Privacy policy
Last updated: 6 November 2026
1. Who we are
1.1 Clusterz is run by Zer0Paper OÜ, registry code 16797271 in the Estonian commercial register, Ahtri tn 12, 15551 Tallinn, Estonia. We decide how the personal data described in this policy is used, so in data protection law we are its controller.
1.2 You can reach us about your personal data at contact@clusterz.eu.
2. What this policy covers, and what it does not
2.1 This policy covers personal data about people who:
- visit our website at clusterz.eu or our dashboard at app.clusterz.eu;
- sign in to Clusterz, including people invited to join a team;
- add credit, write to us, use our assistant or help form, or report content to us;
- send requests to Clusterz, or to an app on it, that our security software detects as an attack.
2.2 It does not cover the data inside the apps our customers run on Clusterz, such as patient, member or client records, the logs those apps write, or the code, commits and build logs of those apps. For that data the customer decides how it is used, and we process it for them under our data processing agreement. If you use one of those apps, or your records are kept in one, the organisation that runs it is responsible for your data, and its own privacy notice applies. Please send requests about that data to that organisation. If you send one to us, we pass it on to them.
3. The personal data we collect
3.1 Your account. You sign in with Google, Apple, GitHub, GitLab or Bitbucket, as our sign-in page offers. GitHub, GitLab and Bitbucket send us your user ID, username, name, email address, whether the address is verified, and the address of your profile picture. Google and Apple send us your ID, your email address, whether it is verified, and your name and picture where they have them. Apple may give us a private relay address instead of your email address, if you choose that. We keep your ID at that service, your email address, name, picture address, whether your email address is verified, and when you last signed in. We also keep which version of our terms you accepted, when and how, and, for our staff, that they are staff.
3.2 Access to your code. When you connect GitHub, GitLab or Bitbucket, you allow us to read your repositories. We keep the access and refresh tokens these services issue, encrypted, with when they expire and the permissions you granted. On GitHub, access to repositories comes through the GitHub App you install, and we keep the ID of that installation and the GitHub account name. We use this access to list and read your repositories, build your code, and add or remove the notifications that tell us when your code changes. GitLab asks you to give us full access to its API for your account; we use that access for these tasks. When your team builds an app, we may use the stored access of any member of the team.
3.3 Your team. We keep your team's name, its members, their roles, who invited each member, and when they joined. Every member of a team can see the names, email addresses and pictures of the other members. A new team's name comes from your name, or from the start of your email address. Its slug is random until an owner or admin changes it. The slug is part of the web address of each of the team's apps, and those addresses are public, as section 5.3 explains. Owners and admins can change the name and the slug in the team's settings.
3.4 Invitations. When a member invites you, they give us your email address and the role they offer you, and they send you the link. An invitation lasts 7 days. If you already have an account, you appear in the team as pending, with the role offered, until you accept or an owner or admin removes you. Your email address also appears in the team's audit records and, for up to 30 days, in our log store.
3.5 Audit records. When a member builds, deploys, rolls back or changes an app, changes a setting, a domain or the team's members, or installs a bundle, we record who did it, when, what it was, and the member's IP address and browser. We record the names of environment variables, never their values. For other changes, such as a rename, we record the old and the new value. When an owner reveals or resets an app's admin password, we record who did it and when, never the password. Owners and admins of the team can read these records, and so can our staff. We also record the changes our staff make in our admin tools.
3.6 Billing. For each payment of credit we keep the amount, the time, Revolut's order reference, the payment's state and the member who made it. We also keep each team's credit history and the hours of memory and processing power it used. Each invoice holds your organisation's legal name, registry code and address, and any VAT number you give us. We keep your team's price region, which sets the prices it pays: it comes from the country of the IP address of the member who installs or pays for the team's first solution (section 3.10), and stays with the team. Revolut receives the email address of the member who pays. We never receive card details.
3.7 Free trial. When a team starts a free trial, we keep the verified email address that started it, the account, the team, the trial's dates, and when we sent the reminder emails. This stops the same address, account or team from starting a second free trial. When the account and the team are deleted, the links to them go. The email address and the dates stay, with no end date, so that the address cannot start another.
3.8 Emails we send. We may email the owners and admins of a team about its free trial and its credit, for example when the trial is about to end or credit runs low. These emails show the team's credit, its plan or bundle, and a link to its billing page. The dashboard's billing page always shows your credit. We send no marketing emails.
3.9 Messages and reports. If you email us, we keep your message and our reply. If you report content under our acceptable use policy, we keep the report, with your name and email address if you give them. We tell the customer concerned who made a report only where that is strictly necessary.
