Privacy Policy

Last updated: March 2026 · Onyx Deploy · hello@onyx-deploy.eu

🇪🇺 All your data is stored exclusively on servers within the European Union. We do not transfer personal data outside the EU. This policy complies with the General Data Protection Regulation (GDPR).

1. Who We Are

Onyx Deploy ("we", "us", "our") operates the cloud deployment platform available at onyx-deploy.eu. We are the data controller for the personal data described in this policy.

Contact: hello@onyx-deploy.eu

2. What Data We Collect

We collect the minimum data necessary to provide the Service:

Category	Data collected	Purpose	Legal basis
Account data	Email address, password (hashed), account creation date	Authentication and account management	Contract performance
Billing data	Subscription plan, payment history. Card details are handled exclusively by Stripe — we never store card numbers.	Processing payments and managing subscriptions	Contract performance
Project data	Project names, deployment history, environment variable names (not values), custom domains, build logs	Delivering the deployment service	Contract performance
GitHub integration	GitHub installation ID, repository names, webhook events. We request only the minimum GitHub App permissions needed.	Triggering automated deployments from your repositories	Contract performance
Technical logs	IP addresses, request paths, HTTP status codes, timestamps (access logs retained 30 days)	Security monitoring, debugging, abuse prevention	Legitimate interest
Analytics & Speed Insights	Pageview counts, device types, country (derived from IP, not stored), Core Web Vitals — only for Hobby/Pro plan users who have enabled tracking on their projects	Providing analytics to project owners	Legitimate interest / consent of project visitors

We do not collect or store the contents of environment variable values. We do not read your application code beyond what is necessary to execute the build process.

3. How We Use Your Data

To create and manage your account
To build and deploy your applications
To process payments and manage your subscription
To send transactional emails (deployment notifications, billing receipts, password reset)
To detect and prevent security incidents and abuse
To respond to support requests

We do not use your data for advertising, profiling, or selling to third parties. We do not engage in automated decision-making that produces legal effects.

4. Third Parties

We share data with the following third-party processors, all operating under GDPR-compliant data processing agreements:

Provider	Purpose	Data shared	Location
Hetzner Online GmbH	Server infrastructure and hosting	All data stored on platform	Germany / Finland (EU)
Stripe	Payment processing	Email address, subscription details, payment method	EU (Stripe Ireland Ltd.)
GitHub (Microsoft)	Source code integration via GitHub App	Installation ID, repository access events	USA — Standard Contractual Clauses apply

GitHub is the only third party located outside the EU. Data exchanged with GitHub is limited to integration metadata (repository names, push events) and is covered by Standard Contractual Clauses (SCCs) under GDPR Article 46.

5. Data Retention

Account data: Retained for the duration of your account. Deleted within 30 days of account deletion request.
Project and deployment data: Retained while your account is active. Projects paused after subscription cancellation are deleted after 180 days (see Terms of Service).
Database backups: 7 rolling backups, each retained for up to 6 hours. Permanently deleted when the associated project is deleted.
Access logs: Retained for 30 days for security and debugging purposes.
Billing records: Retained for 7 years as required by Belgian tax law.

6. Your Rights Under the GDPR

As a data subject under the GDPR, you have the following rights:

Right of access Request a copy of the personal data we hold about you.

Right to rectification Ask us to correct inaccurate or incomplete data.

Right to erasure Request deletion of your personal data ("right to be forgotten").

Right to data portability Receive your data in a machine-readable format.

Right to restriction Ask us to limit how we process your data in certain circumstances.

Right to object Object to processing based on legitimate interest.

To exercise any of these rights, email hello@onyx-deploy.eu. We will respond within 30 days. You may also lodge a complaint with the Belgian supervisory authority: Gegevensbeschermingsautoriteit (GBA).

7. Security

We implement technical and organizational measures to protect your personal data, including:

Encryption in transit (TLS 1.2+) for all connections
Passwords stored as bcrypt hashes — we cannot recover your password
Authentication tokens with short expiry and server-side revocation
Container isolation between users' workloads
Access logs and automated security monitoring
Server infrastructure hardened with firewall rules, intrusion detection, and DDoS protection

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Gegevensbeschermingsautoriteit (GBA) within 72 hours and inform affected users without undue delay.

8. Cookies

The Onyx Deploy dashboard uses a single session cookie to keep you logged in. No third-party tracking cookies, advertising cookies, or analytics cookies are used on our platform.

The marketing website (onyx-deploy.eu) uses no cookies.

9. Children

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you by email at least 14 days before material changes take effect. The current version is always available at onyx-deploy.eu/privacy.html. This policy is governed by the laws of Belgium.

11. Contact

For any privacy-related questions or to exercise your rights:

Email: hello@onyx-deploy.eu
Supervisory authority: Gegevensbeschermingsautoriteit (GBA) (Belgium)