This policy explains how Depfloy, LLC (“Depfloy”, “we”, “us”) handles personal data on depfloy.com, app.depfloy.com and the services behind them.
It covers data about you — the person using Depfloy. It does not cover data your own application collects about your own users; that runs on your servers, we do not see it, and you are the controller of it. Where Depfloy processes personal data on your behalf, the Data Processing Agreement governs it and this policy is secondary to it.
Depfloy is a Delaware company and the Service runs on servers in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, that means your data is transferred to the United States — Section 8 explains on what legal basis.
1. What we collect
Account information. Your name, email address and password (stored hashed, never in readable form). If you sign in with GitHub, GitLab, Bitbucket, Google or Apple, we receive your name and email address from that provider, not your password.
Billing information. Your billing address and the details of your subscription. Card numbers never reach our servers — our payment processor collects and stores them, and returns a token we use to charge you.
Server and project configuration. Which servers exist, what runs on them, deploy history, backup schedules, domains and the activity log. Some of this identifies people: the activity log records which member performed each action and when.
Credentials that reach your servers. SSH private keys, sudo passwords, server credentials and the environment variables you enter. Section 3 covers these separately because they deserve it.
Technical information. IP address, browser and device type, referring page, and timestamps, collected automatically when you use the site or the app. Server logs retain these for a limited period, and IP addresses are also used to protect the sign-in form against automated abuse.
Support conversations. What you write to us, and what we write back.
What we do not collect. We do not ask for and do not want special category data — health, biometrics, political or religious views, and the rest of Article 9. Do not put it in a project name, an environment variable or a support ticket.
Children. Depfloy is for professional use and not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, write to [email protected] and we will delete it.
2. Why we are allowed to process it
Under the GDPR and equivalent laws, we rely on these bases:
| What | Why we may do it |
|---|---|
| Running your account, deploying, connecting to your servers, taking payment | Performance of a contract — this is what you signed up for |
| Fraud prevention, bot protection on sign-in, securing the platform, product analytics, keeping records of what changed | Legitimate interests — running a service that works and is not abused, balanced against your rights |
| Tax, accounting and legal record-keeping | Legal obligation |
| Marketing email, and the advertising cookies in Section 5 | Consent — which you can withdraw at any time, without affecting what came before |
Note what is not here: we do not rely on consent to run your account. Consent can be withdrawn at any moment, and a basis that could vanish mid-deploy would be the wrong one for keeping your servers working.
3. Your server credentials
This is the most sensitive data we hold, and it is worth being exact about it.
Stored: SSH private keys, sudo passwords, server credentials and project environment variables. Encrypted at rest with AES-256-CBC and an HMAC, using a random initialisation vector per value. Decrypted only in memory, only when a job needs to open a connection or write a release.
Who can reach them: the automation that runs your jobs, and the members of your organisation whose role permits it. Depfloy staff do not read them in the ordinary course of work, and we do not use your credentials to connect to your servers for a support investigation without your request — except where we reasonably believe it is necessary to stop active harm, in which case we will tell you.
Never sent anywhere else. Credentials are not shared with any third party in the list below. No sub-processor receives them.
Not stored: your application data, your databases, your files and your backups. Backups stream from your server straight to the destination you configured; we are not a hop in that path and keep no copy.
4. Who else sees your data
We do not sell personal data. We share it only with the companies that help us run the Service:
| Sub-processor | What it does | What it receives | Where |
|---|---|---|---|
| Stripe | Payments and subscriptions | Name, email, billing address, card data (collected directly by Stripe) | US / global |
| Intercom | In-app support chat | Name, email, account identifier, conversation content | US |
| Ahrefs Web Analytics | Site analytics | Pageview events, referrer, country, device. Ahrefs states it sets no cookies | US |
| Fathom (Conva Ventures Inc.) | Site analytics | Pageview and click events, referrer, country, device. Fathom states it sets no cookies | Canada |
| Google Ads | Conversion measurement for advertising | Signup and purchase conversion events | US / global |
| Reddit Ads | Conversion measurement for advertising | Hashed email, hashed phone number, IP address, user agent, event type | US |
| Cloudflare Turnstile | Bot protection on sign-in and registration | IP address, browser signals | Global |
The advertising rows deserve a plain sentence: when you sign up or subscribe, we send a conversion event to Google and Reddit. The email address and phone number in it are hashed before they leave us, which reduces the risk but does not make the data anonymous — hashing is pseudonymisation, and it is still personal data. These events are sent only if you have accepted marketing cookies (Section 5), and stop when you withdraw that.
