Privacy Policy
Controller: ZANTEMARK LIMITED, Arch. Makariou III, 195, NEOCLEOUS HOUSE 3030, Limassol, Cyprus, registration number HE 426044. Privacy contact: [email protected] Supervisory authority: Office of the Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia, Cyprus, [email protected]
This policy explains what personal data we process when you visit vbtnl.com, use the vbtnl dashboard, API and hosting platform, or deal with us, why, on what legal basis, for how long, who receives it, and what rights you have. It is written for the GDPR (EU and EEA), the UK GDPR, and, in a separate section, US state privacy laws. We do not ask you to “agree” to this policy: it is information we owe you. We ask you to confirm you have read it when you create an account so that we can show we gave it to you.
Your applications’ users are not covered here. If you build an application on vbtnl that processes other people’s personal data, you are the controller of that data and we process it for you under the Data Processing Agreement. Those people should read your privacy notice, not this one.
1. What we process, why, and on what basis
| Data | Purpose | Legal basis | Kept |
|---|---|---|---|
| Account: email, name, password hash, account type (consumer or business), country, language, Google account ID if you sign in with Google | Creating and running your account, signing you in, contacting you about the Service | Contract (art. 6(1)(b)) | Until you delete the account, plus 7 days to change your mind |
| Country as seen from your IP address at signup and at checkout | Evidence for VAT and for which consumer law applies; sanctions compliance | Legal obligation (art. 6(1)(c)); legitimate interest in compliance | With the account |
| Agreements record: which document versions you accepted or read, when, the text of the checkbox, your IP address and browser identifier, and the email we sent you as a copy | Being able to show what was agreed (contract formation, GDPR art. 7(1)) | Contract; legitimate interest in defending claims (art. 6(1)(f)) | 6 years after the account closes (limitation period) |
| Billing: billing name and address, VAT number, subscription and invoice history, the last four digits and brand of your card as Stripe shows them to us | Charging you, invoices, tax, fraud prevention | Contract; legal obligation (tax law) | Invoices and payment records 7 years; the rest with the account |
| Projects: your code, configuration, logs, database contents, domains, secrets | Providing the Service | Contract | Until you delete the Project or account, then up to 30 days in backups |
| Usage events: actions in the dashboard and through the API or MCP (for example project created, deployment published, plan changed), with timestamps | Understanding how the Service is used, improving it, support, and recognising abuse | Legitimate interest (product analytics on our own systems; no third-party cookies) | Until account deletion; aggregated statistics indefinitely |
| Signup source: campaign parameters (UTM) and referring page carried in the link you arrived with, promo code, and an optional “how did you hear about us” | Knowing which channels bring customers | Legitimate interest | Until account deletion |
| Technical logs: IP address, request path, timestamp, user agent, error details, for the dashboard, the API and your applications’ traffic through our edge | Security, abuse detection, debugging, rate limiting | Legitimate interest (security, art. 6(1)(f)); legal obligation where it applies | 30 to 90 days |
| Anti-bot check: Cloudflare Turnstile on the signup and password-reset forms | Keeping bots out | Legitimate interest (security) | Processed by Cloudflare during the check |
| Support and correspondence: what you write to us and we to you, by email or through the contact form on vbtnl.com (your name, email address, message and the country Cloudflare reports for your connection) | Helping you; keeping a record of what was said | Contract; legitimate interest | 3 years after the last message |
| Marketing: your email and the fact that you consented, if you tick the marketing box | Sending you product news and offers | Consent (art. 6(1)(a)); withdraw at any time | Until you withdraw; your address then stays on a suppression list (as a hash) so we do not write again |
| Abuse reports and moderation decisions | Handling reports about content, documenting what we did (DSA) | Legal obligation (Regulation (EU) 2022/2065); legitimate interest | 3 years |
| Data protection requests you make | Answering you and showing that we did | Legal obligation (art. 12) | 3 years after completion |
| Prospects (businesses we contact first, see Section 7) | Telling you about vbtnl | Legitimate interest, with the right to object at any time | 12 months without a reply, then deleted |
Where we rely on legitimate interest we have weighed it against your interests; you can ask us for the assessment and you can object (Section 9).
2. Where your data is
The platform runs on servers in Cyprus (EU) operated for us by Bolton Technologies Ltd in 195 Makarios III Avenue, 3608 Limassol, Cyprus. Some providers we use are in the United States: Cloudflare, Stripe, Resend and Google. For them we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses with additional measures. The current list, with the mechanism for each, is in our Subprocessor list. You can ask us for a copy of the clauses.
