Privacy Policy

1. Who We Are

Serverspot helps developers, agencies, startups, and businesses connect servers, deploy applications, monitor infrastructure, manage team access, use browser-based SSH tooling, configure private network connectors, and handle billing from one dashboard.

For privacy questions, email support@serverspot.com.

2. Information We Collect

Account and profile information

• Name, email address, username, password hash, account role, organization/workspace details, and preferences.
• Two-factor authentication settings, recovery code metadata, login attempts, session information, lockout status, and security notification data.
• GitHub or Google account identifiers, avatar URL, email address, and other OAuth profile information if you sign in with those providers.

Server and infrastructure information

• Server names, hostnames, IP addresses, ports, SSH usernames, server type, operating system details, connection status, and test results.
• SSH passwords, SSH private keys, passphrases, sudo passwords, generated public keys, private-server encryption details, and private network connector tokens or status data.
• Monitoring metrics such as CPU, memory, disk, uptime, network activity, running services, process counts, alerts, file integrity checks, application paths, and log metadata.

Deployment and hosted app data

• Repository URLs, selected branches, GitHub deployment tokens, ZIP uploads, deployment configuration, runtime settings, domains, generated URLs, and deployment logs.
• Environment variable names and encrypted environment variable values used to run or deploy your applications.
• Hosted app resource usage, plan limits, usage credits, overage records, and operational status.

Billing information

Payments are processed by Paystack. We do not store full card numbers. We may store customer references, payment references, reusable authorization identifiers, wallet balances, invoices, plan identifiers, subscription status, tax or billing metadata, and payment failure information.

AI support and communications

If you use Serverspot AI or contact support, we process the messages, selected intent, conversation context you provide, and related account context needed to respond. When AI support is enabled, your message may be sent to the configured AI provider to generate a response.

Usage, device, and cookies

• IP address, browser type, operating system, referring URL, device details, pages visited, features used, and timestamps.
• Essential cookies, CSRF tokens, session identifiers, and authentication tokens required for login, security, and account continuity.

3. How We Use Information

• Provide the service: Create accounts, authenticate users, connect servers, run deployments, show monitoring data, manage hosted apps, and process team invitations.
• Secure the platform: Detect suspicious activity, support 2FA, enforce session controls, investigate abuse, protect credentials, and send account or security alerts.
• Process payments: Manage plans, subscriptions, wallet credits, overages, invoices, failed-payment retries, and Paystack callbacks.
• Improve Serverspot: Debug errors, understand feature usage, improve reliability, and develop product features.
• Communicate with you: Send transactional emails, team invitations, password reset messages, login notifications, billing receipts, support replies, and product updates where allowed.
• Comply with law: Meet legal, tax, accounting, regulatory, and lawful-request obligations.

4. Legal Bases for Processing

Where laws such as the Nigeria Data Protection Act, NDPR, UK GDPR, or EU GDPR require a legal basis, we rely on one or more of the following:

• Contract: Processing needed to provide Serverspot and manage your account.
• Legitimate interests: Security, fraud prevention, service improvement, abuse prevention, and business operations.
• Consent: Optional marketing, some cookies or integrations, and other cases where consent is required.
• Legal obligation: Compliance with accounting, tax, regulatory, security, or lawful-request duties.

5. How We Share Information

We do not sell personal data. We share information only when needed to operate Serverspot, comply with the law, protect users, or complete actions you request.

• Service providers: Hosting, infrastructure, database, email, monitoring, analytics, security, customer support, and AI providers that help us operate the platform.
• Payment provider: Paystack receives payment information needed to process cards, bank transfers, USSD, wallet top-ups, subscriptions, and payment authorizations.
• OAuth and repository providers: GitHub and Google process information according to their own policies when you connect or sign in through them.
• Team members: Workspace owners and authorized members can see data made available by their role, such as shared server metadata, deployment information, alerts, and logs.
• Authorities and legal process: We may disclose information if required by law, court order, regulator, or to protect the rights, safety, and security of Serverspot, users, or others.
• Business transfers: If Serverspot is involved in a merger, acquisition, financing, restructuring, or sale of assets, relevant data may transfer as part of that transaction.

6. Security, Credentials, and Private Keys

Serverspot uses technical and organizational safeguards designed to protect information, including HTTPS/TLS in transit, hashed passwords, encrypted storage for supported secrets, role-based access, 2FA options, login protections, session controls, and security review practices.

SSH credentials, private keys, GitHub tokens, app environment variable values, and similar secrets are encrypted where stored by the application. For private servers, credentials are protected with passphrase-based credential encryption. Credentials may be decrypted temporarily only to perform actions you initiate, such as testing a connection, opening a terminal session, monitoring a server, or deploying an app.

Browser terminal input and command output are processed so the terminal can function. We do not intentionally use terminal command content for advertising or sale. Some command output or error details may appear in logs, audit records, deployment output, support messages, or monitoring records when needed to provide the service or troubleshoot issues.

7. Data Retention

We keep information for as long as needed to provide Serverspot, protect the platform, comply with legal obligations, resolve disputes, enforce agreements, and maintain business records. Retention periods vary by data type, account status, plan, security needs, and legal requirements.

• Account and workspace data is generally kept while your account is active.
• Billing, tax, invoice, and transaction records may be kept as required by financial and accounting laws.
• Monitoring metrics, deployment logs, terminal session metadata, and alert history may be retained according to plan settings, operational needs, and security requirements.
• Deleted account data is removed or anonymized within a reasonable period after a verified request, unless we must retain it for legal, security, fraud-prevention, backup, or accounting reasons.

8. Cookies and Similar Technologies

We use essential cookies and similar technologies for authentication, session management, CSRF protection, security, and preferences. You can disable cookies in your browser, but core features such as login and dashboard access may stop working.

9. Your Rights and Choices

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or export personal data. You may also have the right to withdraw consent where processing is based on consent.

To make a request, email support@serverspot.com. We may need to verify your identity and account authority before acting on the request.

10. International Transfers

Serverspot, our providers, and connected services may process information in Nigeria, the United States, the European Economic Area, or other countries. Where required, we use appropriate safeguards for international transfers.

11. Children's Privacy

Serverspot is not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has created an account, contact us so we can review and take appropriate action.

12. Changes to This Policy

We may update this Privacy Policy as Serverspot, our providers, or legal requirements change. If changes are material, we will provide reasonable notice by email, dashboard notice, or another appropriate method before the changes take effect where required.

13. Contact Us