Privacy Policy

Who's the data controller

The data controller for personal data processed via HostAtlas is:

Entity

HostAtlas Technologies LLC

Address

32 N Gould St., Sheridan, WY 82801, USA

Email

privacy@hostatlas.app

When you use HostAtlas to monitor your own infrastructure, you are the controller of personal data your team or your customers may transmit through your servers; we are a processor on your behalf for that data. Our role as controller covers the account-related data you give us directly to use the Service.

What we collect

Account data

• Identifiers: name, email address, optional phone number.
• Authentication: hashed password (bcrypt), 2FA device fingerprints, OAuth tokens for SSO if used.
• Organisation: company name, role, billing address, VAT/tax ID if applicable.

Billing data

• Payment processor records: we don't store full card numbers. Our billing processor (Polar.sh) holds payment instruments; we keep the customer ID, last 4 of the card, billing country, and invoices.
• Tax IDs and addresses as required by tax law in your jurisdiction.

Telemetry from your fleet (Customer Data)

• Server metadata: hostnames, IPs, OS, agent version, services discovered, container inventory, certificates, cron jobs, log paths.
• Metrics: CPU, RAM, disk, network, load, service-plugin metrics — at the resolution defined by your plan.
• Logs: log lines you choose to centralise, scoped to the paths you configure.
• Events: alert firings, recovery actions, recipe runs, audit trail of administrative changes.
• This is your Customer Data. We process it only to provide the Service and as instructed by you.

Usage data of the Service itself

• HTTP request logs (IP, user agent, request path, status, latency) retained for security and abuse-prevention purposes.
• Error reports forwarded to Sentry — we filter PII and secrets out.
• Aggregate, anonymised metrics about Service usage to inform product decisions.

Cookies & local storage

See Cookies & tracking below.

Why we collect it

We use personal data only for the following purposes:

• Provide the Service — authenticate you, maintain your account, deliver the features your plan includes, sync data between agents and the platform.
• Bill you — process payments, issue invoices, comply with tax law.
• Communicate with you — service announcements, billing notices, security alerts you cannot opt out of; product updates and tips you can opt out of.
• Secure the Service — detect abuse, investigate incidents, defend against attacks.
• Improve the Service — diagnose bugs, understand which features are used, prioritise the roadmap.
• Comply with law — respond to lawful requests, retain records where retention is mandatory.

We do not:

• Sell your personal data.
• Share your personal data with advertising networks.
• Use your Customer Data to train any AI model — yours or ours.
• Read your logs, metrics or backups except when you ask us to (support requests) or where strictly necessary to keep the Service running.

Legal basis (GDPR, where applicable)

• Performance of a contract — the Terms — for everything needed to deliver the Service to you (Art. 6(1)(b) GDPR).
• Legal obligation — for tax records, invoicing, lawful-request compliance (Art. 6(1)(c) GDPR).
• Legitimate interests — security, abuse-prevention, analytics in non-identifiable form, balanced against your interests (Art. 6(1)(f) GDPR).
• Consent — for optional marketing emails (Art. 6(1)(a) GDPR), withdrawable at any time.

Who we share with

We share personal data only with:

• Sub-processors we contract to deliver the Service — see the next section.
• Authorities where required by law — court order, subpoena, lawful request from a regulator. We push back on overbroad requests, and we tell you when we're legally allowed to.
• A successor entity in the event of a merger, acquisition or sale of substantially all assets — only on terms at least as protective as this policy. We'll notify you if it happens.

We do not share personal data with marketing networks, brokers, or affiliates outside the relationships listed below.

Sub-processors

We use the following sub-processors. This list is the source of truth — we update it before adding new ones.

Sub-processor changes are announced in the changelog and via email at least 30 days before they take effect. If you reasonably object to a new sub-processor, you may terminate without penalty before the change takes effect.

International transfers

HostAtlas is a US company; some of our sub-processors operate from the United States. Customer Data on the platform is stored in the European Union by default (Hetzner, Germany). When we or our sub-processors transfer personal data outside your country of residence — including to the United States — we rely on:

• EU Standard Contractual Clauses (2021 module set) signed with each US sub-processor.
• Where applicable, the EU-US Data Privacy Framework certification of the recipient.
• Additional safeguards where the transfer-impact assessment indicates they are needed.

