Skip to content
Legal

Privacy Policy

Last updated: May 27, 2026

1. Overview

Vloud is a self-hosted platform. Your hosted data (websites, databases, email, files) stays on your servers and is never transmitted to us. This privacy policy covers the limited data we collect through the Vloud cloud services: licensing, billing, customer portal, and update distribution.

2. Data We Collect

Account Information

  • Email address (for authentication and communication)
  • Company name (optional, for billing)
  • Country (optional, for tax compliance)

Licensing Data

  • Machine ID (anonymous identifier for your server)
  • Engine version (to deliver compatible updates)
  • License status (active, expired, trial)
  • Heartbeat timestamps (to verify license validity)

Billing Data

  • Payment information is processed by Stripe. We do not store credit card numbers.
  • Stripe customer ID and subscription status are stored for billing management.

Support Tickets

  • Ticket content (subject, body, attachments) submitted through the customer portal.
  • Diagnostic bundles uploaded voluntarily for troubleshooting.

3. Data We Do NOT Collect

Vloud is self-hosted. We have no access to:

  • Your hosted websites, applications, or source code
  • Your databases or database contents
  • Your email messages or mailbox contents
  • Your DNS records or domain configurations
  • Your server files, logs, or system configurations
  • Your tenants' or customers' data
  • SSH keys, passwords, or access credentials on your server

4. How We Use Your Data

  • Authentication: Email address for magic-link sign-in
  • Licensing: Machine ID to bind licenses to servers
  • Updates: Engine version to deliver compatible releases
  • Billing: Email and company info for invoices
  • Support: Ticket content to resolve your issues
  • Communication: Product updates, security notices, trial reminders

5. Data Sharing

We do not sell your data. We share data only with:

  • Stripe — for payment processing
  • Resend — for transactional email delivery
  • Law enforcement — only when legally required

6. Data Retention

Account and licensing data is retained for the duration of your account. Support tickets are retained for 2 years after resolution. Billing records are retained as required by tax law. You may request deletion of your account and associated data at any time.

7. Security

Cloud data is encrypted in transit (TLS 1.2+) and at rest. License tokens are signed with Ed25519. Session tokens use HS256 JWT in httpOnly cookies. We do not store passwords — authentication is via magic link (email-based, passwordless).

8. Your Rights

You have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Request deletion of your account and data
  • Export your data in a portable format
  • Withdraw consent for marketing communications

9. Cookies

The customer portal uses a single httpOnly session cookie (sky_customer_session) for authentication. No tracking cookies, analytics cookies, or third-party cookies are used.

10. Changes

We may update this policy from time to time. Changes will be posted on this page with an updated date. Material changes will be communicated via email.

11. Contact

For privacy questions or data requests, contact us at privacy@vloud.app.