⚡ Drop to DeployDocs

Privacy Policy

How Deployxa collects, uses, shares, secures and retains personal data across the platform, CLI and APIs.

Last updated November 2, 2026

1. Who we are and what this policy covers

This Privacy Policy explains how Deployxa (“Deployxa”, “we”, “us”) collects, uses, shares and protects personal data when you visit our website, create an account, use the dashboard, the @deployxa/cli command-line tool or our APIs, or contact us.

For personal data about our own customers and website visitors (for example your account and billing details), Deployxa is the controller. For personal data contained in the applications, databases and files you deploy on Deployxa (“Customer Content”), you are the controller and Deployxa processes that data on your behalf as a processor under our Data Processing Agreement. This policy does not describe how you, as our customer, handle the personal data of your own users; your own privacy notice should do that.

2. Information we collect

We collect only what we need to sign you in, run your deployments, bill you and keep the platform secure.

Account information

  • Your name, email address and password (stored as a one-way hash by our authentication provider, never in plain text).
  • If you sign in with Google, the basic profile Google shares with us (name, email address, profile picture and a unique account ID).
  • If you connect GitHub to deploy from a repository, your GitHub username and account ID, the repositories you authorize, and the access token GitHub issues so we can fetch code and receive push webhooks.
  • Workspace and team details: workspace names, team members you invite, their roles and invitation status.

Billing information

  • Your plan, subscription status, invoices, credit balance, top-ups and payment history.
  • Billing name, billing address and tax identifiers where you provide them.
  • Payments are taken by our payment processors (see Section 5). Card numbers and mobile-money credentials are entered on the processor’s own checkout and are not stored by Deployxa. We receive confirmation of the payment, a transaction reference and limited details such as the card brand or last four digits.

Deployment and telemetry data

  • Project configuration: repository and branch, build settings, environment names, custom domains and DNS records.
  • Environment variables and secrets you set. These are encrypted at rest and injected into your containers at runtime; we do not read them except where you ask us to for support or where required to operate the service.
  • Deployment history, build status, resource usage (CPU, memory, storage), request counts and bandwidth, used to run and bill the service.

Logs

  • Build output, container logs and HTTP access logs for your apps, which may include IP addresses and request paths of your own visitors.
  • Security and audit events for your account and workspace, such as sign-ins, API key creation and revocation, and member changes.
  • Our own server logs for the dashboard and API, which record IP address, user agent, timestamps and request metadata.

Cookies, local storage and analytics

  • Essential cookies and browser storage that keep you signed in, protect forms and remember your cookie choice.
  • With your consent only: analytics (Google Analytics 4 with IP anonymization, and Microsoft Clarity where enabled), product usage events tied to a random identifier, and the campaign source (UTM parameters and referring site) that brought you to us.

See the Cookie Policy for the full list of categories.

Communications

Messages you send to support, the content of tickets, and records of the transactional emails we send you (for example verification, invitation and billing emails).

3. How we use information

  • Provide the service: create and secure your account, build and run your deployments, route domains and issue TLS certificates.
  • Billing: process subscriptions, credit top-ups and invoices, and prevent payment fraud.
  • Support: answer your questions and troubleshoot builds and deployments, including with AI-assisted features you choose to use.
  • Security and abuse prevention: detect unauthorized access, enforce the Acceptable Use Policy and investigate incidents.
  • Service communications: send verification, security, billing and important product notices. These are not marketing and you cannot opt out while you hold an account.
  • Improve the product: understand which features are used, with consent where cookies or similar technologies are involved.
  • Legal obligations: keep accounting and tax records and respond to lawful requests.

Where the EU or UK General Data Protection Regulation (GDPR) or a similar law applies, we rely on these legal bases:

  • Contract: to provide the service you signed up for, including account, deployment and billing data.
  • Legitimate interests: to secure the platform, prevent abuse and fraud, keep operational logs and improve the service, balanced against your rights.
  • Consent: for analytics, marketing and preference cookies. You can withdraw consent at any time from Cookie Settings in the footer.
  • Legal obligation: to keep financial records and comply with lawful requests from authorities.

5. Sharing and subprocessors

We do not sell your personal data and we do not share it for cross-context behavioural advertising. We share it only as follows:

  • Payment processors: Stripe, Paystack and Bachs, depending on the payment method you choose at checkout.
  • Authentication: Google, when you sign in with a Google account; our authentication is built on Google Firebase Authentication.
  • Source control: GitHub, when you connect a repository.
  • Analytics: Google (Google Analytics 4) and Microsoft (Clarity), only after you consent.
  • AI model providers: when you use AI-assisted features, the relevant prompt and context (for example a build log) is sent to the model provider configured for that feature. The platform supports providers such as OpenAI, Anthropic and Google Gemini.
  • Hosting and infrastructure: the data-centre and cloud providers that host our servers and backups.
  • Email delivery: the provider we use to send transactional email.
  • Professional advisers and authorities: lawyers, auditors and accountants under confidentiality, and authorities where the law requires it.
  • Business transfers: a successor in a merger, acquisition or sale of assets, subject to this policy.

Our subprocessors may only use personal data to provide their service to us. The current list is maintained in the Data Processing Agreement.

6. AI features

Deployxa’s AI features help troubleshoot builds and generate configuration. They only run when you use them. Your private source code and Customer Content are not used by Deployxa to train AI models, and we do not authorize our model providers to do so. Prompts are sent over encrypted connections and kept only as long as the feature needs them.

7. Retention

  • Account and workspace data: for as long as your account is open, then deleted after you close it, except for what we must keep by law.
  • Customer Content (apps, containers, databases, files): deleted when you delete the project or close your account, subject to backup rotation.
  • Deployment and container logs: 30 days by default; configurable on Enterprise plans.
  • Raw analytics events: 90 days, after which only aggregated figures are kept.
  • Backups: rotated on their retention schedule (30 days by default).
  • Billing records: for the period required by tax and accounting law.
  • Cookie choice: 12 months, after which we ask again.

8. International transfers

Deployxa and its subprocessors may process personal data in countries other than yours, including countries that do not have the same data protection laws. Where we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we use an approved transfer mechanism, such as the European Commission’s Standard Contractual Clauses (and the UK Addendum), or rely on an adequacy decision. You can ask for more information about these safeguards at [email protected].

9. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to restrict or object to processing, and to withdraw consent. California residents have the right to know, delete and correct personal information and not to be discriminated against for exercising these rights.

You can export your account data and request deletion yourself under Settings, Privacy, or email [email protected]. We may need to verify your identity first. We respond within one month. See GDPR rights for details of each right and how to complain to a supervisory authority.

10. Children

Deployxa is a developer platform and is not directed at children. You must be at least 16 years old, or the age of digital consent in your country if higher, to create an account. If you believe a child has given us personal data, contact [email protected] and we will delete it.

11. Security

We protect data with container isolation, TLS on every route, encryption of secrets at rest, role-based access control and audit logging. No system is perfectly secure, and we cannot guarantee absolute security. The Security Policy describes our controls in more detail. Report a suspected vulnerability to [email protected].

12. Changes to this policy

We may update this policy as the service or the law changes. We will change the “Last updated” date above and, for material changes, notify account holders by email or in the dashboard before the change takes effect.

13. Contact

For privacy questions or to exercise your rights, email [email protected]. For security reports, email [email protected].

Questions about this document? Email [email protected].