Privacy Policy

This Privacy Policy (the “Policy”) explains how Valgix, LLC. (“Valgix,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal data when you visit our website, create an account, use the customer dashboard, order or administer cloud services, contact support, publish or deploy recipes, or otherwise interact with a service that links to this Policy (collectively, the “Services”).

Controller and processor roles

Valgix generally acts as the controller or business responsible for account, security, billing, support, website, marketplace, and service-administration data. When you use infrastructure to store or process data for your own purposes, you decide what is placed inside the server. To the extent Valgix processes that content solely to provide the infrastructure, Valgix acts as your service provider or processor and you remain responsible for the content and your instructions.

When a Valgix customer uses HumanPass to protect its own website or application, service-specific processing and customer notice duties are described in the HumanPass Privacy Addendum.

Some partners act under their own privacy terms for specific activities. In particular, the entity identified during checkout may act as merchant of record and independently determine how payment and compliance data is processed. Links to relevant third-party notices appear below.

What this Policy does not cover

This Policy does not govern a third-party website, application, recipe, integration, or service that you choose to use. It also does not replace a data processing agreement or other written agreement where one applies. If you use Valgix on behalf of an organisation, that organisation may separately control information about your use of its account.

Depending on how you use Valgix, we may collect the following categories:

• Identifiers and contact data, such as an email address, account ID, publisher name, support identity, and information you include in a message.
• Authentication and security data, such as credential hashes, verification challenges, multi-factor settings, passkey public-key material, session information, login times, IP address, user agent, and abuse-prevention signals.
• Commercial and transaction data, such as plans, orders, subscriptions, add-ons, billing periods, prices, taxes, refunds, invoice metadata, and payment status. We do not receive or store your complete payment card number or card security code.
• Cloud service data, such as server names and hostnames, region, operating system, resource allocation, network addresses, public SSH keys, backups, snapshots, operations, service status, and provider-side identifiers.
• Marketplace data, such as publisher applications, recipes, scripts, versions, compatibility, logos, tags, installation history, and creator earnings records.
• Communications, including support conversations, requests, attachments, feedback, and records of how a request was handled.
• Internet and device activity, such as pages or features used, request timestamps, browser and device information, cookie or session identifiers, and diagnostic events.
• Derived operational data, such as fraud or abuse risk, eligibility for an action, service health, incident impact, aggregated usage, and reliability metrics.

We receive this data directly from you, automatically from your browser or use of the Services, from the systems that provide your cloud resources, and from service providers involved in billing, support, monitoring, or security.

We use your email address and account identifiers to create and administer the account, send verification and operational messages, associate orders and servers with the correct customer, and help recover access. We store passwords only in a one-way protected form suitable for authentication; we cannot retrieve the original password from that form.

If you enable time-based multi-factor authentication, we process the configuration needed to verify codes and protect that configuration at rest. If you register a passkey, we receive the public credential information, counter, device category, backup status, and related metadata needed to verify it. Fingerprints, facial scans, device PINs, and other local biometric checks used to unlock a passkey remain with your device or credential provider and are not sent to Valgix.

Session and refresh-token records may include a protected token reference, IP address, user agent, expiry, revocation status, and last activity. We use them to recognise authenticated sessions, display or revoke sessions, detect suspicious activity, rate-limit abusive requests, and investigate security events.

Provisioning and administering a server requires us to process the selected plan, location, operating system, hostname, resource configuration, server state, public and additional IP addresses, internal infrastructure references, and the actions you request. We use this data to create, reconcile, upgrade, start, stop, restart, reinstall, recover, back up, snapshot, monitor, and ultimately delete the service.

We store public SSH keys and fingerprints that you add to Valgix. A public key is designed to be shared with a server, but its name and association with your account remain personal data. Private SSH keys are not requested by this feature and should never be submitted to us.

Some credentials, including an administrator password supplied during an order, may be encrypted and retained only while operationally required to complete the requested provisioning or recovery workflow. Do not reuse that credential elsewhere.

