Who is responsible
The controller under the General Data Protection Regulation (GDPR) is Wolfgang Wachelhofer, trading as Terrapixel, Heiligenstädter Straße 80/3/3, 1190 Wien, Austria. For anything about your data, write to hello@nuvlo.dev. We are not required to appoint a data protection officer.
Our role, and yours
This policy covers the personal data we process as controller: about visitors of nuvlo.dev, about account holders and their team members, and about buyers.
When you use Nuvlo to manage servers and sites, those servers may hold personal data of your own customers or site visitors, for example in databases, files or access logs. For that data you are the controller and we act as your processor under the data processing agreement.
Visiting the website
When you open nuvlo.dev, your browser sends technical data such as your IP address, the page requested, the time, and your browser and operating system. Our hosting and Cloudflare, which protects and delivers the site, process this data to deliver pages and to defend against attacks and abuse. We use IP addresses briefly in memory to limit repeated requests, for example to sign-in pages, and do not store them in a profile.
Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).
We host our fonts ourselves; opening the website does not send data to font services.
Your account and sign-in
To create an account we process your name, email address and password. The password is stored only as a cryptographic hash by our authentication provider Supabase. You can add a profile picture. If you turn on two-factor sign-in, we store the secret of your authenticator app.
If you sign in with Google or GitHub, that provider tells us your name, email address and profile picture after you agree on its page, and it learns that you sign in to Nuvlo. We remember on your device which method you used last.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
Bot protection on sign-in forms
The forms to sign in, create an account, reset a password and confirm your password use Cloudflare Turnstile, run by Cloudflare, Inc., to tell people from automated attacks such as password guessing and fake sign-ups. Turnstile runs invisibly in the background: your browser sends Cloudflare technical data such as your IP address, browser and device characteristics and how the page was loaded, and Cloudflare returns a one-time check result that our authentication provider verifies. Turnstile is not used for advertising or to follow you across websites.
Cloudflare describes how it processes this data in the Turnstile Privacy Addendum.
When an account is created, we store the IP address it was created from, the domain of its email address and how it signed up (email, GitHub or Google) for 90 days. We use this only to stop one person from creating many accounts, for example to avoid paying for a plan: an address or network that creates too many accounts in a short time, an email address that is a copy of an existing account's mailbox, and temporary inbox services are refused. For the same reason we keep a one-way fingerprint of the cloud accounts and provider API keys you connect, so a free account can't use one that another account already uses. Legal basis: our legitimate interest in preventing abuse and fraud (Art. 6(1)(f) GDPR).
Legal basis: our legitimate interest in protecting accounts and the service against abuse (Art. 6(1)(f) GDPR).
Using Nuvlo
To provide the service we process what you set up in Nuvlo:
- servers, sites, domains, deploy settings and environment variables;
- access tokens for the services you connect, SSH keys, database and WordPress passwords, and certificates, stored with application-level encryption;
- an activity log of actions in the workspace with the email address of the person or agent who took them;
- resource figures that the Nuvlo agent on your servers reports (CPU, memory, disk and network use, uptime), and the results of uptime checks and security scans;
- deploy output, and a preview image of each site’s homepage;
- for deploy hooks, the IP address that called the hook, shown in the deployment details.
Visitor numbers for your sites are worked out live from your server’s access logs when you open the analytics view and are not stored by us.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR); for the activity log and deploy hook IPs also our and your legitimate interest in security and traceability (Art. 6(1)(f) GDPR).
Team invitations
When you invite someone to your workspace, we process their email address and role and send them an invitation email. Invitations expire after 14 days. Legal basis: performance of the contract with the inviting account and our legitimate interest in letting teams work together (Art. 6(1)(b) and (f) GDPR).
Payments
Payments are handled by Stripe. In the checkout you enter your card details, billing address and, if you buy as a business, your business name and VAT ID. Card details go directly to Stripe and never reach our servers. Stripe also checks payments for fraud.
We keep a record of each purchase: what was bought, the amount, the VAT, your country, whether you bought as a business, when you accepted the terms and, for consumers, when you asked for an immediate start or withdrew.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legal obligations to keep accounting records (Art. 6(1)(c) GDPR).
Emails
We send emails that belong to the service: sign-in and confirmation emails, invitations, purchase confirmations, notices about plan limits, messages when a server or site is ready, and the alerts you switch on, such as a site going down or a backup failing. A welcome email in the first days shows you how to get started. Emails are sent through Resend and through our authentication provider Supabase. We do not send newsletters without your consent.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR); for the welcome email our legitimate interest in helping you use Nuvlo (Art. 6(1)(f) GDPR).
