1. Data Controller

Octagon Solutions LLC ("we", "us", "our") operates the OctaDeploy platform at octadeploy.com and app.octadeploy.com. This Privacy Policy explains how we collect, use, store, and protect personal data in compliance with the EU General Data Protection Regulation (GDPR) and applicable data protection law.

2. Data We Collect

Account data

Name, email address, password (stored as a bcrypt hash — never in plaintext).

Billing data

Payment details are processed by Stripe, Inc. We store only the last four digits of your card, your plan tier, and billing status. Full card numbers are never stored on our servers.

Deployment data

Git repository URLs, application source code and files you deploy, environment variables you configure, and custom domain settings.

Usage data

IP addresses, HTTP access logs, deployment logs, container resource metrics (CPU, RAM). These are used for service operation and security monitoring.

Communications

Emails you send to support@octadeploy.com and support correspondence.

3. Legal Basis for Processing (GDPR Art. 6)

• Contract performance (Art. 6(1)(b)) — to deliver the hosting service you subscribed to, including deploying your applications, provisioning SSL, and managing custom domains.
• Legitimate interests (Art. 6(1)(f)) — for security monitoring, fraud prevention, abuse detection, and platform stability improvements, where these interests are not overridden by your rights.
• Legal obligation (Art. 6(1)(c)) — where retention or disclosure is required by applicable law (e.g. accounting and tax records).

4. Infrastructure & Sub-processors

Your data is stored on servers operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany — an EU-based data center subject to German and EU law. We do not host your data outside the EU/EEA without prior notice.

Our sub-processors:

• Hetzner Online GmbH (Germany, EU) — dedicated server infrastructure
• Stripe, Inc. (USA) — payment processing (governed by Stripe's own GDPR-compliant DPA)

5. International Data Transfers

Octagon Solutions LLC is incorporated in Florida, USA. Operating the service may involve transfers of personal data from the EU/EEA to the USA. We rely on Standard Contractual Clauses (Module 2: Controller to Processor, per Commission Implementing Decision 2021/914) as the legal mechanism for such transfers under Art. 46(2)(c) GDPR. A copy of the applicable SCCs is available upon written request to support@octadeploy.com.

6. Data Retention

• Account data: retained for the duration of your contract and deleted within 30 days of account termination.
• Billing and invoice records: retained for 7 years as required by applicable accounting regulations.
• Application files, environment variables, and deployment logs: deleted within 30 days of account termination.
• Access logs: retained for 90 days for security purposes, then deleted.

7. Your Rights (GDPR Chapter III)

As a data subject in the EU/EEA, you have the right to:

• Access your personal data (Art. 15)
• Rectify inaccurate data (Art. 16)
• Erase your data ("right to be forgotten") (Art. 17)
• Restrict processing (Art. 18)
• Data portability — receive your data in a machine-readable format (Art. 20)
• Object to processing based on legitimate interests (Art. 21)
• Lodge a complaint with the supervisory authority in your EU member state of residence

To exercise any right, email support@octadeploy.com. We will respond within 30 days.

8. Cookies

We use only strictly necessary session cookies required for authentication and security (CSRF protection). We do not use analytics, advertising, or tracking cookies. No cookie consent banner is required because we set no non-essential cookies.

9. Security Measures

We implement appropriate technical and organisational measures including:

• TLS 1.2+ encryption for all data in transit
• Isolated Docker containers per application — apps cannot access each other's data
• Role-based access controls on the platform and server level
• Regular security patches applied to the underlying infrastructure
• Incident detection and response procedures

10. Changes to this Policy

We will notify you by email at least 14 days before any material changes take effect. Continued use of the service after the effective date constitutes acceptance of the revised policy.