Valgix uses Polar to provide embedded checkout, recurring billing, tax handling, invoices, refunds, and payment-related events. Polar receives the information needed to complete the transaction and may collect billing contact details, country, payment method information, tax information, device information, and fraud signals under its own terms and privacy notice.

Valgix receives and stores transaction metadata needed to operate your service, such as customer, checkout, order, product, and subscription identifiers; currency; subtotal, tax, total, and refunded amounts; invoice number; billing period; renewal, cancellation, and payment-failure status; and relevant timestamps. We do not receive or store your complete card number or card security code.

Polar may act as merchant of record for the transaction where identified at checkout. Its processing is described in the official Polar Privacy Policy. We use the metadata returned by Polar to provision paid resources, show billing history, manage renewal or cancellation, reconcile entitlements, prevent duplicate fulfilment, and respond to disputes or refunds.

When you open Support, our support provider may receive your email address, Valgix user ID, a stable support identity token, and any message, file, or information you choose to send. This connects the conversation to the authenticated account and helps us avoid mistaking one customer for another.

Valgix uses a self-hosted deployment of Chatwoot to provide the support interface, conversation history, routing, and agent tools. The support application and its customer data are operated within infrastructure controlled by Valgix and its disclosed infrastructure providers. Chatwoot's self-hosting documentation is available in the official Chatwoot documentation. Support conversations may be reviewed by authorised staff and retained for service, quality, security, dispute, and legal purposes.

Do not send private keys, complete payment card details, or unrelated sensitive personal data through support. If a credential is required for a specific diagnostic action, follow only the secure method provided by authorised support staff and rotate it afterwards.

Publisher profiles

If you apply to become a publisher, we process your requested publisher name, account association, application and review status, administrative notes, avatar, verification state, recipes, versions, installation statistics, and earnings. A publisher name, avatar, verification state, recipe content, and public activity may be visible to other users. Your account email is not displayed as the publisher name unless you choose to publish it in content.

Recipe installations

Installation records may include the customer account, recipe and version, target server, operating-system family, status, task references, timestamps, and the names of requested parameters. Valgix installation history records parameter names rather than the values you entered. Values are transmitted as needed to execute the recipe on the selected server.

A recipe is code supplied by its publisher and can access the server with elevated privileges. It may read data on that server or send data to a destination chosen by the publisher. Review the recipe, publisher, requested values, and linked privacy terms before deployment. A publisher or external service contacted by the script may act as an independent recipient of data and is not governed by this Policy.

Customer Content means files, databases, application data, logs, secrets, personal data, and other material that you or your users place inside a server, backup, snapshot, or deployed application. You control what Customer Content is processed and are responsible for having a lawful basis, giving required notices, honouring data-subject rights, and configuring appropriate security and retention.

Valgix does not routinely inspect Customer Content. We and our infrastructure or storage providers may nevertheless process it to deliver the service; execute an action you request; maintain integrity, availability, backup, or recovery; provide support you authorise; investigate abuse or security threats; or comply with law. Access is limited to what is reasonably necessary for the relevant purpose.

Backups and snapshots may contain the same personal data as the source server. A deletion request relating to Customer Content must identify the relevant service and may require deletion of the source, backups, or snapshots under the tools and retention rules available to you. Redundant copies may remain for a limited period while retention cycles complete, unless law requires longer preservation.

We generate structured operational telemetry to keep the Services reliable and secure. Events may include request and correlation IDs, account or service IDs, route and operation names, response status, duration, outcome, scheduler or queue health, infrastructure-provider references, error messages, and diagnostic stack information. Security and access logs may also include IP address, user agent, timestamps, and session information.

We use Better Stack for portions of logging, uptime monitoring, incident data, and operational observability. Better Stack may process telemetry submitted by Valgix under our service configuration. Its practices are described in the official Better Stack Privacy Policy. We configure telemetry to avoid sending passwords, private keys, complete payment details, and recipe parameter values, but an error or support investigation may include identifiers and technical context needed to diagnose the event.