If you add a client’s email address to receive monthly client reports, we first send that address one email asking to confirm. Reports go out only after the recipient confirms, and every report email has a link to stop them. We store the address, when it was confirmed or stopped, and, for report links you share, when they expire and how often they were opened. Legal basis: the recipient’s confirmation (Art. 6(1)(a) GDPR) and performance of the contract with the account that sends the reports (Art. 6(1)(b) GDPR).
AI features
When you use an AI feature, the content needed for the task is sent to our AI provider Anthropic: for example a launch-check finding, the WordPress and plugin versions of a site you migrate, or, for suggested code fixes, files from the repository you connected and the names (not the values) of your environment variables. Anthropic processes the data to produce the answer; under its commercial terms it does not use it to train its models. If you store your own AI provider key, requests run under your contract with that provider.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
Services you connect
When you connect a cloud provider, a Git provider (GitHub, GitLab, Bitbucket), Cloudflare or a storage provider, data is exchanged with that service on your instruction, for example to create a server, read a repository or set DNS records. These services process the data as independent controllers under their own privacy policies.
If you connect Slack, Discord, Microsoft Teams, Telegram or a webhook for alerts, each alert sends the name of the site or server and what happened to that service. If you connect an AI agent such as Claude, ChatGPT, Cursor or VS Code, the site and server details and logs it reads go to that service under your own contract with it.
Backups go from your server directly to the storage you connected; they do not pass through Nuvlo. Server-to-server migrations and copies also run directly between your servers.
Roadmap votes and comments
If you vote on or comment on the public roadmap, we store the vote or comment with your account. Comments are shown publicly with your first name and the initial of your last name. Legal basis: our legitimate interest in learning what to build next (Art. 6(1)(f) GDPR). You can ask us to remove a comment at any time.
Who receives data
We use service providers who process data on our behalf under data processing agreements; they are listed with their purpose and location on the subprocessors page. Beyond that we only pass on data if you instruct us to (for example to the services you connect), if the law requires it (for example to tax authorities), or to enforce our rights. We do not sell personal data.
Transfers outside the EU
Some of our service providers are based in the USA or may access data from there. Where the recipient is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR); otherwise on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). You can ask us for a copy of the safeguards.
How long we keep data
| Data | Kept for |
|---|---|
| Account and profile | Until your account is deleted. An account with no servers or sites that nobody uses for 6 months is deleted, after an email 30 days before and a reminder a week before; signing in keeps it |
| Servers, sites, settings, encrypted credentials | Until you delete them or the account |
| Activity log (who did what in a workspace) | 180 days |
| Live deployment output | 3 days; the saved deploy log is kept with the site |
| Saved deploy logs and site preview images | Until the site or the account is deleted |
| Server resource history | Every reading for 24 hours, then 15-minute averages; deleted after 7 days |
| Uptime checks | Each check for 2 days; daily uptime figures for 31 days |
| Security scans | 90 days, longer while a finding is still open |
| Team invitations | Expire after 14 days |
| Sign-up records (IP address, email domain, sign-up method) | 90 days |
| Fingerprints of connected cloud accounts and provider keys | Until your account is deleted |
| Purchase records and invoices | 7 years from the end of the calendar year (§ 132 Austrian Federal Fiscal Code, BAO) |
When your account is deleted, its data is removed, except purchase records we must keep by law. Backups of our database are overwritten within a few weeks.
Security
Connections are encrypted with TLS. Access tokens, keys and passwords are additionally encrypted before they are stored. Server connections check the server’s identity before connecting. You can protect your account with two-factor sign-in, and access within the database is limited to the records each account may see.
Your rights
You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18), to receive it in a portable format (Art. 20), and to withdraw consent at any time with effect for the future (Art. 7(3)).
You have the right to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 21 GDPR).
To use these rights, write to hello@nuvlo.dev. You can also complain to a data protection authority, in Austria the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb.gv.at.
Do you have to give us data?
You do not have to give us data, but without an email address and password (or a Google or GitHub sign-in) we cannot create an account, and without billing details we cannot sell you a plan. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR).
Changes to this policy
We update this policy when Nuvlo or the law changes. The date at the top shows the current version; we will tell account holders about significant changes by email.