Table of Contents
The short version
We collect only what's necessary to operate the platform -- account info, deployment metadata, and access logs. We do not sell your data. We share information only with service providers essential to operating the platform (like our cloud and payment processors).
This Privacy Policy describes how Cabotage Deploys, LLC ("Cabotage," "we," "us," or "our") collects, uses, and discloses information when you use our platform and services available at cabotage.io (the "Services"). By using the Services, you agree to the terms of this Privacy Policy.
This Privacy Policy applies to the hosted Cabotage platform operated by Cabotage Deploys, LLC. If you are running a self-hosted instance of the open-source Cabotage software, this policy does not apply; your organization's own privacy practices govern.
This policy covers two categories of people: Customers (individuals or organizations that create an account and use our platform to deploy applications) and End Users (individuals whose data may be processed by Customers' applications running on our infrastructure). Cabotage acts as a data controller for Customer account data and as a data processor for any personal data Customers process through their deployments.
If you are an end user of a Customer's application hosted on Cabotage, please direct privacy requests to that Customer. Cabotage will assist Customers in responding to such requests as required by applicable law and our Data Processing Agreement.
1 Information We Collect
1.1 Account and Customer Data
When you register for an account, we collect:
- Name and email address
- Organization name (if applicable)
- Username and hashed password credentials
- Billing contact information
1.2 Payment Data
Payment processing is handled by Stripe, Inc. Cabotage does not store full payment card numbers. We receive and retain limited billing data such as the last four digits of a card, billing address, and transaction history. Please review Stripe's privacy policy at stripe.com/privacy for details.
1.3 Infrastructure and Usage Data
When you use the Services, we automatically collect:
- Deployment configurations, build logs, and runtime logs
- Resource usage metrics (CPU, memory, network, storage)
- IP addresses and request metadata for platform security
- API access tokens and authentication events
- Browser type, operating system, and referring URLs when accessing the dashboard
1.4 Customer Content
Your application code, container images, environment variables, and any data stored in infrastructure managed by Cabotage ("Customer Content") are yours. We access Customer Content only as necessary to provide the Services, respond to support requests, or as required by law. We do not analyze Customer Content for advertising purposes.
1.5 Communications
If you contact us for support or correspond with us by email, we retain those communications to assist you and improve the Services.
2 How We Use Information
- To provision, operate, maintain, and improve the Services
- To authenticate users and prevent unauthorized access
- To process payments and send billing communications
- To send service notifications, security alerts, and policy updates
- To provide technical support
- To detect, investigate, and prevent fraud, abuse, and security incidents
- To comply with legal obligations
We do not use your data for advertising. We do not sell, rent, or trade your personal information to third parties for marketing purposes.
4 Data Retention
3 yrs
Account & billing data after relationship ends
90 days
Log and usage data
30 days
Customer Content after termination
Data may be retained longer where required by law. Residual copies in encrypted backups and disaster recovery systems are purged according to our standard retention schedules. De-identified or aggregated data may be retained indefinitely.
For Bring Your Own Cloud and white-label deployments, data residency is determined by the customer's infrastructure configuration. Cabotage's access to data in those environments is limited to what is necessary to operate and support the platform.
5 Security
We implement commercially reasonable safeguards including:
- Encryption of data in transit via TLS
- Encryption of data at rest
- Access controls and authentication for Cabotage personnel
- Regular security assessments
In the event of a security incident affecting your personal data, we will notify affected users without undue delay and in accordance with applicable law.
No system is completely secure. If you believe your account has been compromised, contact legal@cabotage.io immediately.
7 Your Rights & Choices
The rights below apply to Cabotage Customers. If you are an end user of an application hosted on Cabotage, please contact the application operator (our Customer) directly regarding your personal data.
7.1 Access and Correction
You may update most account information through your account settings. For other requests, contact privacy@cabotage.io.
7.2 Deletion
You may request deletion of your account and personal data by contacting privacy@cabotage.io. We will honor requests subject to legal obligations and legitimate business needs.
7.3 Marketing Communications
You may opt out of marketing emails via the unsubscribe link in any such email. We will continue to send transactional and administrative communications.
7.4 Data Portability
Upon request, we will provide an export of your account data and deployment configurations where technically feasible.
8 U.S. State Privacy Rights
If you are a resident of California, Colorado, Connecticut, Virginia, or another U.S. state with applicable consumer privacy laws, you may have rights including the right to know what personal information we collect, the right to correct inaccurate data, the right to delete personal information, and the right to opt out of the sale or sharing of personal information.
We do not "sell" or "share" (as defined under the CPRA) your personal information.
Categories of personal information collected in the preceding 12 months include: identifiers (name, email, username), commercial information (billing data, transaction history), internet activity (IP address, browser type, usage logs), and professional information (organization name).
To exercise these rights, contact privacy@cabotage.io. We will respond within applicable legal timeframes and will not discriminate against you for exercising your rights.
9 International Users & GDPR
The Services are operated from the United States. Your data is transferred to, stored, and processed in the United States.
If you are located in the EEA, UK, or Switzerland, you have rights under applicable data protection law including the right to access, rectify, or erase your personal data, restrict or object to processing, and data portability.
Our lawful bases for processing include: performance of a contract (to provide the Services you requested), compliance with legal obligations (tax, fraud prevention), and legitimate interests (platform security, service improvement, abuse prevention).
Where required by applicable law, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms, to safeguard international data transfers. You may request a copy of the applicable transfer safeguards by contacting legal@cabotage.io.
You also have the right to lodge a complaint with your local supervisory authority.
Customers requiring a Data Processing Agreement (DPA) for GDPR Article 28 compliance should contact legal@cabotage.io.
10 Children's Privacy
The Services are not directed to individuals under 16. We do not knowingly collect personal information from children under 16. If you are under 16, do not create an account or submit personal information. Contact privacy@cabotage.io if you believe a child under 16 has provided us with information.
11 Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email and/or a prominent notice on cabotage.io at least 30 days before taking effect. Continued use after the effective date constitutes acceptance.
12 Contact
Questions, concerns, or requests related to this Privacy Policy:
Cabotage Deploys, LLC — privacy@cabotage.io