We may aggregate or de-identify telemetry to measure reliability, capacity, performance, feature adoption, abuse patterns, and incident impact. Data that has been irreversibly de-identified is no longer personal data under this Policy.

We use cookies and similar browser storage that are necessary to authenticate you, protect sessions, prevent abuse, remember essential preferences, preserve checkout or onboarding state, and make the website and dashboard work. These technologies may store a session reference, security state, preference, or temporary workflow data.

You can instruct your browser to block or delete storage, but essential parts of the Services may stop working or require you to sign in again. If we introduce optional analytics, marketing, or other non-essential tracking, we will provide additional information and obtain consent where applicable law requires it.

We do not use personal data collected through Valgix cookies to sell audiences or support cross-context behavioural advertising.

We process personal data for the following purposes:

• create, authenticate, secure, and administer accounts;
• accept orders and provision, operate, reconcile, upgrade, and delete services;
• process payments, subscriptions, invoices, taxes, refunds, and cancellation;
• provide support and communicate about service, security, billing, and legal matters;
• operate the recipe marketplace, publisher review, analytics, and creator earnings;
• monitor availability, diagnose failures, improve reliability, and plan capacity;
• prevent fraud, abuse, unauthorised access, and violations of our Terms;
• comply with accounting, tax, sanctions, legal-process, and regulatory obligations;
• establish, exercise, or defend legal claims; and
• produce aggregated or de-identified business and service statistics.

Legal bases

Where the GDPR, UK GDPR, or a similar law applies, we rely on: performance of a contract or steps requested before a contract; our legitimate interests in operating, securing, supporting, and improving Valgix; compliance with legal obligations; and consent where required for a specific optional use. Our legitimate interests are balanced against your rights and reasonable expectations.

Where processing is based on consent, you may withdraw it at any time without affecting processing already completed. Some data is required to provide a service; if it is not provided, we may be unable to create an account, process an order, or perform the requested action.

We disclose personal data only as reasonably necessary to:

• Polar, for checkout, merchant-of-record services, payments, subscriptions, invoicing, tax, refunds, fraud prevention, and disputes;
• our self-hosted Chatwoot support system, together with the infrastructure, storage, and email providers needed to operate it, for authenticated customer support and communications;
• Better Stack, for logs, uptime monitoring, incident management, and operational observability;
• infrastructure, network, storage, security, and orchestration providers, to provision and operate servers, IP addresses, backups, snapshots, recovery, and related resources;
• professional advisers and vendors, such as auditors, insurers, lawyers, accountants, and security specialists, subject to appropriate duties;
• authorities or other parties when required by law, valid legal process, protection of rights or safety, investigation of abuse, or enforcement of agreements; and
• a successor or transaction participant in a merger, financing, reorganisation, acquisition, sale, or transfer, subject to confidentiality and applicable notice requirements.

Service providers are permitted to use data only for contracted services and associated legal obligations, unless their independent role is disclosed. We do not sell personal data. We do not disclose personal data to third parties for cross-context behavioural advertising.

Valgix and its service providers may process data in countries other than the one in which you live. Privacy and government-access laws may differ between those countries. The location selected for a server concerns the primary service region for that server and does not necessarily determine where account, billing, support, security, or telemetry data is processed.

Where required, we use recognised safeguards for restricted transfers, such as an adequacy decision, contractual protections based on approved standard clauses, or another lawful transfer mechanism. You may contact us for information about the safeguards relevant to your personal data, subject to confidentiality limitations.

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, an active account or service, security and reliability, dispute resolution, enforcement, and legal, tax, accounting, or regulatory duties. Retention depends on the type of data and context rather than a single period.

• Account and service-administration data is generally retained while the account or related service remains active and for a limited period afterwards.
• Transaction, invoice, tax, refund, and contract records may be retained for the period required by accounting, tax, merchant-of-record, and legal rules.
• Security, access, operational, and support records are retained for a proportionate period based on diagnostic, fraud, incident, and dispute needs.
• Server resources, backups, and snapshots follow the service lifecycle and configured retention. Deletion may take time to propagate through queues, redundant copies, and provider systems.
• Marketplace installation and earnings history may be retained after a recipe is archived to preserve accounting, anti-fraud, and historical statistics.

