This Privacy Policy applies to personal data processed by TAKEHOST OÜ, an Estonian private limited company (OÜ), as the data controller for the Lofenta platform ("Service"). Customer and project data is hosted in the European Union on infrastructure operated by TAKEHOST OÜ. We comply with the General Data Protection Regulation (GDPR, Regulation EU 2016/679) where it applies to our users.
1. Data We Collect
We collect and process the following categories of personal data:
| Category | Data points | Source |
|---|---|---|
| Account data | Name, email address, GitHub username, profile avatar URL | Provided by you or GitHub OAuth |
| Usage data | Pages visited, features used, deployment events, timestamps | Automatically collected |
| Technical data | IP address, browser type, device type, operating system, referrer URL | Automatically collected |
| Project data | Repository names, environment variable keys (values are encrypted), deployment logs, custom domains | Provided by you |
| Billing data | Payment method type, last 4 digits, billing address (processed by payment processor) | Provided by you at checkout |
| Communications | Emails you send to support or legal addresses | Provided by you |
We do not collect or store full payment card numbers. Payment processing is handled by our payment processor under their own PCI-DSS compliant environment.
2. Legal Basis for Processing
We rely on the following legal bases under GDPR Article 6:
| Purpose | Legal basis |
|---|---|
| Providing and operating the Service | Performance of a contract (Art. 6(1)(b)) |
| Billing and payment processing | Performance of a contract (Art. 6(1)(b)) |
| Sending transactional emails (deployment alerts, security notices) | Performance of a contract (Art. 6(1)(b)) |
| Complying with legal obligations (tax, accounting records) | Legal obligation (Art. 6(1)(c)) |
| Security monitoring and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Service improvement and analytics | Legitimate interests (Art. 6(1)(f)) |
| Marketing communications (optional) | Consent (Art. 6(1)(a)) |
3. How We Use Your Data
We use your personal data to:
- Create and manage your account and authenticate your identity.
- Provision, operate, and improve the deployment infrastructure.
- Process payments and send billing receipts.
- Send transactional communications such as deployment failure alerts and security notices.
- Detect, investigate, and prevent fraudulent or abusive activity.
- Comply with legal and regulatory obligations applicable to TAKEHOST OÜ.
- Respond to your support requests and enquiries.
- Analyse aggregated, anonymised usage patterns to improve the Service.
We will not sell, rent, or trade your personal data to any third party for their own marketing purposes.
4. Data Sharing and Subprocessors
We share personal data with the following named subprocessors. Each operates under a data processing agreement (Art. 28 GDPR) and the transfer mechanism noted below.
| Subprocessor | Purpose | Location | Transfer basis |
|---|---|---|---|
| GitHub, Inc. | OAuth authentication, repository access | United States | EU Standard Contractual Clauses |
| Stripe Payments Europe, Ltd. | Card payment processing, subscription billing, fraud detection | Ireland (EEA) | EEA-based; SCCs for parent transfers to Stripe Inc. (US) |
| Cloudflare, Inc. | CDN, DDoS protection, custom-hostname SSL termination, DNS | United States with EU edge nodes | EU Standard Contractual Clauses |
| TAKEHOST OÜ | Infrastructure hosting (servers in Romania and the Netherlands) and transactional email delivery (DirectAdmin SMTP) | Romania and the Netherlands (EEA) | EEA-based processing, data processing agreement |
| Let's Encrypt (ISRG) | Free TLS certificate issuance for custom domains | United States | EU Standard Contractual Clauses; certificate metadata only, no user PII |
| Telegram FZ-LLC / Discord Inc. | Optional operator alerts (admin actions, billing events) | United Arab Emirates / United States | Operator-side opt-in; user identifiers only when an admin action explicitly references them |
We commit to giving Team-plan customers at least 30 days' advance notice before adding or replacing a subprocessor on this list. Notice goes to the team owner's email and is reflected on this page.
We may also disclose your data to law enforcement or regulatory authorities if required to do so by applicable law, or to protect the rights, property, or safety of TAKEHOST OÜ, our users, or the public.
5. International Data Transfers
TAKEHOST OÜ is established in Estonia (EU), and our primary infrastructure is operated within the European Economic Area (EEA). Customer and project data remains hosted on EEA infrastructure. Where we transfer personal data from the EEA to recipients located outside the EEA (for example, to GitHub, Inc. in the United States), we ensure that appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework where applicable.
6. Data Retention
We retain personal data only for as long as necessary for the purpose for which it was collected:
| Data type | Retention period |
|---|---|
| Account data | Until account deletion, then up to 30 days for backup purge |
| Deployment logs | Tied to your plan's deploy-history limit: 0 days (Hobby), 7 days (Developer), 30 days (Team). Older deployment logs are pruned as the deploy history is capped per plan. |
| Billing and financial records | 10 years, as required by applicable accounting law |
| Security and audit logs | 12 months |
| Support communications | 3 years from last interaction |
7. Security
We implement the following technical and organisational security measures:
- AES-256 encryption for all stored environment variable values.
- TLS 1.2 or higher for all data in transit.
- Access controls limiting data access to authorised personnel on a need-to-know basis.
- Regular security assessments and dependency audits.
- Containerised workloads with network isolation between projects.
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and, where required, notify the competent supervisory authority (the Estonian Data Protection Inspectorate, our lead supervisory authority) within 72 hours.
8. Cookies
We use cookies and similar tracking technologies. For full details, please read our Cookie Policy.
9. Your Rights Under GDPR
As a data subject under GDPR, you have the following rights. You can exercise them by contacting us at [email protected]. We will respond within 30 days.
Right of access (Art. 15)
You have the right to request a copy of the personal data we hold about you and information about how we process it.
Right to rectification (Art. 16)
You have the right to have inaccurate or incomplete personal data corrected without undue delay.
Right to erasure (Art. 17)
You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and there is no other legal basis), or where you object to processing based on legitimate interests and there are no overriding legitimate grounds.
Note: some data may be retained where required by law (for example, financial records under applicable accounting law).
Right to restriction of processing (Art. 18)
You have the right to request that we restrict processing of your data in certain circumstances, for example while we verify the accuracy of your data or while an objection is being resolved.
Right to data portability (Art. 20)
Where processing is based on your consent or a contract, and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit it to another controller.
Right to object (Art. 21)
You have the right to object at any time to processing based on legitimate interests, including profiling. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests or the processing is for the establishment, exercise, or defence of legal claims.
You also have the right to object at any time to processing for direct marketing purposes.
Right to withdraw consent (Art. 7(3))
Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
Right not to be subject to automated decision-making (Art. 22)
We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.
Right to lodge a complaint
You have the right to lodge a complaint with the Estonian data protection supervisory authority:
Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)
Tatari 39, 10134 Tallinn, Estonia
www.aki.ee
If you are located in another EU member state, you may also contact your local supervisory authority.
10. Children's Privacy
The Service is not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or via an in-app notice at least 14 days before the changes take effect and update the "Last updated" date above. Your continued use of the Service constitutes acceptance of the updated policy.
12. Contact and Data Controller
For any questions, data subject requests, or concerns about this Privacy Policy or our data practices, please contact us:
TAKEHOST OÜ
17524902
Tornimäe tn 5, Kesklinna linnaosa, Tallinn, Harju maakond, Estonia
Registration details are published on the Imprint page.
[email protected]