3.10 Technical data. When you use our website, dashboard or API, our servers log your IP address, the address you asked for, the time, and how the server answered. Our services also send reports of errors to our own error-tracking service, which runs on our own servers. No outside company receives those reports. A report from the dashboard includes the page address and your browser details, and the service sees your IP address. Alerts about failures in our own systems, with team and app identifiers and the cause, go to our staff chat at Google. To show you the prices for your region, we look up the country of your IP address in a database on our own servers (IP Geolocation by DB-IP, under the CC BY 4.0 licence), and keep neither the address nor the country for it. When your team installs or pays for its first solution, we keep only the region that lookup gives, as section 3.6 says.
3.11 Attacks. To protect Clusterz, CrowdSec software runs on our servers. It is set up to read our router's logs, detect attacks and, where we enable it, block the addresses they come from. For each attack it detects, it sends CrowdSec SAS the address, its location when available, the kind of attack and the time. It sends no logs.
3.12 What you must give us. To use Clusterz you need an account at a service our sign-in page offers, and we need the email address it gives us. Without them we cannot create your account. To add credit, you pay through Revolut.
3.13 The assistant. If you use it, we keep what you type and its replies for 30 days, with your account and team if you are signed in. If you are signed out, we keep a keyed hash of your network address for one day, apart from the chat, to limit use of the assistant and our help form. To answer you it can read your role, which bundles your team has, when its free trial ends, how many apps and members it has, whether its credit is below zero and the date its apps pause, and for each app the software it runs and its state, the kind and time of a failed step, whether it ran out of time, whether it is up, and its last backup's time and state. It cannot read anything inside your apps, their logs or their settings, and your apps' own names and addresses are not sent to it. Our own servers put your team's credit and charges and a bundle's price into a reply, so those are not sent to it either. What you type, its earlier replies in that chat and what it reads go to Anthropic, PBC in the United States, which runs Claude, its AI model, to answer you. You can delete a chat while it is open, and otherwise it goes after 30 days. Our staff read a chat only if you tick the box to share it when you send us a request. They read it as far as it had reached when you sent it. For a question it could not answer, we keep a count and a topic, not your words.
4. Why we use it, and our legal basis
| Purpose | Data | Legal basis under the GDPR |
|---|---|---|
| Create your account, sign you in and run your team | Account, team and invitation data | Providing the service (see below) |
| Show that you accepted our terms | The version you accepted, when and how | Providing the service, and our legitimate interest in being able to prove the contract (Article 6(1)(f)) |
| Build and deploy your team's code | The tokens and links that connect your account to your repositories | Providing the service |
| Take payments, keep your team's credit and charge fees | Billing data | Providing the service, and our duty to keep accounting records (Article 6(1)(c)) |
| Show you the prices for your region, and charge your team the prices of its region | Your IP address, looked up for its country in a database on our own servers, and your team's price region | Our legitimate interest in pricing by region, so that organisations in Africa pay a lower price (Article 6(1)(f)) |
| Email you about your trial and your credit | Email address, team's credit, plan or bundle | Providing the service |
| Allow one free trial per person, account and team | Free trial record | Our legitimate interest in stopping misuse of the free trial (Article 6(1)(f)) |
| Keep a record of who did what in each team | Audit records | Your team's and our legitimate interest in security and in knowing who made each change (Article 6(1)(f)) |
| Keep Clusterz secure, and find and fix faults | Logs, error reports, alerts, and the addresses of detected attackers, which we share with CrowdSec SAS | Our legitimate interest in running a secure, working service (Article 6(1)(f)) |
| Show the pictures of team members | The viewer's IP address and browser details, which the viewer's browser sends to the service each member signed in with (section 9.5) | Your team's and our legitimate interest in showing who is in the team (Article 6(1)(f)) |
| Answer your messages | Messages | Providing the service, or our legitimate interest in answering you (Article 6(1)(f)) |
| Answer your questions in the assistant | Chats, and the account facts it reads | Providing the service, or our legitimate interest in answering you (Article 6(1)(f)) |
| Limit how much the assistant and the help form are used from one network | A keyed hash of a signed-out visitor's network address | Our legitimate interest in stopping misuse of the assistant (Article 6(1)(f)) |
| Handle reports of illegal content | Reports | Our duties under the EU Digital Services Act (Article 6(1)(c)) |
| Meet legal duties and answer lawful requests from authorities | Any of the above, as needed | Our legal duties (Article 6(1)(c)) |
"Providing the service" means this. If you are the customer in person, it rests on our contract with you (Article 6(1)(b)). If you act for a business or organisation, it rests on that organisation's and our legitimate interest in providing the service it contracted (Article 6(1)(f)).
