This policy covers two different things, and the distinction matters: the information we collect about you as a customer, and the data inside the application we operate for you.
What we collect about you
- Account information — name, company, email address, phone number, and the plan you are on
- Billing information — handled by our payment processor. We do not store card numbers
- Support correspondence — the emails, tickets, and call notes involved in supporting your account
- Operational logs — server and platform logs generated by running your application, used for monitoring, debugging, and security
What we do not do
- We do not sell your information, and we do not share it for advertising
- We do not use the data inside your application for anything except operating and supporting the service
- We do not use your data to train models
Your application's data
You own it. We process it on your behalf so that we can run the platform it sits on. We access it only where operating or supporting the service requires it — restoring a backup, diagnosing a fault you reported, responding to an incident — and not otherwise.
If your application handles personal data on any scale, ask us for a data processing addendum and we will put one in place.
Sub-processors
We use third-party infrastructure providers to operate the platform. A current list of sub-processors is available to customers on request, and we will tell you before a change materially affects where your data is processed.
Retention and deletion
Backups are retained for the window your plan specifies. After cancellation your environment stays available for thirty days, during which you may request an export. After that window, production data and backups are deleted on our normal schedule. Account and billing records are kept as long as required for tax and legal purposes.
Security
Access to production environments is limited to the people who operate them. Backups are stored separately from production. Runtime and platform dependencies are patched on a maintenance schedule, and critical vulnerabilities are patched out of cycle. We do not claim a compliance certification we do not hold.
Cookies
This marketing site sets no tracking cookies and runs no third-party analytics. Cookies inside your own application are governed by your application, not by this policy.
Making a request
To access, correct, export, or delete information we hold about you, write to support@vettahosting.com. We respond within thirty days.