We also disclose data where we must: to comply with a law or a valid legal demand, to enforce our Terms, to investigate fraud or a security incident, or in connection with a merger, acquisition or sale of assets — in which case the acquirer is bound by this policy or gives you notice of a new one.
Changes to this list. We will update this table before adding a sub-processor. Customers with a Data Processing Agreement in force receive notice and may object under Section 3 of that agreement.
5. Cookies
Strictly necessary cookies keep you signed in, protect the sign-in form and remember your interface preferences. They do not require consent and cannot be turned off without breaking the product.
The only optional category is Marketing — Google Ads and Reddit, to measure whether an ad led to a signup. It is not set until you say so.
Two measurement tools sit outside this. Ahrefs Web Analytics and Fathom count pageviews (Fathom also counts named clicks on trial CTAs) and load without asking. Both vendors state the script sets no cookies and collects no personal data, and consent under the ePrivacy rules is about reading from or writing to your device — so on that basis we do not gate them behind the banner. They are still listed as sub-processors in Section 4.
On your first visit a banner asks. Nothing in that category loads before you answer, and refusing takes one click in the same place as accepting. You can change or withdraw your answer at any time from Cookie settings in the footer of any page — withdrawing stops further collection immediately.
Your choice is stored in a cookie on depfloy.com and applies to the app as well, so you are not asked twice for the same thing. We ask again after six months.
Anything a vendor has already set stays until you clear it: we cannot delete a cookie on a domain we do not control. You can do that in your browser, or through Google’s ad settings and Reddit’s advertising preferences.
6. How long we keep it
| Data | Retention |
|---|---|
| Account and configuration | While your account is open |
| Server credentials and environment variables | Deleted within 30 days of account closure |
| Backups and application data | Never held — they live on your servers and in your storage |
| Activity log | 24 months, then deleted |
| Invoices and tax records | 7 years, as tax law requires |
| Support conversations | 24 months after the conversation closes |
| Server and access logs | 90 days |
| Analytics events | 14 months |
| Marketing list | Until you unsubscribe |
Where an account is closed with an unresolved dispute, a legal hold or an active fraud investigation, we keep what is necessary for that and no more.
7. Your rights
Wherever you live, you may ask us to give you a copy of your data, correct it, or delete it. Under the GDPR, the UK GDPR and similar laws you also have the right to restrict or object to processing, to receive your data in a portable format, to withdraw consent, and not to be subject to a decision made solely by automated means — we make none.
Much of this you can do yourself: your profile is editable in the dashboard, and closing your account starts the deletion above.
For anything else, write to [email protected]. We will respond within 30 days. We may need to verify who you are first, and we will not charge you unless a request is manifestly unfounded or repetitive.
If you think we have got it wrong, you may complain to your data protection authority — in the EEA, the one where you live or work. We would rather you told us first.
California residents. We do not sell or share personal information as CCPA/CPRA define those terms, and we do not discriminate against anyone who exercises their rights. The same address handles CCPA requests.
8. International transfers
The Service runs in the United States, so personal data from the EEA, the UK and Switzerland is transferred there.
For those transfers we rely on the European Commission’s Standard Contractual Clauses (Decision 2021/914), with the UK Addendum for UK data and the Swiss amendments for Swiss data, together with the technical measures described in Section 3. The Standard Contractual Clauses are incorporated into our Data Processing Agreement, and you can request a signed copy at [email protected].
We do not rely on the EU–US Privacy Shield. It was invalidated in 2020 and no longer exists as a transfer mechanism.
9. Security
We encrypt credentials at rest as described in Section 3 and traffic in transit. Access to production systems is limited to the people who need it. Passwords are hashed. Two-factor authentication is available on your account and we recommend turning it on.
No system is perfectly secure and we do not claim otherwise. If a breach affects your personal data and is likely to put your rights at risk, we will notify you and the relevant authority within the time the law requires.
10. Changes
We may update this policy. The date at the top of this page always reflects the current version. For a change that materially affects your rights, we will notify you by email or in the dashboard before it takes effect.
11. Contact
Depfloy, LLC 1111B S Governors Ave STE 29096, Dover, DE 19904, United States [email protected] — privacy, data rights, anything in this policy [email protected] — everything else
Depfloy, LLC is the controller of the personal data described here.