Privacy Policy
Version: November 2026
English translation: the German version is the legally authoritative one. Full notice at the foot of this page.
Related documents: use of the services is governed by our Terms of Service; for hosted services, the Data Processing Agreement (DPA) applies.
1. Controller
Lanisce, razvoj programske opreme, d.o.o.
Trnovo 44A, 5252 Trnovo pri Gorici, Slovenija
E-mail: privacy@kubehz.io
2. What data we collect
2.1 Registration and user account
- E-mail address: for account creation and communication
- Password: stored as a cryptographic hash (bcrypt)
2.2 Cluster metadata
- Cluster name, Kubernetes version, node count, component status
- Heartbeat data (for registered/managed clusters)
- No workload data, no container images, no secrets
2.3 Access logs
- IP address: stored in server access logs for 7 days
- Sign-in records: IP address, browser and time of each sign-in and session, for security, deleted at the daily run after 91 days without activity
- User agent, timestamps: for security and error analysis
2.4 Payment data
- Payments are processed by an external payment provider
- We do not store credit card numbers or bank details
- We store: the chosen contribution, payment status, timestamps
3. Legal basis
| Processing | Legal basis |
|---|---|
| Account creation, cluster provisioning | Art. 6(1)(b) GDPR (performance of a contract) |
| Access logs, security | Art. 6(1)(f) GDPR (legitimate interest) |
| Bot protection at sign-up (Cloudflare Turnstile) | Art. 6(1)(f) GDPR (legitimate interest: keeping automated sign-ups out) |
| E-mail notifications | Art. 6(1)(b) GDPR (performance of a contract) |
4. Recipients
| Recipient | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting infrastructure | Germany (FSN1/NBG1) |
| Revolut Bank UAB | Card payment processing | Lithuania (EU) |
| MINDBAZ SAS (“Sweego”) | Sending account and notification e-mail (delivery of the message and its recipient address) | France (EU) |
| Cloudflare, Inc. | Bot protection on the sign-up page (Turnstile): checks the browser and its IP address when you register | USA (EU-US Data Privacy Framework) |
No recipients other than those listed above. No Google Analytics. No advertising networks. No social media trackers.
5. Retention periods
| Data | Retention period |
|---|---|
| Account data | As long as the account is active |
| Cluster metadata | As long as the cluster is registered |
| Access logs | 7 days |
| Sign-in and session records (IP address, browser, time) | Deleted at the daily run after 91 days without activity |
| E-mails we send you and their delivery records | 28 days |
| Support chat | Messages deleted at the daily run after 90 days, files 90 days after their last use |
| After account deletion | Personal data deleted, planned within 14 days, at the latest within 30 days. The exceptions are listed below |
| Backups (disaster recovery only) | Data deleted from the live systems can remain in encrypted backups for at most 90 days; backups are read only to restore the service, and after a restore we apply deletions again from our records. A total loss can also lose the records of deletions from the last 24 hours |
What stays after account deletion
We do not delete everything. These records stay, each for the reason and the time given here. They hold no more than this list says.
- Invoices and accounting records, with the billing details on them: 10 years after the end of the year concerned, because tax law requires it (Art. 6(1)© and Art. 17(3)(b) GDPR).
- Sign-in and session records: until their 91 days end, to detect and investigate attacks (Art. 6(1)(f) GDPR).
- Audit records of security-relevant actions: who did what to which target and when, as internal IDs, with no end date. They stay as proof of what happened, including that your data was deleted (Art. 5(2) and Art. 6(1)(f) GDPR). After 12 months at the latest, their IP address, free text, before-and-after values and any customer’s e-mail address go. The records of a deletion keep its state, counts and internal IDs. Our staff’s addresses stay.
- Do-not-contact list: your e-mail address, if you unsubscribed, or if mail to it bounced or was reported as spam. It stays with no end date, so that we do not write to you again (Art. 6(1)(f) GDPR).
- Deletion record: an internal ID and the time, with no end date, so that a deleted account is not restored or contacted by mistake (Art. 6(1)(f) GDPR).
- References in the sign-in system: internal IDs in its records of memberships and changes, with no end date. Your name and e-mail address are gone from those records, but an ID can still be linked through other records that stay, such as an invoice.
- Reserved names: the cluster and Space names you used stay reserved, with no end date, without your name or e-mail address. If a name you chose identifies you, write to privacy@kubehz.io and we remove it.
- Support chat: your profile, messages and files go with your account. Some things stay: messages in a room you had already left, until the daily run after 90 days (a room’s newest message stays until there is a newer one); and, with no end date, room records such as that you joined, which can hold your display name of that time, and your chat user ID with its internal link, which the chat software cannot delete. New user IDs hold no name, older ones can.
6. Your rights
You have the following rights under the GDPR:
- Access (Art. 15): what data we have stored about you
- Rectification (Art. 16): correction of inaccurate data
- Erasure (Art. 17): deletion of your data
- Restriction (Art. 18): restriction of processing
- Data portability (Art. 20): export of your data
- Objection (Art. 21): objection to processing
Contact for data protection requests: privacy@kubehz.io
7. Automated decision-making
No automated decision-making or profiling takes place.
8. Cookies
The website sets no cookies. Signing in and the dashboard store the following:
i18n_redirected is set on your first visit from your browser’s language, before you choose one. No tracking cookies. No advertising cookies. No outside company sets storage on any kubehz domain. No cookie banner required (ePrivacy Directive / ZEKom-2: storage strictly necessary for a requested service).
More information: Cookie Policy
9. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority:
Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia)
Dunajska cesta 22, 1000 Ljubljana, Slovenija
https://www.ip-rs.si
This is an English translation provided for convenience. The German version of this privacy policy is authoritative. For questions, contact privacy@kubehz.io.