Privacy Policy

1. Who we are

We are the controller for the personal data described in this policy: data about you as a DeployLane customer and as a visitor of deploylane.dev.

2. The short version

• We collect what we need to run your account and to do what you ask DeployLane to do.
• There are no analytics, advertising or tracking cookies on this website or in the dashboard.
• We don't sell your data, and we don't use it to train AI models.
• Your apps, databases and backups run in your own Hetzner account. DeployLane only connects to them to do what you ask.
• DeployLane itself runs on Hetzner servers in Falkenstein, Germany.

3. What we collect and why

“Contract” means we need the data to provide DeployLane to you. “Legitimate interest” means we have a good reason, such as keeping DeployLane secure, that doesn't outweigh your interests. You can object to it (see section 10).

The credentials you connect and your environment variables are stored encrypted. Access tokens for the API and the MCP server are stored only as a hash. We don't use automated decision-making or profiling.

4. Data on your servers

Your apps run on servers in your own Hetzner account. For the personal data your apps process, you are the controller and DeployLane acts as your processor. DeployLane connects to your servers over SSH to deploy, to run backups and restores, and to show you logs, metrics and query results when you ask for them.

• Container logs, query results and database contents are shown in your browser, but we don't store them.
• Backups go straight from your server to your own Object Storage bucket. They don't pass through DeployLane.
• We write what your apps need to your servers: the code checkout, your environment variables and the scripts for your jobs. Environment files and job scripts are readable only by root.
• Traefik on your servers keeps an access log (visitor IP address, browser and requested URL), which DeployLane uses to show you traffic statistics. A default maintenance job rotates it daily and keeps 14 days.
• Your servers request TLS certificates from Let's Encrypt using your email address. Domain names on certificates appear in public Certificate Transparency logs, and automatic domains under apps.deploylane.dev are visible in public DNS.

5. Who we share data with

We use the following providers to run DeployLane. They only process personal data on our instructions.

When you connect Hetzner or GitHub, DeployLane sends those services the requests needed to do what you ask, using your own credentials. Their own privacy policies apply to your accounts there.

The information page at mcp.deploylane.dev loads its fonts from Google Fonts, so Google receives your IP address when you open that page. The dashboard and this website host their fonts themselves.

We only share personal data with others when the law requires it, for example when a competent authority orders us to.

6. Data outside Europe

Clerk is based in the United States, Stripe also processes payment data in the United States, and SMTP2GO is based in New Zealand, so some of your data is processed outside the European Economic Area. In that case we rely on the safeguards the GDPR provides for: an adequacy decision of the European Commission (such as the one for New Zealand or the EU–US Data Privacy Framework) or the Commission's standard contractual clauses.

7. How long we keep data

• Account data and your setup: as long as you have an account.
• Deploy logs, database console queries and key downloads: until you delete the app or server they belong to, or your account.
• MCP calls: the last 30 per token. Revoking a token deletes its log.
• Contact form messages: as long as we need them to handle your question.
• Billing records and the invoices we issue, including the company name, address and VAT number on them: seven years, because Dutch tax law requires it, also after you delete your account.
• Backups in your Object Storage are in your own account: 7 days by default, adjustable from 1 to 30 days.

When you ask us to delete your account, we delete your data from DeployLane and Clerk within 30 days, except what we must keep by law, such as invoices. Copies in our own database backups expire within 30 days after that. Your servers, buckets and backups in Hetzner stay yours; DeployLane simply stops managing them.

8. Cookies and local storage

• deploylane.dev sets no cookies. It remembers your light or dark theme in your browser's local storage.
• The dashboard only uses the cookies Clerk needs to keep you signed in, and local storage for your theme and sidebar preferences.

These are all strictly necessary for what you're doing, so we don't ask for consent. There are no analytics, advertising or tracking cookies.

9. Security

All traffic to DeployLane uses HTTPS. Credentials and environment variables are encrypted in our database with AES-256-GCM, and API and MCP tokens are stored as hashes. Access to production systems is limited to the people who run DeployLane. If something goes wrong that affects your data, we'll tell you and, where required, the Dutch Data Protection Authority.

10. Your rights

Under the GDPR, you can ask us to:

• show you the personal data we have about you;
• correct it, or delete it;
• limit how we use it, or stop using it where we rely on legitimate interest;
• give you a copy in a machine-readable format.

Email support@deploylane.dev. We'll answer within one month. If you think we handle your data wrongly, you can also complain to the Dutch Data Protection Authority, Autoriteit Persoonsgegevens.

11. Changes to this policy

We update this policy when DeployLane changes. For changes that matter, we'll email you before they take effect. The date at the top shows the latest version.

12. Contact

Questions about privacy? Email support@deploylane.dev or use our contact form. Also see our Terms of Service.