Privacy Policy

Who processes your data

Nubiecloud is an application deployment platform (PaaS). This policy covers the public website nubiecloud.io, the console console.nubiecloud.io, the API api.nubiecloud.io and the MCP server exposed at api.nubiecloud.io/mcp.

The data controller is NUBITECH SAS, a French simplified joint-stock company registered with the trade and companies register under SIREN number 105 358 543, whose registered office is at 200 rue de la Croix Nivert, 75015 Paris, France.

As NUBITECH SAS is established in France, the General Data Protection Regulation (GDPR) applies directly to this processing, and the competent supervisory authority is the CNIL.

Two roles not to be confused. For the data of your account, your organisation and your billing, we decide on the processing and we are responsible for it. For the data that your applications process — your databases, your files, the users of your service — you are the one who decides: we host and run it on your behalf, without using it for our own purposes.

1. The data we collect

Your account

• Identity and contact: first name, last name, email address. These are the only fields asked for at registration.
• Password: kept only as a digest computed by a hash function dedicated to passwords. It is never stored in clear text and we cannot read it.
• Two-factor authentication, if you enable it: the TOTP secret (encrypted) and your ten recovery codes.
• Trusted devices: the browser used, the date of last activity and the expiry date of the trust granted, so that you are not asked for a code at every sign-in.
• Sign-in through an identity provider (Google, Microsoft Entra ID), where that option is enabled: the technical identifier the provider sends us and the associated email address. We never receive your password.

What you deploy

• the source code fetched from the Git repository you connect, and the container images built from that code;
• your configuration: environment variables, configuration files, domain names, quotas;
• your applications’ secrets (database passwords, API keys). They are encrypted and are never shown again once saved;
• the contents of your managed databases, your backups and your object storage buckets.

Logs

• Audit logs: for every action that changes the state of the platform (sign-in, creating or deleting a resource, a deployment, restoring a backup, running an SQL query…), we record the date, the author (email and name), the action, the resource concerned, the outcome and the IP address. You read them yourself from your organisation’s Audit page.
• Application logs: the output of your own applications, collected so that you can read it in the console. Its content depends on what your application writes — if it writes personal data there, that data ends up there.
• Technical logs of the infrastructure and web servers (IP address, timestamp, path requested, response code), necessary for operations and security.

Connected Git repositories

When you connect a GitHub or GitLab account, we keep the access token issued by that provider, encrypted before storage, together with the list of repositories it gives access to. Removing the connection from Nubiecloud withdraws our access on our side; to revoke it completely, also remove the authorisation in your GitHub or GitLab account settings.

Connected AI assistants (MCP)

Nubiecloud exposes an MCP server that lets an assistant — Claude, for example — act on your organisation on your behalf, after you have explicitly authorised it. What we keep:

• the authorised session (which client, which organisation, which capabilities) and the digest of the access token, revocable at any time from the console;
• one log line per request received: date, method called, tool name, resource targeted, outcome, status code and duration. That trace is what lets you see what an agent did.

The capabilities that can be granted are read, write and operate (restart, redeploy). No MCP tool can delete a resource: every deletion goes through the console, performed by a person.

What that implies on your side. As soon as an assistant reads your data through this channel, that data travels to the assistant’s provider, under their privacy policy and not ours. We have no visibility and no control over what they do with it.

On the public website nubiecloud.io

• Audience measurement: we use an instance of Plausible Analytics that we host ourselves, on our own subdomain. It measures page views in aggregate, sets no cookie, does not follow you from site to site and builds no advertising profile. No audience data is sent to an ad network.
• Browser local storage: a single value, your light or dark theme preference. It never leaves your browser.
• The public website sets no advertising cookie and embeds no social network pixel.

What we do not collect

• No payment card data. Online payment does not exist in the console: paid plans go through a request handled with our team.
• No special category data within the meaning of the GDPR (health, opinions, orientation) is requested by the platform.

2. What this data is used for, and where it is stored

Purposes

• Providing the service: creating your account, building and deploying your applications, running your databases, serving your domains over HTTPS, running your backups.
• Securing accounts: two-factor authentication, verification of new devices, abuse detection, rate limiting.
• Giving you traceability: audit logs and MCP call logs exist first and foremost so that you know who did what.
• Supporting you: answering a support request, diagnosing a deployment that fails.
• Billing platform usage and meeting our accounting obligations.

We do not use your data for advertising, we do not sell it, and we do not use it to train artificial intelligence models.

Legal basis

The processing described above rests on the following legal bases, within the meaning of the GDPR:

• performance of the contract between us, for everything necessary to provide the service: account, deployments, databases, backups, domains, support;
• our legitimate interest in preserving the security and availability of the platform, for two-factor authentication, device verification, rate limiting, audit logs and technical logs;
• a legal obligation, for keeping invoices and accounting records;
• your consent, for the processing that depends on it — today, the authorisation you give an AI assistant to act on your organisation through MCP. It is revocable at any time from the console.