If you require copies of the relevant SCCs or our transfer-impact summary, contact privacy@hostatlas.app.

Retention

• Account data: kept while your account is active.
• Telemetry & logs: kept according to the retention windows defined by your plan (5 days metric / 1 day log on Free; up to 365 / 90 on Enterprise).
• Backups: rolling backups follow the same retention as your plan's data window.
• Soft delete after account closure: 30 days, during which you can restore the account.
• Hard delete after soft-delete window: data is removed from production systems immediately and from rolling backups within the standard backup-rotation cycle.
• Audit and security logs: retained for up to 12 months or as required by applicable law, whichever is longer.
• Billing & tax records: retained for the period required by tax law in our jurisdiction (typically 7 years).

Security

We implement commercially reasonable technical and organisational measures to protect personal data — see our Security page for specifics. No system is perfectly secure; we do not warrant that.

If we become aware of a personal-data breach affecting you, we will notify you without undue delay in line with applicable law — typically within 72 hours of becoming aware, where Article 33 GDPR applies.

Your rights

Under GDPR (EU/UK)

• Access — get a copy of the personal data we hold about you.
• Rectification — correct inaccurate data.
• Erasure — delete your data, subject to legal retention obligations.
• Restriction — limit how we process your data while a dispute is resolved.
• Portability — receive your data in a machine-readable format.
• Object — to processing based on our legitimate interests, including direct marketing.
• Withdraw consent — at any time, where processing is based on consent.
• Lodge a complaint — with your local supervisory authority. You can find yours at edpb.europa.eu.

Under CCPA / CPRA (California)

• Right to know what personal information is collected, used, shared, or sold.
• Right to delete personal information.
• Right to correct inaccurate personal information.
• Right to opt out of any sale or sharing of personal information — we do not sell or share for cross-context behavioural advertising, so there is nothing to opt out of, but the right exists.
• Right to limit use of sensitive personal information — we don't use sensitive personal information for purposes that would trigger this right.
• Non-discrimination for exercising your rights.

Other states (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, etc.)

You have analogous rights under your state's privacy law. Contact us at privacy@hostatlas.app to exercise them.

How to exercise

Email privacy@hostatlas.app from the address on your account, or include enough information for us to verify your identity safely. We respond within 30 days for GDPR requests and 45 days for CCPA requests; extensions are possible only where allowed by law.

Cookies & tracking

We use a small number of cookies, all functional or strictly necessary:

• Session cookie (hostatlas-session) — keeps you logged in. Strictly necessary; expires on logout or after inactivity.
• CSRF token (XSRF-TOKEN) — prevents cross-site request forgery. Strictly necessary.
• Cloudflare cookies (__cf_bm, cf_clearance) set by our CDN to detect abusive traffic and pass bot challenges. Considered strictly necessary for security.

We do not currently use third-party analytics, advertising trackers, retargeting pixels, or any cross-site tracking on the marketing site. If we add analytics, we will use a privacy-respecting tool that doesn't require consent banners (e.g. server-side aggregation) — and we will update this section before we do.

Children

The Service is built for infrastructure operators, not consumers. We do not knowingly collect personal data from children under 13. If you believe a child has provided personal data to us, contact privacy@hostatlas.app and we will delete it.

Data Processing Agreement

For business customers in the EEA / UK, we offer a Data Processing Agreement on request. Email privacy@hostatlas.app and we'll send the current version, including SCCs and the sub-processor list aligned with this page.

The DPA covers: scope of processing, security measures, sub-processor change notifications, audit rights, breach notification, return/deletion of data on termination, and the SCC modules appropriate to the transfer scenario.

Changes to this policy

We may update this policy. For changes that materially affect how we use your personal data, we will notify you at least 30 days before the change takes effect — by email and an in-app banner. For minor updates (clarifications, contact details, sub-processor list refresh) we will update the “Last updated” date at the top.

Contact

For any privacy question, complaint or rights request:

Email

privacy@hostatlas.app

Postal

HostAtlas Technologies LLC
32 N Gould St., Sheridan, WY 82801, USA