Privacy Policy
1. Overview
This policy explains how DebutDeploy handles personal data when you use our website and Service. For personal data contained in the applications and databases you deploy ("Your Content"), you are the data controller and we act as your processor — see our Data Processing Addendum. For your own account, we are the controller.
2. Who is responsible
The controller for account data is [legal entity name], [registered address]. Data protection contact: privacy@debutdepoly.com. [Appoint a DPO / EU-UK representative if required.]
3. What we collect
- Account data — name, email, avatar, and provider ID from GitHub or Google when you sign in.
- Billing data — company/billing details and a payment token; card numbers are handled by Stripe, not stored by us.
- Usage & resource metadata — services, databases, deployments, logs, and metering needed to run and bill the Service.
- Technical data — IP address, session cookies, and basic request logs for security and operation.
4. Why we use it (lawful bases)
We match each purpose to a lawful basis under Article 6 of the UK/EU GDPR:
| Purpose | Lawful basis |
|---|---|
| Provide the Service and run your account | Performance of our contract with you |
| Take payment and issue invoices | Contract; and legal obligation (tax & accounting records) |
| Secure the platform, prevent fraud and abuse, and keep audit logs | Legitimate interests — operating a secure, reliable service and protecting our platform and customers |
| Comply with legal, tax, and regulatory obligations | Legal obligation |
| Non-essential cookies and any analytics | Consent |
Where we rely on legitimate interests you may object at any time; where we rely on consent you may withdraw it at any time.
5. Cookies
We use a small number of strictly necessary cookies for authentication and session security. We do not run third-party advertising trackers. Where we add analytics, we will ask for consent first and list them here.
6. Sharing and subprocessors
We share data with the vendors that run the Service (hosting, payments, and sign-in). The current, named list is in our subprocessor register. We do not sell personal data.
7. International transfers
Hosting is in the EU (Germany and Finland), so your hosted data stays in the EEA. Some of our vendors — Stripe, GitHub, and Google — process account or payment data in the United States. Those transfers are covered by the EU Standard Contractual Clauses and the UK International Data Transfer Addendum (IDTA), supported by a transfer risk assessment. See our subprocessor register.
8. Retention
We keep account and billing data for as long as you have an account and then as needed for legal, tax, and accounting purposes (typically up to [6-7 years] for financial records). Operational logs are kept for a shorter period. Deleted resources are purged within a reasonable window.
9. Your rights
Subject to law, you may access, correct, delete, restrict, or object to processing of your personal data, request portability, and — where we rely on consent — withdraw that consent at any time. To exercise any right, contact privacy@debutdepoly.com.
You also have the right to complain directly to us. Email privacy@debutdepoly.com and we will acknowledge your complaint within 30 days and respond without undue delay. If you remain unhappy, you can complain to a data protection authority — in the UK, the Information Commissioner's Office (ICO); in the EU, your local supervisory authority.
10. Security
We protect data with encryption in transit, encrypted secret storage, access controls, and isolation between customer workloads. See our Security overview.
11. Changes
We will post updates here and change the effective date; we will notify you of material changes.