Where the Nigeria Data Protection Act 2023 applies, we rely on the matching grounds in that Act.
5. Who receives it
5.1 Members of your team see each other's names, email addresses and pictures. Owners and admins see the team's audit records.
5.2 Companies that process data for us: Hetzner, which runs our servers and storage in Germany; Google, which runs our email, including the billing emails we send, our staff chat, and the key service that protects our backups; and Anthropic, PBC, which runs the AI model behind the assistant. The subprocessors page names each one, and says what it receives and where.
5.3 Companies that receive data for their own purposes, under their own privacy notices:
- Revolut Bank UAB, Lithuania, which takes payments for credit. It receives the payer's email address, the amount and a reference. The payment form loads from Revolut in the payer's browser, so Revolut also receives what a browser sends when it loads a page, such as its IP address.
- Google Ireland Limited and Apple Distribution International Limited, both in Ireland, if you sign in with Google or Apple. They see when you sign in to Clusterz.
- GitHub, GitLab and Bitbucket, if you sign in with them. They see when you sign in to Clusterz and when we read your repositories. They also see the IP address of anyone whose browser loads a member's picture from them.
- Internet Security Research Group (Let's Encrypt), United States, which issues the security certificates for web addresses on Clusterz. About you and your apps, it receives domain names only. These then appear in public certificate logs, as every public certificate does.
- CrowdSec SAS, France, which runs a shared list of attacking addresses. It receives what section 3.11 describes. It acts on its own account, and says it is a joint controller of this data with those who send it. You can use your rights over this data with it or with us. It says it keeps an address as such for at most 3 months and then blurs it, and that some data can stay up to a year before it is anonymised.
5.4 Public authorities, when the law requires us to give them data.
5.5 We use no advertising or analytics services.
6. Transfers outside the European Economic Area
6.1 We keep your account data in Germany.
6.2 Google. Our agreements with Google are with Google Cloud EMEA Limited in Ireland. We set the data region of our Google Workspace to Europe, so Google keeps our mail and chat data in Europe. Where Google moves data out of the European Economic Area, it relies on the EU-US Data Privacy Framework, under which Google LLC is certified, and on the European Commission's standard contractual clauses.
6.3 The services you sign in with. GitHub, Inc. and GitLab Inc. are in the United States and are certified under the EU-US Data Privacy Framework. Bitbucket is run by Atlassian, whose privacy policy names Atlassian Pty Ltd in Australia and Atlassian, Inc. in the United States. Atlassian says it relies on the Data Privacy Framework, under which Atlassian, Inc. is certified, and on standard contractual clauses. You hold your own account with each of these services, and its privacy notice says where it keeps your data. The same safeguards apply when your browser loads a member's picture from them. If you sign in with Google, its sign-in service comes from Google LLC, which is certified under the Data Privacy Framework. If you sign in with Apple, Apple says it relies on standard contractual clauses.
6.4 Let's Encrypt is in the United States. About you and your apps, it receives domain names only. A certificate cannot be issued without the name, and the name then becomes public by design. Choose names that hold no personal data, as section 3.3 explains.
6.5 CrowdSec SAS is in France. It says it uses Amazon Web Services and Google Cloud, and that it relies on the European Commission's standard contractual clauses for transfers outside the EU.
6.6 Anthropic. Anthropic, PBC is in the United States, and runs the assistant's AI model there. The European Commission's standard contractual clauses, in Anthropic's data processing addendum, cover what it receives from us, and Anthropic may not train its models on it.
6.7 You can check a company's certification on the Data Privacy Framework list at www.dataprivacyframework.gov. For more about any of these safeguards, write to contact@clusterz.eu.
