Privacy policy
Version 1.0 Effective 7 October 2026
Deploy is a product of Vimonto. These documents are an agreement between you and Vimonto.
Our legal documents are available in English only. The English text is the one that applies.
This policy explains how we use personal data for Deploy’s website, dashboard, accounts, subscriptions, AI functions and support at https://deploy.vimonto.com.
1 Who is responsible
The controller for our own processing is Luuk Dahlmans, trading as Vimonto, a sole proprietorship registered in the Netherlands, Chamber of Commerce number 74936719, VAT identification number NL002415477B32, with its business address at Echterstraat 85, 6051 EZ Maasbracht, the Netherlands. Contact: info@vimonto.nl or +31 85 060 9131.
For account administration, billing records we receive, website analytics and our own legitimate security purposes, Vimonto determines the relevant purposes. When we process personal data in customer configuration, deployment operations, logs or instructed AI requests on a customer’s behalf, we act as processor, or as subprocessor where that customer acts for a client. Our Data Processing Agreement governs that processing.
If your data is in an application operated by a Deploy customer, contact that application’s operator first. We assist our customers with applicable requests. Our access to a server does not make us controller of everything on it.
2 Information we handle
We receive information from you, your organisation’s account administrator, providers you connect, Polar or another purchase channel, and your interactions with the service.
| Category | Examples |
|---|---|
| Account and identity | Name, email, account identifier, organisation and membership information, authentication and MFA information |
| Subscription and billing | Selected plan, order and subscription identifiers, billing contact details, tax information where supplied, payment status and cancellation records |
| Server management | Server IP addresses and identifiers, domains, repository references, configuration, SSH keys, API tokens, environment variables and operational output |
| Security and usage | IP address, browser and device information, timestamps, sign-in events, administrative actions, failures and performance records |
| Support | Contact details, messages, attachments and the diagnostic information you provide |
| AI interactions | Prompts, relevant context submitted for an AI task, responses and associated request metadata |
| Website analytics | Consent-based identifiers, page and event information, browser/device information and interactions measured through Google Analytics |
Deploy stores encrypted management credentials and configuration. Your application repositories, databases and application backups are not hosted on our infrastructure as part of Deploy; they remain with your independent providers. Our remote operations may still access personal data on those systems. Logs, prompts or support messages may contain snippets or personal data that you or an operation includes. Avoid exposing credentials and unnecessary personal data through these channels.
3 Why we use it
| Purpose | GDPR legal basis for Vimonto’s controller processing |
|---|---|
| Create and operate an individual’s account or subscription; respond to a requested pre-contract enquiry | Performance of a contract or requested pre-contract steps, Article 6(1)(b) |
| Provide an organisation’s account, manage its users and respond to its contacts | Legitimate interests in supplying the organisation’s service and communicating with authorised people, Article 6(1)(f) |
| Process necessary purchase records and comply with tax or other legal duties | Contract performance where applicable, legitimate interests in account administration, and legal obligation for required records, Article 6(1)(c) |
| Protect accounts, investigate faults and abuse, and maintain service reliability | Legitimate interests in securing and operating the service, Article 6(1)(f), subject to necessity and balancing against individuals’ rights |
| Resolve support tickets, including appropriate AI-assisted analysis and drafting | Contract performance where applicable; otherwise legitimate interests in resolving requests efficiently and accurately |
| Optional Google Analytics and related optional tracking | Consent, Article 6(1)(a), collected before enabling the relevant tracking |
| Optional product marketing | Consent where required; you can unsubscribe at any time |
| Establish, exercise or defend legal claims | Legitimate interests in protecting legal rights, limited to relevant information |
Processing customer-controlled project information follows the customer’s documented instructions and lawful purposes under the DPA. We do not rely on this table to claim independent ownership of customer project data or permission to repurpose it.
Required account and purchase information is necessary to supply the requested service. Optional marketing and analytics consent is not a condition of using Deploy. Contractual acceptance of a privacy notice is not consent to unrelated processing.
4 Payments and sign-in
Polar operates the checkout as merchant of record and authorised reseller. It processes payment details, taxes, invoices, fraud checks and refunds under its Privacy Policy and Buyer Terms. Vimonto receives the customer and transaction information needed to activate and manage the subscription; we do not receive full payment-card details through the standard Polar checkout.
If you use Google sign-in, Google supplies the identity and authorisation information permitted by that login flow, such as name, email and account identifier. We do not obtain your Google password. Google’s own processing of your Google account is subject to its terms and privacy notice.
If you buy through AppSumo or another authorised marketplace, that seller processes the purchase under its notice and supplies information needed for redemption, entitlement verification and support. It receives data only if you interact with that purchase channel; a possible future listing does not mean every Deploy customer is disclosed to AppSumo.
5 AI and support tools
OpenRouter provides the routing for AI functionality inside Deploy. A submitted AI request and its relevant context are processed by OpenRouter and the model provider serving the selected route. The provider is identified through the applicable feature or information supplied before processing. We limit routing involving Customer Personal Data to providers authorised under the DPA. We do not treat an unspecified automatic fallback as permission to introduce an undisclosed recipient.
Vimonto uses ChatGPT, Claude and Google Gemini to assist software development and ticket resolution. Where a support issue requires these tools, the material can include the relevant ticket text and diagnostic extracts. We limit it to what is necessary for the task and apply the relevant confidentiality, processor and international-transfer arrangements. Our development use of AI does not authorise uploading customer repositories or databases wholesale.