We may retain data longer where necessary to preserve evidence, comply with a legal hold, resolve an outstanding payment or dispute, protect users, or meet a legal duty. When retention is no longer required, we delete, anonymise, or isolate the data from ordinary use.

We use technical and organisational measures designed for the nature of the data and risks involved. Measures may include encryption in transit and at rest where appropriate, one-way credential protection, multi-factor authentication, passkeys, access controls, secret separation, network restrictions, structured audit and operational logs, monitoring, rate limits, backups, incident handling, and provider review.

No system is perfectly secure. You are responsible for securing your account, devices, applications, server operating system, Customer Content, SSH private keys, and credentials. Use unique passwords, enable multi-factor authentication, keep software updated, restrict network access, and report suspected compromise promptly.

If a personal-data incident requires notification under applicable law, we will notify affected individuals and authorities as required, using the contact details available to us.

Depending on where you live and subject to legal exceptions, you may have the right to request access to personal data, a portable copy, correction, deletion, restriction, or objection; withdraw consent; and complain to a data-protection authority. You may also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

You can update some information, revoke sessions, manage SSH keys, cancel services, or delete resources through the dashboard. For a privacy request, contact privacy@valgix.com. Describe the request and the account involved. We may ask for information needed to verify identity, authority, and scope before disclosing or deleting data.

We respond within the period required by applicable law. A request may be limited or denied where we cannot verify it, the request would adversely affect another person, the data is required for security or a legal obligation, or another lawful exception applies. We will explain a denial where permitted. You may use an authorised agent where local law allows it, subject to proof of authority and identity verification.

For residents of the European Economic Area, the United Kingdom, or Switzerland, you may complain to the competent supervisory authority. The text of the EU General Data Protection Regulation is available from EUR-Lex.

Where a United States state privacy law applies, the categories described in Section 2 are the categories we may have collected and disclosed for business purposes during the preceding twelve months. The business purposes and recipient categories are described in Sections 11 and 12.

We do not sell personal information and do not share it for cross-context behavioural advertising as those terms are defined by the California Consumer Privacy Act. We do not offer a financial incentive in exchange for personal information. Publisher earnings are compensation for qualified recipe activity, not for providing personal information.

Where applicable, residents may request to know, access, correct, or delete personal information and receive equal service when exercising a right. Information about California rights is also available from the California Attorney General. Submit a request using the contact method in Section 21. We will not discriminate against you for exercising a right protected by law.

The Services are intended for adults and are not directed to children under 18. We do not knowingly collect personal data from a child who is not legally able to enter into the agreement for the Services. If you believe a child has provided personal data without appropriate authorisation, contact us so we can investigate and take appropriate action.

We use automated rules and signals to protect accounts, rate-limit requests, identify suspected fraud or abuse, validate service eligibility, reconcile billing and infrastructure, and prioritise operational work. These systems may delay, block, or flag an order or action for manual review.

Valgix does not use personal data for solely automated decisions that produce legal or similarly significant effects unless the processing is necessary to provide the requested service, authorised by law, based on explicit consent where required, and accompanied by the safeguards required by applicable law. You may contact Support to ask for review of an automated restriction.

We may update this Policy as our Services, providers, legal obligations, or data practices change. The “Last updated” date identifies the current version. If a change materially affects how we use personal data, we will provide reasonable notice through the website, dashboard, email, or another appropriate channel before it takes effect where required.

Earlier versions may be retained for legal and audit purposes. Continued use of the Services does not override consent or other rights that applicable privacy law requires us to obtain separately.

The responsible entity is Valgix, LLC. Privacy questions and data requests can be sent to privacy@valgix.com or submitted through Support in the authenticated Valgix dashboard. Legal notices may be sent to the current registered-office address and legal contact published on the Legal page.

Include enough information for us to identify the account and understand the request, but do not send passwords, private keys, complete payment card details, or unrelated sensitive data by email.