7. How long we keep it
| Data | How long we keep it |
|---|---|
| Your account and your connections to GitHub, GitLab and Bitbucket | Until your account closes. Email contact@clusterz.eu to close it. |
| Your acceptance of our terms | While your account exists |
| Team membership | Until an owner or admin removes you, or the team is deleted. Your account stays after you are removed. |
| Invitations | 7 days. If you already have an account, your pending membership stays until you accept or an owner or admin removes you. |
| Data used during sign-in | Up to 11 minutes |
| Audit records | While your team exists. When a member's account closes, we remove that member's identity, IP address and browser from them within 30 days. We delete a team's audit records within 30 days after the team is deleted. |
| Billing records | At least 7 years after the end of the financial year of the payment, as the Estonian Accounting Act requires, including after your account closes. If a team is deleted with an invoice unpaid, we also keep its owners' and admins' email addresses until the invoice is closed or our last reminder goes. |
| Free trial record | With no end date, as section 3.7 explains |
| Messages and reports from people with an account | While the account exists. We delete them within 30 days after it closes. |
| Messages and reports from people with no account | 2 years |
| Assistant chats | 30 days. You can delete a chat sooner while it is open. |
| Hash of a signed-out visitor's network address | 1 day |
| Server logs, including IP addresses | 30 days in our log store. The servers' own log files are overwritten in turn as they fill. |
| Copies of any of this in a backup of our own databases | Up to 40 days |
| Measurements of our services | 90 days for metrics, 7 days for traces of requests |
| Error reports | 90 days. The entry that groups repeated errors goes within 7 days after that. |
8. How we protect it
8.1 We keep repository access tokens and secret settings encrypted with AES-256-GCM in our database. Our dashboard and API are served over HTTPS, and our sign-in cookies cannot be read by scripts.
8.2 Our staff reach our servers with SSH keys and our dashboards with Google sign-in. Our admin tools record the changes staff make with them.
8.3 Annex 2 of the data processing agreement describes our security measures.
9. Cookies, browser storage and what our pages load
9.1 We set two cookies. Both are needed to keep you signed in, so we do not ask for consent to them.
| Cookie | What it does | How long it lasts |
|---|---|---|
| clusterz_token | Shows that you are signed in | 15 minutes |
| clusterz_refresh | Renews clusterz_token | 7 days |
Both are set by api.clusterz.eu, cannot be read by scripts, and are sent only over HTTPS.
9.2 The dashboard also keeps a few items in your browser's own storage: your choice of light or dark theme, a note that you are signed in, the page to return to after you sign in, two short-lived notes about a bundle you are installing, and, while you use the assistant, a token for your chat, which goes when you close the tab. Only the dashboard in your browser uses them.
9.3 We use no analytics, advertising or tracking cookies or scripts.
9.4 Our pages load their fonts from our own servers.
9.5 When the dashboard shows the pictures of team members, your browser loads them from the service each member signed in with.
9.6 When our sign-in page shows Google's one-tap prompt, your browser loads Google's sign-in script from Google, which sees your IP address and browser details. Our public pages load no script from Google.
9.7 When a dashboard page fails, your browser sends an error report to our own error-tracking service, with the page address and your browser details. Our public pages, and our help form for people who are signed out, send none.
9.8 Our command-line tool keeps its sign-in tokens in a file on your own computer.
10. Decisions made automatically
We do not profile you. Three things happen automatically under our terms:
- an email address, account or team that has had a free trial cannot start another;
- when a team's credit stays below zero, its apps stop 72 hours after we first find it below zero;
- when a free trial ends and the team has never paid, its apps stop 72 hours later.
All three follow from our contract with your team. If you think one was wrong, write to us and a person will look at it.
The assistant answers questions. It decides nothing about you or your team.
11. Your rights
11.1 You can ask us to:
- give you a copy of your personal data;
- correct it;
- delete it;
- limit how we use it;
- give you the data you gave us in a common, machine-readable format, or send it to another company;
- stop using it where we rely on our legitimate interests.
11.2 Email contact@clusterz.eu. We answer within one month. If a request is complex, we may take two more months, and we tell you so within the first month. We may ask you to confirm who you are. The law limits some of these rights; if we cannot do what you ask, we tell you why.
11.3 To close your account, email us, and we complete this within one month. An account that owns a team stays until the team is deleted or has a new owner, as section 3.4 of the terms describes. Section 7 says what we keep afterwards and for how long.
11.4 If the Nigeria Data Protection Act 2023 applies to you, you have the rights it gives you, and you use them the same way.
12. Complaints
12.1 You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, info@aki.ee, +372 627 4135, www.aki.ee.
12.2 You can also complain to the data protection authority of the EU country where you live or work, or where you think the law was broken.
12.3 If you are in Nigeria, you can complain to the Nigeria Data Protection Commission, www.ndpc.gov.ng.
12.4 You do not have to write to us first, but we would like the chance to put things right.
13. Changes to this policy
If we change how we use your personal data, we email each team's owners and admins at least 30 days before the change applies, and we publish the new version here with its date.
14. Contact
Email contact@clusterz.eu, or write to Zer0Paper OÜ, Ahtri tn 12, 15551 Tallinn, Estonia.