Privacy Policy
Version 1.0 · Last updated 22 October 2026
Draft: the company details in square brackets are placeholders and will be completed before these terms take effect.
This policy explains which personal data NorthVault processes when you visit our website, use the customer panel or use our services, why we do so, how long we keep the data and which rights you have.
1 Controller and contact
The controller within the meaning of the GDPR is [Company name] [Legal form, e.g. GmbH], [Street and number], [Postcode and city], Germany, represented by [Managing director]. You can reach us for all data protection matters at privacy@northvault.com or by post at the address above.
We are not required to appoint a data protection officer. Should this change, we will name them here.
2 Visiting our website
2.1 When you open our website or the customer panel, your browser sends technical data that our servers record in log files: IP address, date and time, the page requested, the referring page, the HTTP status, the amount of data transferred, and browser and operating system (user agent).
2.2 We need this data to deliver the pages, to keep them secure and to detect and defend against attacks (Art. 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of the website). Log files are deleted after 14 days at the latest unless an individual incident requires longer retention as evidence.
2.3 We do not use web analytics, tracking pixels, advertising networks or social media plugins, and we do not create user profiles.
4 Customer account and contracts
4.1 When you register and order, we process: email address, password (stored only as a cryptographic hash by our sign-in provider), name and display name if you provide them, billing details, the services you order (plan, location, term, prices), your credit balance and payments, invoices, the history of your orders and settings, and your communication with us.
4.2 Legal basis: performance of the contract and steps prior to it (Art. 6(1)(b) GDPR) and compliance with legal obligations, in particular commercial and tax retention duties (Art. 6(1)(c) GDPR).
4.3 We record what you do in the customer panel (for example orders, cancellations, changed settings) in an activity log that you can see yourself. We keep it to document the contract and to clarify disputes (Art. 6(1)(b) and (f) GDPR) for the duration of the contract and up to three years thereafter.
4.4 When you accept our Terms of Service or request that a service starts during the withdrawal period, we record that you did so, when, and which version of the Terms applied, as evidence (Art. 6(1)(b) and (c) GDPR).
5 Operating your services
5.1 To provide and bill your servers and websites, we process technical data about them: resource usage (CPU, memory, storage), the volume of data transferred, status and error messages, the IP addresses and domains assigned to them, and logs of administrative actions. Legal basis: Art. 6(1)(b) GDPR; for security monitoring also Art. 6(1)(f) GDPR. We keep usage data as long as it is needed for billing and fair-use limits, and security logs for at most 90 days unless an incident requires longer.
5.2 Content that you store in your services (files, databases, emails your applications send, data of your own customers or website visitors) we process only on your behalf as a processor. The Data Processing Agreement in Annex 3 of our Terms of Service applies; you are the controller for that data.
5.3 For domains you connect, we obtain TLS certificates from Let’s Encrypt (Internet Security Research Group, USA). Certificates and the domain names in them are published in public Certificate Transparency logs; this is how the certificate system works.
6 Abuse reports and legal requests
When you report abuse or illegal content to abuse@northvault.com, we process your report and contact details to handle it, to inform you of our decision and, where required, to inform the customer concerned (Art. 6(1)(c) GDPR in conjunction with the Digital Services Act, and Art. 6(1)(f) GDPR). We keep reports for three years after they are closed. We pass data to authorities only where we are legally obliged to.
7 Contacting us
When you write to us, we process your message and contact details to answer it (Art. 6(1)(b) GDPR if it concerns a contract, otherwise Art. 6(1)(f) GDPR). We delete correspondence once it is no longer needed, unless retention duties apply.
8 Payments
Services are paid from your credit balance. When you top up your balance, the payment is processed by the payment provider you choose in the ordering process, which processes your payment data as its own controller under its own privacy policy. We receive confirmation of the payment, the amount and a reference, not your full card details. Legal basis: Art. 6(1)(b) and (c) GDPR. The providers offered are named on the payment screen.
9 Recipients and processors
We share personal data only where necessary for the purposes above. We use the following processors, bound by data processing agreements:
- Data-centre operators at the locations of our servers and of your services: [Data-centre operators per location, e.g. IONOS SE, Montabaur, Germany (Frankfurt)].
- Supabase, Inc. (USA) for the database of the customer panel and for sign-in, hosted in [Supabase project region, e.g. Frankfurt, Germany (eu-central-1)].
Other recipients are payment providers (Section 8), authorities where we are legally obliged to disclose data, and professional advisers bound to confidentiality.
10 Transfers to third countries
Where a processor is based outside the EU/EEA or may access data from there (for example Supabase, Inc. in the USA), we ensure an adequate level of protection, in particular through the EU–US Data Privacy Framework where the recipient is certified under it, or through the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). If you choose a server location outside the EU/EEA, the content of that service is stored there at your request.
11 How long we keep data
We delete personal data as soon as the purpose ceases to apply, unless legal retention duties require otherwise. Account and contract data are kept for the duration of the contract; after it ends, data we must retain under commercial and tax law (such as invoices and accounting records) is kept for the statutory periods of up to ten years and restricted from other use. The content of your services is deleted 14 days after the contract ends (Section 13 of our Terms of Service).
12 Your rights
You have the right to access your data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to withdraw any consent with effect for the future (Art. 7(3)). Much of your data you can view, export or change yourself in the customer panel.
Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or the place of the alleged infringement.
To exercise your rights, write to privacy@northvault.com.
13 Whether you must provide data
You are not obliged to provide personal data. Without an email address and password, however, we cannot create a customer account, and without the data needed for the contract we cannot provide services. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.
14 Security
We protect data with technical and organisational measures appropriate to the risk, including encrypted connections (TLS) for the website and the customer panel, separation of customers on our servers, access to administrative systems only through encrypted, restricted connections, and regular security updates.
15 Changes to this policy
We update this policy when our processing changes or the law requires it. The current version is always available on this page; the date at the top shows when it was last changed.