Who is responsible for your data
The controller of personal data processed through the website and the panel is the administrator of the deployment.sh service, reachable at support@deployment.sh. For data that your organization stores on its own servers through Deployment (for example application databases or logs), your organization is the controller and we act as a processor on its instructions.
What data we collect
- Account data. Your email address, a hashed password, the confirmation code status, your organization name and the roles you assign to team members.
- Billing data. Your plan, billing period, payment status and the billing details you provide for receipts or invoices. Card numbers are entered directly with our payment processor and never reach our servers.
- Server and site data. Server IP addresses and hostnames, the public part of the SSH key we use, cloud API tokens you add, repository URLs, deploy scripts, environment variables, process and cron definitions, deploy logs and the application and web server logs you choose to stream into the panel.
- Monitoring data. Uptime check results and server metrics such as CPU, RAM, disk and load.
- Deploy plan demo. When you use the demo, the public repository URL, the chosen cloud, environment and branch, the generated plan and your IP address.
- Technical data. IP address, browser user agent, request timestamps and security logs needed to run and protect the service.
- Support messages. The content of emails and in-panel help requests you send us.
- Signup source. Referral and campaign parameters present in the link you used to reach the site.
Why we process data and on what legal basis
- To create and run your account and deliver the service you subscribed to (performance of a contract).
- To charge for the plan, issue receipts and invoices and keep accounting records (performance of a contract and legal obligation).
- To secure the service, prevent abuse and investigate incidents (legitimate interest).
- To answer support requests (performance of a contract or legitimate interest).
- To send service emails such as confirmation codes, deploy failure alerts you configure, security notices and billing notices (performance of a contract).
- To understand which pages and channels bring signups, using aggregated data without advertising trackers (legitimate interest).
We do not sell personal data and we do not use it for advertising profiles.
Who receives your data
We share personal data only with service providers that help us run the service, under contracts that bind them to process it on our instructions and protect it.
- A hosting provider in the EU or US that runs the control plane and its databases.
- A payment processor that handles card payments, subscriptions and fraud checks.
- An email delivery provider that sends confirmation codes, alerts and receipts.
- An error monitoring and log storage provider, where used, limited to technical data.
- Professional advisers such as accountants or lawyers, where required.
- Public authorities, only when the law requires it.
Integrations you enable yourself, such as your cloud provider, git host, Slack, Discord, outgoing webhooks or your S3-compatible storage, receive data because you instruct us to send it there. Their own privacy terms apply to that data.
International transfers
Some providers may process data outside the European Economic Area. In that case we rely on an adequacy decision or on standard contractual clauses approved by the European Commission, together with additional safeguards where needed.
How long we keep data
- Account and server data, for as long as your account is active and up to 30 days after you delete it.
- Deploy history and logs, for the retention period of your plan (14 days, 90 days, 1 year or 2 years).
- Billing records, for as long as tax and accounting law requires.
- Deploy plan demo records, up to 90 days.
- Security logs, up to 12 months.
- Support messages, up to 3 years after the matter is closed.
Backups of the control plane roll over and are removed within 35 days after the source data is deleted.
How we protect data
Environment variables and cloud API tokens are encrypted at rest. Connections to your servers use SSH with a dedicated key, and the panel is served over HTTPS only. Access by our staff is limited to what is needed to run the service and is logged. More details are on the server security platform page.
Your rights
Depending on where you live, you have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable format and withdraw consent where processing is based on consent. Residents of California and other US states have the right to know, delete and correct personal information and are not discriminated against for using these rights. We do not sell or share personal information for cross-context behavioral advertising. To exercise any right, email support@deployment.sh from the address linked to your account. You may also lodge a complaint with your local data protection authority.
Cookies
The site uses only essential cookies for the session, CSRF protection and your preferences. There are no advertising pixels or third-party tracking cookies. See the Cookie Policy.
Children
The service is intended for businesses and professionals and is not directed at anyone under 16. We do not knowingly collect data from children.
Changes to this policy
We update this policy when our processing changes. The date at the top shows the latest version. Material changes are announced by email to account owners before they take effect.
Contact for privacy questions
Write to support@deployment.sh with the subject Privacy.