What personal data we collect, why we need it, and the choices you have.
1. What we collect
- Account details: your name and email address. If you sign in with GitHub, also your GitHub username; if you sign in with Google, the name and email address on your Google account.
- Billing details: payment references and transaction history. Card numbers are handled by our payment providers, not stored by us.
- Usage data: which resources you create, how long they run, and logs needed to operate and bill them.
- Support messages you send us.
- Technical data from your browser: error reports from the dashboard and site, and the sign-in time, device and approximate location we use to warn you about new sign-ins.
3. How we use it
We use this data to run the Service, charge your balance, keep accounts secure, answer support requests and tell you about changes that affect you. We send product news only if you opt in, and every such email has an unsubscribe link.
4. Data you host with us
Data inside your apps, databases and buckets belongs to you. For that data you are the controller and we act on your instructions. It stays in the region you choose unless you move it.
5. How we protect it
Traffic to the dashboard, the API and your apps is encrypted in transit with TLS. The secrets you give us (environment variables, secret files, access keys and the contact details for domains you register) are encrypted at rest with AES-256-GCM. Files you keep in our object storage are encrypted at rest with AES-256-GCM, and backups of your databases are encrypted with AES-256-GCM before they are uploaded. Passwords and API tokens are stored only as one-way hashes. Backups of our own systems are encrypted before they leave our servers.
7. Your rights
Under the Nigeria Data Protection Act 2023, and the GDPR where it applies, you can ask to see, correct, export or delete your personal data. Email privacy@naijacloud.com and we will reply within 30 days.
8. How long we keep it
We keep account data, including your sign-in history (the time, IP address and browser of each sign-in), until you ask us to delete your account. Billing records are kept for as long as tax law requires. Everything else is kept for these periods:
- CPU and memory readings and request counts for your services: 14 days. Health checks: 35 days.
- Request logs for your apps, with the visitor’s IP address shortened and query strings removed: 30 days. Hourly totals built from them: 13 months.
- Our web servers’ own access logs: rotated once they reach a fixed size, so they hold only recent traffic.
- Error reports from our website and dashboard: 90 days.
- Findings from our abuse scans: 90 days.
- Database backups: 7 days by default, or the period you choose between 1 and 365 days. A backup taken before we move your database to another server: 30 days.
- Build and deploy logs, the activity log, and records of the emails we send (recipient and subject, never the body): kept until your account is deleted. We do not yet delete them on a schedule.
- Encrypted backups of our own systems: every copy for 48 hours, one a day for 30 days and one a month for 12 months. Data you delete can stay in these backups for up to 12 months before it is gone.