3. Who receives your data
- Our processors, who act only on our instructions: the infrastructure provider, Cloudflare (network, DNS, protection, custom domains), Resend (email), and, after you consent to analytics cookies, Google (Google Analytics). The full list is the Subprocessor list, which we keep up to date and announce changes to 30 days ahead.
- Stripe, our payment provider, which processes your payment details as an independent controller under its own privacy policy; we never see your full card number.
- Google, if you choose to sign in with Google: Google tells us your email, name and account ID; what Google does with the fact that you signed in is in Google’s policy.
- Your AI Assistant’s provider, if you connect one (for example Anthropic for Claude): your assistant reads your Projects and sends what you ask it to its provider. We are not a party to that; your contract with the provider governs it. By default your assistant cannot read your Projects’ production data (your own users’ data); you can allow it per Project, and we keep a record of who switched it on and when.
- Authorities, when the law requires us to, for example a court order; we check every request and tell you where we are allowed to.
- A buyer of our business, in a sale or merger, under confidentiality and with notice to you.
We do not sell personal data and we do not share it for others’ advertising.
4. Cookies and similar technologies
Strictly necessary (no consent needed): a session token in your browser’s session storage and a refresh_token cookie that keep you signed in; Cloudflare’s security cookies on the forms protected by Turnstile.
Google Analytics (consent needed in the EU, EEA, UK and Switzerland): on vbtnl.com only, and only after you accept it in the cookie banner. It sets the _ga cookies and sends usage data to Google. You can change your choice any time via “Cookie settings” in the footer. Visitors from other countries see no banner; Google Analytics loads with IP anonymisation and without advertising features.
We use no advertising cookies or tracking pixels. The dashboard (app.vbtnl.com) uses no third-party analytics at all. Details are in the Cookie Policy.
5. Children
vbtnl is for adults. You must be at least 18 to create an account. We do not knowingly collect data from children; if you believe a child has an account, write to [email protected] and we will delete it.
6. Automated decisions
We make no decisions about you with legal or similarly significant effect by automated means alone. Automated tools help us detect malware, phishing and resource abuse in hosted applications; what we do about a finding is decided by a person, and you can object (Terms, Section 6).
7. Businesses we contact first
8. How long we keep data
The table in Section 1 gives the periods. When you delete your account we remove your Projects, databases, domains, tokens, usage events and profile from live systems within the 7-day grace period, and from backups within their 30-day cycle. We keep invoices (7 years), the record of the agreements you accepted (6 years) and a minimal deletion record (account ID, deletion date, hashed email) so that a restored backup does not bring the account back and so that promotional conditions for new customers are not abused. These records are kept only for those purposes and are not used to contact you.
9. Your rights
You have the right to access your data and get a copy, to have inaccurate data corrected, to have data erased, to restrict processing, to receive the data you gave us in a machine-readable format (portability), to object to processing based on legitimate interest, and to withdraw a consent at any time without affecting earlier processing. Objecting to direct marketing always works.
Use the dashboard (Account: export, delete; Legal: your agreements and marketing choice) or write to [email protected]. We may ask you to confirm your identity, for example by writing from the account’s email address. We answer within one month; for complex requests we may extend by two months and tell you why.
You may complain to a supervisory authority, in particular the one in the country where you live or work, or to ours: Office of the Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia, Cyprus, [email protected].
10. United Kingdom
For people in the UK, the UK GDPR applies with the same rights as above. You may complain to the Information Commissioner’s Office (ico.org.uk).
11. US state privacy rights
If you live in California, Colorado, Connecticut, Virginia, Utah or another US state with a consumer privacy law, you may have the right to know what personal information we collect, to delete it, to correct it, and to opt out of its sale or sharing for targeted advertising. We do not sell personal information and we do not share it for cross-context behavioral advertising; Google Analytics, where used, is configured without advertising features. To exercise rights, use the dashboard or write to [email protected]; we will verify your request through your account email. We do not discriminate against you for exercising rights.
12. Security
We protect data with the measures described in Annex II of our Data Processing Agreement, including isolation of each customer’s workloads, encryption in transit, access limited to named staff with multi-factor authentication, logging of administrative access, and tested backups. No system is perfectly secure; if a breach affects you we tell you without undue delay.
13. Changes
We update this policy when our processing changes. We publish the date and a summary of changes, tell you by email and in the dashboard, and keep every version available. Because this policy informs you rather than binds you, we do not ask you to accept new versions; where a change needs your consent (for example a new purpose based on consent), we ask for it separately.
Version 2026-11-09, effective 09 November 2026.