Privacy Policy

The controller of your personal data is:

Account and order data: email address, name, company name, country, VAT ID, order contents, currency, amounts and payment status.

Technical data: IP address, browser type, pages visited, and server logs created when you use the website or your VPS control endpoints.

Support data: the content of tickets and emails you send us.

We do not receive or store your full card number at any point.

Performance of a contract (Art. 6(1)(b) GDPR) for taking orders, provisioning servers, billing and support. Legal obligation (Art. 6(1)(c)) for invoicing, VAT records and accounting retention. Legitimate interests (Art. 6(1)(f)) for fraud prevention, network security, abuse handling and service improvement. Consent (Art. 6(1)(a)) for optional analytics and marketing cookies and for newsletters.

Whop (payment processing), Brevo (transactional and marketing email), Supabase (database and authentication hosting in the EU), Cloudflare (DNS, CDN and bot protection), and our datacentre partners in Frankfurt, Madrid and Amsterdam. Each is bound by a data processing agreement and processes data only on our instructions.

Personal data is stored in the European Union wherever possible. Where a processor transfers data outside the EEA, the transfer is covered by the European Commission's Standard Contractual Clauses and additional technical safeguards.

Invoices and accounting records: five years from the end of the tax year, as required by Polish law. Order and account data: for the life of your account plus three years. Support tickets: three years. Server access logs: 30 days. Backups are cycled out within 30 days.

You have the right to access, rectification, erasure, restriction, data portability, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting prior processing. Write to order@skycloud-droid.site and we will respond within one month.

You may also lodge a complaint with your local supervisory authority, or with the Polish President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.

Data is encrypted in transit with TLS and at rest on encrypted volumes. Access to production systems is limited to the operator, protected by multi-factor authentication and logged. We notify affected customers and the supervisory authority of a qualifying personal data breach within 72 hours.

We do not carry out automated decision-making or profiling producing legal effects. Order fraud checks may flag an order for manual review by a human.

We publish changes on this page and update the date shown above. Material changes are announced by email to active customers at least 14 days in advance.