Privacy Policy

1. Who we are

deploybase is a static site hosting platform operated by TwanIT, a sole proprietorship (eenmanszaak) registered in the Netherlands.

Trade name

TwanIT / deploybase

KVK number

71667415

VAT ID

NL002404374B49

Address

Email

support@deploybase.eu

TwanIT is the data controller for the personal data processed through deploybase, as defined in the General Data Protection Regulation (GDPR / AVG).

2. Data we collect

We collect only the data necessary to provide our service.

Account data

When you create an account: your name, email address, and authentication credentials. Passwords are never stored in plain text — authentication is handled by our self-hosted Zitadel identity provider.

Billing data

When you subscribe to a paid plan: company name, billing address, VAT identification number, and payment method details. Payment processing is handled by Creem (our EU-based Merchant of Record) — we do not store credit card numbers.

Usage data

When you use the platform: deployment metadata (project names, build logs, domain configurations), IP addresses in server logs, and API request logs.

Communication data

When you contact us: your email address and the content of your message.

Feedback data

When you submit feedback through the in-app feedback widget: the content of your message, the feedback type you selected, and a minimal technical context to help us reproduce issues — the page path you were on (query strings are stripped), the app version, your browser viewport size, and your browser's user-agent string. We do not capture screenshots, your IP address, or query-string parameters. Feedback is processed on the basis of our legitimate interest (Art. 6(1)(f)) in fixing bugs and improving the service, is retained for the duration of your account, and is deleted together with your team's data when your account is deleted.

3. Why we collect your data

We do not use your data for profiling, automated decision-making, or selling to third parties.

4. Legal basis

We process your data based on the following legal grounds under GDPR Article 6:

• Contract performance (Art. 6(1)(b)) — Processing necessary to provide the hosting service you signed up for: account management, deployments, billing.
• Legal obligation (Art. 6(1)(c)) — Tax record keeping and invoice retention as required by Dutch tax law (7-year retention).
• Legitimate interest (Art. 6(1)(f)) — Security monitoring, abuse prevention, and service improvement. We balance this against your privacy rights.

We do not rely on consent as a legal basis for core service functionality.

5. Data processors

We use a limited number of trusted third-party processors. All are based in the EU or provide adequate data protection guarantees. Each is bound by GDPR Article 28 data processing terms.

Authentication (Zitadel) is self-hosted on our own infrastructure — no third-party access to your credentials.

For full details, see our Data Processing Agreement and Security page. Full details, legal entities and registration numbers are on our subprocessors page.

6. International data transfers

Your data is stored and processed exclusively within the European Union. Our servers are located in Scaleway's Paris datacenter. Our CDN provider (Bunny.net, headquartered in Slovenia, EU) delivers cached static content globally via edge nodes for optimal performance. The CDN caches only publicly accessible static files (HTML, CSS, JS, images) — no personal data is stored or processed outside the EU.

For the personal data we handle ourselves, as controller or through our processors, we do not transfer personal data to countries outside the European Economic Area (EEA). CDN edge caching of public static content does not constitute a transfer of personal data. If our data handling practices ever change, we will update this policy and ensure appropriate safeguards (such as Standard Contractual Clauses) are in place.

Billing is the one exception worth naming. Our merchant of record, Creem (Armitage Labs OÜ, Tallinn, Estonia), is an independent controller for payment processing, and card payments in its provider chain can run on US payment infrastructure under EU standard contractual clauses. The billing relationship, invoicing and VAT handling stay in the EU.

7. Data retention

You can delete your account yourself. Sign in and go to Settings → Account. Requesting deletion opens a 14-day grace period: nothing is removed during those 14 days, and you can cancel the request at any point in that window. Once the grace period ends, erasure runs automatically. You can also ask us to handle it instead by emailing support@deploybase.eu. Either way, your personal data is removed within 30 days of the request, except where the law requires us to keep records.

Two things outlast the erasure. Invoices, and the billing details attached to them, stay with Creem, our payment provider, which sells our subscriptions on our behalf. Dutch tax law obliges us to keep them for 7 years after the financial year in which they were issued. We also keep one anonymous record that a deletion happened, so we can show we honoured your request. That record holds no name, no email address and no other detail that points back to you: your address is stored only as a code derived from it that cannot be turned back into the address.

8. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access — Request a copy of the personal data we hold about you.
• Right to rectification — Request correction of inaccurate or incomplete data.
• Right to erasure — Request deletion of your personal data ("right to be forgotten"). You can do this yourself from Settings → Account.
• Right to data portability — Receive your data in a structured, commonly used format.
• Right to restrict processing — Request that we limit how we use your data.
• Right to object — Object to processing based on legitimate interest.

You can exercise your right of access, data portability and erasure yourself, without contacting us. Sign in and go to Settings → Account, then choose Download my data. You get a JSON file containing your profile, your membership of every team you belong to, invitations addressed to your email address, and feedback you have sent. The file explains what it contains and what it does not.

Assets owned by a team — projects, deployments, build logs, custom domains and forms — are not part of that file, because they belong to the team rather than to you individually. Some of those team-owned records do note your email address as the person who acted, such as the deployment you triggered or the share link you created. Waiting-list signups are held separately under a different lawful basis and are also not included. Email us for either of those, or export a form's submissions from that form's page in the dashboard.

The same page carries Delete this account. Deletion is self-serve, and reversible for a while: the request opens a 14-day grace period in which nothing is removed and you can cancel, and erasure runs automatically once that period ends. Download your data first if you want to keep a copy. See Data retention above for the little that we have to keep afterwards, and why.

To exercise any of the other rights above, or if you would rather we handled the request for you, email us at support@deploybase.eu. We will respond within 30 days.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

9. Cookies

deploybase uses only functional cookies that are strictly necessary for the service to work (authentication session, CSRF protection). These do not require consent under the Dutch Telecommunicatiewet.

We do not use tracking cookies, advertising cookies, or third-party analytics that track individual users. No cookie consent banner is required because we do not place any non-essential cookies.

10. Security

We take appropriate technical and organizational measures to protect your personal data, including:

• Encryption in transit (TLS) and at rest
• Authentication via passkeys and secure password hashing
• Role-based access control with team isolation
• Regular security updates and monitoring
• Infrastructure hosted in ISO 27001 certified datacenters

If we discover a data breach that affects your personal data, we will notify you and the Autoriteit Persoonsgegevens within 72 hours as required by GDPR.

For a full overview of our security measures, see our Security & Compliance page.

11. Changes to this policy

We may update this privacy policy from time to time. When we make material changes, we will notify you by email or through a notice on the platform. The "last updated" date at the top of this page reflects the most recent revision.

12. Contact

For privacy-related questions or to exercise your rights:

Email

support@deploybase.eu

Postal address