Privacy policy

1. Who is responsible

The controller for account, billing, support and service-operation data is:

This policy covers the luisa.sh website and service. For personal data you put inside a VM on behalf of others, you decide the purposes of processing; our role as processor must be covered by a separate data-processing agreement. This policy does not replace that agreement.

2. The data we process

• Account and access: your email address, account identifiers, public SSH keys and fingerprints, team memberships, consent records, verification challenges and browser-session records. We do not ask for your SSH private keys.
• Service operation: IP addresses, connection times, authentication and security events, VM identifiers, locations, resource allocations and lifecycle events. These help us route connections, allocate capacity and investigate faults or abuse.
• Billing: plan, subscription and transaction references, payment status, billing contact details and records needed for accounting. Paddle collects payment details at checkout; we do not receive full payment-card numbers.
• Support: messages, attachments and information you choose to send us.
• Hosted content: files and other data stored on your VM disks, processed to provide the storage and computing you request.

We obtain these data from you, your use of the service, team administrators and payment-status information from Paddle. Providing an email address and the necessary account and billing information is required to use the paid service. Support attachments are optional.

3. Why we use it

• Providing the service and support: creating accounts, authenticating access, running VMs, managing subscriptions and answering requests. Our basis is performance of a contract or steps you request before one (GDPR Article 6(1)(b)).
• Security and reliable operation: preventing abuse, investigating incidents, enforcing access controls and maintaining records needed to resolve disputes. Our basis is our legitimate interest in protecting customers and operating a reliable service (Article 6(1)(f)).
• Legal duties: tax and accounting records and valid legal requests (Article 6(1)(c)).
• Optional communications: where consent is required, we ask separately and you can withdraw it at any time (Article 6(1)(a)). Signing up or requesting a login code does not subscribe you to marketing.

We do not sell personal data, use advertising trackers on this website or use your VM content to train our own AI models. Services and AI tools that you choose to run or connect inside a VM have their own data practices.

4. Providers and recipients

We use the following providers for the purposes listed. We share only data needed for those purposes, and authorized people working on the service may access data needed for their role.

• Amazon Web Services (AWS): computing, networking and infrastructure storage. VM data resides on the host in your allocated region; provider support and service metadata may involve other countries. See AWS’s privacy notice.
• Cloudflare: domain and DNS services, including technical query data. Cloudflare operates globally. See Cloudflare’s privacy policy.
• Loops (Astrodon): transactional email, such as verification codes and service notices, including recipient addresses and delivery information. Loops is based in the United States. See Loops’ privacy policy.
• Fastmail: our support and business email, including the messages you send us. Fastmail is based in Australia and uses international infrastructure and service providers, including in the United States and Europe. See Fastmail’s privacy policy.
• Paddle: checkout, recurring billing, invoices, tax and fraud prevention. Paddle acts as an independent controller for its merchant-of-record activities. The relevant entity is identified in your purchase documents and may be in Ireland, the United Kingdom, the United States or Canada. See Paddle’s privacy policy.

We may also disclose necessary information to professional advisers or authorities where required by law or necessary to establish, exercise or defend legal claims. We assess requests before disclosing data.

5. International transfers and security

A VM’s region is not a promise that all account, email or payment data stays in that region. The providers above can process personal data outside the European Economic Area. For transfers we control, we require an applicable GDPR transfer mechanism, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, with supplementary safeguards where needed. Contact us for information about the safeguards applicable to your data.

Browser connections use HTTPS. SSH traffic is encrypted between your client and VM while the gateway relays it. We use access controls and restrict administrative access. Host-level encryption and SSH do not mean that stored data is technically inaccessible to infrastructure operators. No system can guarantee absolute security.

6. Retention and deletion

We retain data for as long as it is needed for the purpose described, taking account of active subscriptions, unresolved support or security issues, legal deadlines and the need to establish or defend claims.

• Accounts: retained while active. You can request deletion in settings or by email. We review active resources and outstanding obligations before closing the account. Necessary financial records, security audit records and minimal key-ownership records may remain afterward to meet legal duties or prevent misuse.
• VM disks: kept while the VM exists and for the 30-day retention period after paid access ends. They are then scheduled for deletion, subject to an already accepted connection finishing. Explicit VM deletion removes the disk immediately. Local NVMe disks are not backed up by us.
• Login: email codes expire after 10 minutes. Authenticated browser sessions expire after 30 days or earlier on logout or revocation. Expiry of an access credential is separate from retention of a security event recording its use.
• Billing: records subject to Austrian accounting requirements are generally retained for seven years, and longer where an ongoing proceeding or another legal duty requires it.
• Logs and support: retained only for operational troubleshooting, security, resolving your request or applicable legal needs. Incident or dispute records may be kept longer than routine records. We assess retention by those needs rather than promising that all records are erased when an account closes.

We tell you if a deletion request cannot yet be completed and why. Providers acting as independent controllers, including Paddle, apply their own legal retention obligations.

7. Your rights

Subject to the conditions in the GDPR, you can request access, correction, deletion, restriction of processing and a portable copy of your data. Account settings include an export and a deletion-request option. Contact us if you need assistance or wish to exercise another right.

You may object to processing based on legitimate interests on grounds relating to your situation, and object to direct marketing at any time. You may withdraw consent without affecting processing that was lawful before withdrawal. We may need to verify your identity before acting on a request and normally respond within one month, with any lawful extension explained to you.

You can complain to the Austrian Data Protection Authority (Datenschutzbehörde), or the supervisory authority where you live, work or believe an infringement occurred. You do not have to contact us first.

We do not use your personal data for automated profiling that makes decisions with legal or similarly significant effects. Automated authentication, capacity and payment-status checks control access to the service; contact us if you believe a restriction is incorrect.

8. Cookies and changes

Our account pages use an essential first-party session cookie to keep you signed in and protect account actions. It is marked Secure, HttpOnly and SameSite=Lax, and lasts up to 30 days after login. Logging out revokes the session. If you block this cookie, browser login will not work. The website does not use analytics or advertising cookies. Paddle’s checkout may use its own necessary technologies under its privacy notice.

We update this policy when our processing changes. The date above identifies the version. We will notify account holders of material changes and request consent where it is legally required.