Privacy Policy
Last updated 8 November 2026
This policy explains how we collect and use personal data when you visit supahost.app, create a SupaHost account or use the SupaHost service.
1. Who we are
SupaHost is operated by VOLODS LTD, a company registered in England and Wales under company number 16149306, with its registered office at 29 Rosemary Avenue, Grimsby, England, DN34 4JN (“Volods”, “we”, “us”). For the personal data described in this policy we are the controller under the UK GDPR and the Data Protection Act 2018.
You can contact us about privacy at any time at [email protected].
2. Data you store in your projects
Our customers use SupaHost to host their own databases, users and files (“Customer Data”). For Customer Data, the customer is the controller and we act only as a processor on their instructions. If you are an end user of an app built on SupaHost, please read that app’s privacy policy and contact its operator to exercise your rights. Customers can request our data processing agreement at [email protected].
3. What we collect
- Account data — your name, email address, company name, and the profile details your sign-in provider shares with us if you sign in with Google or GitHub. Passwords are stored only as salted hashes.
- Billing data — billing name, address, VAT number and payment history. Card payments are handled by our payment processor, Stripe; we never see or store your full card number.
- Service data — the instances, projects, domains, access tokens and settings you create, and an activity log of actions taken in your account (including by AI agents using your tokens).
- Technical data — IP address, browser and device information, and server and request logs generated when you use the website, dashboard or API.
- Communications — messages you send us for support, sales or feedback.
4. How we use it and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Creating your account and providing, operating and supporting the service | Performance of our contract with you |
| Billing, invoicing and collecting payments | Contract; legal obligation (tax and accounting records) |
| Keeping the service secure, preventing fraud and abuse, and debugging | Legitimate interests |
| Service emails such as security alerts, quota warnings and changes to these terms | Contract; legitimate interests |
| Improving the product using aggregated usage information | Legitimate interests |
| Product news and marketing emails | Consent, or legitimate interests for existing customers — you can opt out at any time |
5. Who we share it with
We do not sell personal data. We share it only with:
- Service providers who process it on our behalf under contract: cloud infrastructure and hosting providers, our payment processor (Stripe), DNS and content delivery (Cloudflare), and email delivery and customer support tools.
- Professional advisers such as accountants and lawyers, where needed.
- Authorities where we are required to by law, or to protect our rights, our users or the public.
- A buyer or successor if our business is sold or reorganised, under the same protections.
6. International transfers
Some of our providers process data outside the UK. When they do, we rely on UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Customer Data is stored in the region you choose for your instance.
7. How long we keep it
- Account and service data: for as long as your account is open.
- Customer Data: deleted within 30 days after your subscription ends, and removed from backups as they expire.
- Billing records: six years after the end of the financial year they relate to, as UK law requires.
- Request and security logs: up to 90 days, unless needed to investigate an incident.
8. Security
We use encryption in transit (TLS), encrypted storage, isolated projects with separate credentials, least-privilege access for our staff and audit logging. No system is perfectly secure; if a breach affects your personal data we will notify you and the ICO where the law requires.
9. Your rights
Under UK data protection law you can ask to access, correct, delete or export your personal data, object to or restrict how we use it, and withdraw consent at any time. Email [email protected] and we will respond within one month. If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office at ico.org.uk, though we would appreciate the chance to help first.
10. Cookies and local storage
We use strictly necessary cookies and browser storage to keep you signed in, remember your preferences and protect against fraud. We do not use advertising cookies. If we add analytics that are not strictly necessary, we will ask for your consent first.
11. Children
SupaHost is a service for businesses and developers and is not directed at children under 16.
12. Changes
We may update this policy. We will post the new version here with a new date and, for significant changes, email account holders. See also our Terms of Service.