Privacy Policy

1. Who is responsible

Planch Digitals is the data controller for the personal data described here. Contact us at support@planchdigitals.com about anything on this page, including to exercise the rights in clause 6.

2. What we collect

When you create an account we store:

• your name and email address;
• a one-way hash of your password — we never store the password itself and cannot recover it;
• your country, currency and billing region, which decide the prices you are quoted and which payment provider handles your payments;
• the time you last signed in, and whether your email is verified.

As you use the service we also store:

• the SSH public keys you upload — required before a server can be created, since a machine without one cannot be logged into;
• the servers, volumes, snapshots, backups, firewalls and addresses you create, and the actions taken on them;
• your orders, invoices, payments and account ledger — records we are required to keep;
• performance samples for your machines (CPU, memory, disk and network), which power the charts in your dashboard;
• support tickets and notifications.

We do not store your card details. Payments are handled entirely by the providers in clause 4; card numbers never reach our systems.

We do not look inside your servers. What you run on a machine, and the data on it, is not visible to us in the ordinary course of operating the service.

3. Why we collect it

To create and run your account and your servers; to charge you and keep the financial records the law requires; to show you your own usage; to answer your support requests; to detect and stop abuse; and to tell you about things affecting your service, such as an unpaid invoice or a machine about to be suspended.

The lawful bases are performance of our contract with you, compliance with our legal obligations, and our legitimate interest in keeping the platform secure. We do not sell your personal data, and we do not use it for advertising.

4. Who else processes it

We use the following providers. Each receives only what it needs, and each is bound to use it only to provide its service to us.

• DigitalOcean — Provisions and runs the virtual machines customers order, and hosts the API and its database.
• Vercel — Serves this website and the customer dashboard, and therefore handles requests to them.
• Stripe — Processes card payments in euro, sterling and US dollars.
• Paystack — Processes payments in Nigerian naira.
• Flutterwave — Processes payments in naira, cedi, shilling, rand and US dollars.

We may also disclose data where the law requires it, or to protect our rights or the safety of others.

5. Where it is held, and for how long

Our API and its database run in Frankfurt, Germany. The servers you create run in the region you choose, which may be elsewhere; that is your choice at the point of ordering. Our payment providers operate in their own regions.

Retention:

• Account data — for as long as your account exists.
• Invoices, payments and ledger entries — kept after account closure for as long as tax and accounting law requires.
• Performance samples — about 8 days, then deleted. They are for the charts, not a long-term record.
• Sessions — a signed-in session can be resumed for up to 30 days before you must sign in again.
• Server contents — destroyed with the machine. Once a server and its snapshots are gone we cannot recover them.

6. Your rights

You may ask us for a copy of your personal data, to correct it, to delete it, or to restrict or object to how we use it. You may also ask us to transfer it to another provider. Email support@planchdigitals.com and we will respond within a month.

Some data we must keep even if you ask us to delete it — invoices and payment records in particular. We will tell you when that applies and why.

7. Security

Passwords are hashed with bcrypt. Traffic to our site, dashboard and API is encrypted in transit, and the connection between the API and its database is encrypted too. Your session is held in cookies that scripts in the page cannot read, so a flaw in our front end cannot walk away with your session. Access to production systems is limited to people who need it.

No system is perfectly secure. If we discover a breach affecting your personal data we will tell you and the relevant authority as the law requires.

8. Cookies

We use cookies that are necessary for the service to work: they keep you signed in to the dashboard and let it verify your requests. We do not use advertising cookies, and we do not track you across other websites.

9. Children

The service is not intended for anyone under 18, and we do not knowingly collect their data.

10. Changes

We may update this policy. Where a change materially affects you we will give notice before it takes effect.