Stored SSH private keys, API tokens, passwords and secret environment values must not be supplied to AI merely because they are available in Deploy. We minimise or redact sensitive information and do not authorise reuse of Customer Personal Data for general-purpose model training. Supplier selection, account configuration and contractual safeguards must support these restrictions. AI providers can still process necessary request metadata and security information within the applicable arrangement; we do not promise universal zero retention.
AI-generated assistance may be wrong. You may ask for human review of an AI-assisted support response. AI assistance is not intended to make legal or similarly significant decisions about individuals. If we introduce processing that does so, we will first provide the legally required information and safeguards.
6 Recipients and international processing
Our main application, database and platform backups are hosted in Hetzner datacentres in the European Union. This statement concerns the infrastructure we use to store Deploy’s own application data. It does not mean that every email, payment, identity or AI operation takes place only within the EU.
Providers include Hetzner for platform hosting, Amazon Web Services for SES transactional email, Google for Workspace, sign-in, Analytics and Gemini, Polar for purchases, OpenRouter for integrated AI, and OpenAI and Anthropic for development and support tools. The Subprocessors and Service Providers page describes their roles. Openprovider manages Vimonto’s own domain registration; it does not register customer domains through Deploy.
External providers and their authorised affiliates may process information in the EEA, United States or other locations used for the relevant service. Provider privacy and subprocessor information is linked in our register. Before making a restricted transfer for which we are responsible, we require a valid safeguard, such as an applicable adequacy decision or the relevant Standard Contractual Clauses with any necessary assessment and supplementary protection. We do not claim that accepting these Terms supplies blanket transfer consent. Ask info@vimonto.nl for the applicable transfer and recipient details or a copy of safeguards, with necessary confidential material redacted.
We also disclose information where legally required to competent authorities, or as necessary to professional advisers and in a genuine business transfer under appropriate safeguards. We do not sell personal data or supply private project content for third-party advertising.
7 Retention and deletion
| Information | Period or criterion |
|---|---|
| Active account, credentials and configuration | While necessary to supply the account and connected features; remove or revoke connections when no longer needed |
| Ordinary security and deployment logs; retained AI operational history | Up to 90 days from creation, unless a relevant extract is needed for an incident, a support request or a documented legal obligation |
| Closed support tickets and related retained AI assistance | Up to 12 months after the ticket is closed; remove unnecessary secrets sooner |
| Account and project information after account closure | A 30-day retrieval period, followed by removal from active systems without undue delay; an earlier valid deletion request is handled where applicable |
| Residual platform backup copies | Removed or made irrecoverable within 90 days after active deletion, isolated from ordinary use in the meantime |
| Google Analytics user-level and event-level data | No more than 14 months; cookie lifetimes are addressed separately in the Cookie Policy |
| Optional marketing contact information | Until withdrawal or objection, or when no longer needed; a minimal suppression record can be retained to honour an opt-out |
| Required accounting and tax records | Normally seven years from the applicable legal starting point; ten years for relevant One Stop Shop records where that obligation applies to Vimonto |
| Evidence of agreements, privacy choices, disputes and legal claims | Only for as long as needed to demonstrate compliance or resolve the relevant matter under applicable legal periods |
Downgrading to Free does not close your account and does not require deletion of information still needed for the Free service. After a switch, the agreed retrieval period is at least 30 days. Isolated backup remnants may therefore remain for approximately 120 days after closure, subject to the time reasonably required for active deletion, or longer where a lawful transition or preservation requirement applies. They are not used to continue ordinary processing.
This schedule governs data under our control. Independent controllers such as Polar retain their records under their own legal duties. Our processors must follow the retention and deletion obligations applicable to the data they handle for us. Tax retention does not justify retaining every log or support ticket for seven years.
8 Security and cookies
We use encrypted storage of access secrets, HTTPS and encrypted server connections, MFA, logging, platform backups and automated software tests. Access is limited to what is necessary for the task. No measure makes a service completely secure or eliminates every defect.
The Cookie Policy explains necessary browser storage, Google Analytics and consent controls. We seek prior consent for optional analytics and provide a way to reject it and withdraw consent. Rejecting optional tracking does not remove access to the core service.
9 Your rights
Subject to applicable legal conditions, you may request access, correction, deletion, restriction and portability. You may object to legitimate-interest processing based on your situation and object to direct marketing at any time. Withdrawing consent does not affect earlier lawful processing.
Contact info@vimonto.nl. We may verify identity proportionately. We normally respond within one month; if a lawful extension is needed, we explain it within that month. Requests are generally free, subject to the limited exceptions in law.
You may complain to the Dutch Autoriteit Persoonsgegevens or another competent supervisory authority, including where you live or work or where an alleged infringement occurred. You do not have to complain to us first. Additional rights under applicable laws outside the EEA remain available; contact us to exercise them.
10 Age and changes
Deploy accounts are intended for people aged 18 or over. This does not mean customer applications cannot contain data about children; their operators must establish the necessary lawful basis and safeguards.
We update this policy when practices change and give appropriate notice of material changes. New processing requires its own lawful basis and consent where required; changing the wording does not retrospectively authorise an incompatible use.