Privacy Policy
In short
- We collect what we need to run your account, workspace and billing: contact details, payment references, usage and logs.
- Data inside the apps and databases you deploy is yours; we process it only to run the service and never look at it except to fix a problem you ask us to fix.
- We don't sell personal data or use it for advertising. We use Google Analytics on this website only.
- Deleted apps are kept 30 days, then gone. Account data goes when you close the account, except invoices we must keep.
1. Who this covers
This policy explains how Nexent handles personal data when you visit cloud.nexent.dev, use the console or API, or contact us. It applies to account holders and workspace members. For people whose data is inside your applications (your users, customers or staff), you are the controller and we act on your instructions - see section 4.
2. What we collect
You give us
- Account details - name, email address, password (stored hashed), optional phone number for SMS alerts, profile picture.
- Workspace details - workspace name, currency, members and roles, invitations you send.
- Billing details - top-up amounts, the payment method type and the reference our payment provider returns. We never see or store full card numbers or mobile-money PINs.
- Integrations - tokens you authorise for GitHub, GitLab or container registries, and registry credentials you enter (stored encrypted).
- Services - sender-name requests and the phone numbers you send messages to.
- Messages to us - support and contact emails.
Collected automatically
- Console and API activity - what was done, by whom, when, from which IP address (the audit trail), and API request logs.
- Resource usage - CPU, memory, storage, bandwidth and request counts per app, used for billing, right-sizing and the metrics you see.
- Application logs - stdout/stderr of your containers, shown to you and kept for a short window; we don't read them unless you ask for help.
- Website analytics - see section 8.
3. How we use it
- To provide the service: run your apps, route traffic, issue certificates, take backups, send the messages you ask us to send.
- To bill you and keep the accounting records the law requires.
- To keep the platform secure: detect abuse, investigate incidents, enforce the Terms.
- To communicate: deployment and billing notifications you have enabled, security notices, replies to your messages, and occasional product updates you can opt out of.
- To improve the service, using aggregated usage that does not identify you.
Our legal bases are performance of the contract with you, our legitimate interests in running a secure and reliable service, legal obligations (tax, accounting), and consent where we ask for it.
4. Data inside your apps
The content of your applications, databases, volumes, backups and messages is processed only to provide the service. Staff access it only when needed to resolve an issue you have raised or to respond to a security incident or legal obligation, and such access is logged. We do not use it for any other purpose, including training models or advertising.
You are responsible for the lawful basis of the data you put in your apps and for informing your own users. If you need a written data-processing agreement, contact legal@nexent.dev.
6. How long we keep it
- Account and workspace data - while the account exists; deleted within 30 days of closure.
- Invoices and payment records - as long as accounting law requires (typically 5 years).
- App volumes - 30 days after the app is deleted, then permanently removed. Database backups - the template's retention period (7 days by default).
- Audit trail - for the life of the workspace, then with the workspace.
- Application logs - a short rolling window; API and access logs - up to 90 days for security.
- Message delivery logs - for the life of the service, so you can reconcile spend.
7. Security
Traffic is encrypted in transit (TLS); passwords are hashed; tokens, registry credentials and database passwords are stored encrypted; apps run isolated from one another; access is role-based and logged; volumes are on replicated storage. No system is perfectly secure - if we learn of a breach affecting your data we will tell you without undue delay. Report vulnerabilities to security@nexent.dev.
9. Your rights
You can see and change most of your data in the console. You may also ask us to provide a copy of your personal data, correct it, delete it, restrict or object to its processing, or export it, subject to the retention we must keep for legal reasons. Write to privacy@nexent.dev; we answer within 30 days. If you are not satisfied you may complain to the Personal Data Protection Commission of Tanzania or your local authority.
10. Where data is stored
The platform runs in a single region operated by Nexent; your apps, databases, volumes and backups stay there. Some providers we use (payment, email, source hosting, analytics) process data in other countries under their own safeguards. If you need data to stay in a particular jurisdiction, ask us before deploying.
11. Children
The service is for people 18 and over. We do not knowingly collect data from children; if you believe we have, tell us and we will delete it.
12. Changes
We will post changes here and, for material ones, notify workspace owners by email before they take effect. The date at the top is the current version.
13. Contact
Privacy questions and requests: privacy@nexent.dev. Everything else: contact page.