Where the data is stored

Nubiecloud’s default infrastructure is operated at Hetzner Online GmbH (Germany), in its data centres in Helsinki, Finland — therefore within the European Economic Area. If you chose another region when you created your project, your applications and databases are deployed there.

If you connect your own infrastructure as a region, the applications you deploy there run on your side: the application data stays on your machines, and we keep only the metadata needed to operate them (names, configuration, deployment state).

Transfers outside the European Economic Area

The infrastructure that runs your applications and databases stays within the EEA (Finland), as does the object storage that receives your application logs. Two providers are, however, established in the United States: Backblaze for the object storage of backups, NubiS3 and published sites, and Google for sending our transactional emails.

These transfers are framed by the European Commission’s standard contractual clauses. Both providers are moreover certified under the Data Privacy Framework: Backblaze has certified with the Department of Commerce under the EU-U.S. DPF, the Swiss-U.S. DPF and the UK extension (published commitment), and Google LLC adheres to those same frameworks (published commitment).

How it is protected

• each environment runs in an isolated space, and each project in a dedicated tenant;
• secrets and access tokens are encrypted before storage;
• applications are exposed over HTTPS only, with TLS certificates renewed automatically;
• access is governed by roles, at organisation and project level;
• two-factor authentication is available on every account.

3. Who this data is shared with

We sell no data and we share it with no one for commercial purposes. The only third parties that see part of it are those whose service is necessary to run the platform:

• Hetzner Online GmbH (Germany, data centres in Finland) — the host of the infrastructure on which your applications and databases run. Within the EEA: no transfer to frame for this component.
• Backblaze (United States) — the object storage that receives your database backups, your NubiS3 buckets and the sites you publish.
• Google (United States) — the delivery of our transactional emails over SMTP: account verification, password reset, new-device code. They are sent from contact@nubitech.io.
• GitHub and GitLab — only if you connect a repository. We call their API with the token you authorised, to list your repositories and fetch your code.

Your applications’ application logs are kept on Hetzner object storage, therefore within the EEA.

The website’s audience measurement relies on a Plausible instance we host ourselves, at analytics.nubiecloud.io: no third party has access to it, and it sets no cookie. It is therefore not a sharing of data.

We may disclose data where the law requires us to — a court order, a request from a competent authority. In that case we inform you, except where we are prohibited from doing so.

The third parties you choose. If you connect an AI assistant through MCP, if you call our API from a third-party tool, or if your application itself sends data elsewhere, those transfers are yours and fall under those services’ policies.

4. How long we keep it

Deleting your account

You delete your account from your profile, in the danger zone. The deletion is final. One point to know before starting it: if you hold resources (projects, environments, applications), they are not destroyed — they are transferred to the organisation’s owner, and the console shows you a preview of that transfer before you confirm.

Your account data is then erased within 30 days. Two exceptions, and we would rather state them than let you believe everything disappears at once:

• invoices and accounting records, which we must keep for 10 years;
• backups already taken of your databases, which remain until the retention period you set yourself expires on the deployment concerned. A 90-day retention means a backup may survive the account deletion by 90 days, after which it is purged automatically.

5. Your rights

You may request access to your data, its rectification, its erasure, its portability, the restriction of its processing, or object to a processing operation. Several of these rights are exercised directly from the console: editing your profile, reading your audit logs, revoking a device, a Git connection or an MCP session, deleting your account.

For everything else, write to us (see below). We reply within one month of receiving your request. That period may be extended by two months if the request is complex or if requests are numerous; in that case we tell you within the first month, and why. These are the periods set by the GDPR, not a choice of ours.

If our answer does not satisfy you, you have the right to lodge a complaint with the competent supervisory authority, the Commission nationale de l’informatique et des libertés (CNIL):

CNIL — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr

6. Contact us

For any question about this policy, and for any request concerning your personal data, write to contact@nubitech.io. It is the only address to remember: there is no other one for this subject.

No data protection officer has been appointed — our activity does not require one. The point of contact is the company’s legal representative, reachable at the address above.

If you would rather write by post, address your request to the registered office: NUBITECH SAS, 200 rue de la Croix Nivert, 75015 Paris, France.

7. Changes to this policy

We may develop this policy, for example if we add a service or change provider. The date of the last update appears at the top of this page. In the event of a substantial change — a new category of data, a new purpose, a new processor — we notify account holders by email. That is a commitment, not a possibility.

NUBITECH SAS — 200 rue de la Croix Nivert, 75015 Paris, France — SIREN 105 358 543 — contact@nubitech.io. See also the terms of service, and the French version, which is the reference text.