Privacy Policy

1. Data Controller

The data controller for your personal data is:

2. Data We Collect

Account Data

• Email address (for authentication and communication)
• Name (optional, for personalization)
• Password (hashed, never stored in plain text)
• Payment information (processed by Polar.sh, we don't store card details)

Usage Data

• Instance metadata (names, configurations, creation dates)
• Connection logs (IP addresses, timestamps) for security purposes
• Resource usage metrics (memory, connections) for billing and monitoring

Customer Data

Data you store in your Valkey instances is your property. We do not access, analyze, or share this data except as necessary to provide the Service or as required by law.

3. How We Use Your Data

We use your data to:

• Provide and maintain the Service
• Process payments and manage subscriptions
• Send important service notifications
• Provide customer support
• Detect and prevent abuse or security threats
• Improve the Service based on usage patterns

We do NOT: Sell your data, use it for advertising, or share it with third parties for marketing purposes.

4. Legal Basis (GDPR)

We process your data based on:

• Contract: To provide the Service you signed up for
• Legitimate Interest: For security, fraud prevention, and service improvement
• Legal Obligation: To comply with applicable laws (e.g., tax records)
• Consent: For optional communications (you can opt out anytime)

5. Data Location & Transfers

Our data centers are located in:

• Lithuania 🇱🇹 (primary)
• Additional EU locations may be added (Germany, Sweden, Finland)

We do not transfer customer data outside the EU/EEA. Our company is registered in Sweden, ensuring EU jurisdiction applies.

6. Data Retention

• Account data: Retained while your account is active, deleted within 30 days of account closure
• Customer data (Valkey instances): Deleted immediately upon instance deletion
• Backups: Retained according to your plan (1-30 days), then automatically deleted
• Logs: Security logs retained for 90 days
• Billing records: Retained for 7 years as required by law

7. Your Rights (GDPR)

Under GDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate personal data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Portability: Receive your data in a machine-readable format
• Restriction: Limit how we process your data
• Objection: Object to processing based on legitimate interest
• Withdraw Consent: Withdraw consent at any time (where applicable)

To exercise these rights, contact us at hello@arctickey.com. We will respond within 30 days.

8. Security

We protect your data through:

• TLS 1.3 encryption for all connections
• Encrypted storage at rest
• Regular security audits
• Access controls and authentication
• Monitoring for suspicious activity

In case of a data breach affecting your personal data, we will notify you and relevant authorities within 72 hours as required by GDPR.

9. Third-Party Services

We use the following third-party services:

• Polar.sh: Payment processing (PCI compliant)
• Cloudflare: DNS and DDoS protection (data stays in EU)

These providers are contractually bound to protect your data and comply with GDPR.

10. Cookies

We use essential cookies for:

• Authentication (keeping you logged in)
• Security (CSRF protection)

We do not use tracking cookies or analytics that collect personal data.

11. Children's Privacy

The Service is not intended for children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us for deletion.

12. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes via email. The "Last updated" date at the top indicates when changes were made.

13. Contact & Complaints

For privacy-related questions or to exercise your rights:

If you believe we have not addressed your concerns adequately, you have the right to lodge a complaint with your local data protection authority. In Sweden, this is the Swedish Authority for Privacy Protection (IMY).