
  • Browser storage remembers your light or dark theme, recent searches, column widths, notices you closed and queries you typed in the database manager. It never leaves your browser.

Who else receives your data

  • Mollie (the Netherlands) handles payments. It receives your billing email and the payments you make. You enter your card or bank details at Mollie, not with us.
  • [Mail provider] sends our emails. It receives your email address and the content of the email, such as a sign-in code or an invoice.
  • GitHub (United States), only if you connect it. We fetch your code from it, and your avatar image loads from GitHub.
  • Let's Encrypt (United States) issues the certificates for web addresses. Every address, including your own domain, is published in public certificate logs.
  • Cloudflare (United States) sits in front of this panel to protect it against attacks. It handles every visit, so it sees your IP address, your browser and what you send. It also answers our DNS lookups when we check that your own domain points at us.
  • Hosting. The panel, your apps and their data run on servers at [Data center, country].
  • Workspace icons. An icon link you enter loads from that website, which then sees the visitor's IP address.

Where data goes to the United States, the transfer relies on [the EU-US Data Privacy Framework or standard contractual clauses]. We do not sell your data.

Data inside your apps

What your apps and databases store belongs to you. We only host it on your behalf and never look at it, unless you ask us to, we need to for an abuse report, or the law requires it. A data processing agreement is available on request at [email protected].

Why we may use it

  • To give you what you signed up for: your account, workspaces, apps, API keys, GitHub and billing.
  • Because the law requires it: keeping invoices for 7 years.
  • To keep the service safe: the activity log, active sessions, IP addresses and Cloudflare.

We do not make decisions about you by computer alone.

How long we keep it

  • Account, workspace and app data: until you delete your account, plus 30 days in which you can still keep it.
  • Invoices: 7 years, because the law requires it.
  • Server logs: until newer lines overwrite them, usually within [X days].
  • Backups of app storage: daily backups until a newer one replaces them, as many as your plan allows per app. Backups you take yourself until you delete them. Backups taken before a restore 7 days. Deleting an app deletes its backups.

Your rights

You can delete your account and all its data yourself, on the Account page. You can also ask to see, correct or export your data, limit how we use it, or object to how we use it. Email [email protected] and we reply within one month. If you are not happy with our answer, you can complain to the Autoriteit Persoonsgegevens.