Privacy Policy

1. Who we are

Cavas, CVR DK37178640, Aalborg, Denmark, is the data controller for personal data processed when you use provisore.com. Contact: privacy@cavas.dk.

2. What we collect

• Account data. Name, email, hashed password or SSO identity, 2FA secrets.
• Billing data. Plan, invoices, and the last four digits of your card (full card data is held by Stripe, never by us).
• Operational data. Server IPs, site configuration, deploy logs, and audit events you generate by using the product.
• Usage data. Product analytics and feature-flag evaluation through PostHog EU Cloud, on marketing pages and inside the app. We record a fixed list of actions you take (a page you opened, a server you created, a deploy you started) and never the contents of what you were working on: no server names, domains, environment variables, log lines, search terms or terminal output. Autocapture and session recording are switched off, and your IP address is discarded after your country is derived from it. By default this is anonymous and nothing is stored on your device. No cookie, no local storage, no profile, and no way to connect one visit to the next. It is linked to your account only if you agree, which we ask once and you can change at any time under Account settings → Product analytics. See the Cookie Policy for exactly what is sent in each case.
• Crash diagnostics. When something fails in your browser, an error report goes to Sentry's EU region: the error message, the stack trace, the page you were on, and your browser version. Request and response bodies, authorisation and cookie headers, and URL query strings are stripped in your browser before the report is sent, and we do not record your screen. See the Cookie Policy for the detail.

3. What we don't collect

We do not read your application code, your databases, or your customers' data. Environment variables and SSH keys are encrypted at rest and decrypted only to perform operations you initiate.

4. Legal bases & retention

We process account and operational data to perform our contract with you (GDPR art. 6(1)(b)), billing data to meet legal obligations (art. 6(1)(c)), and security logs and anonymous usage measurement in our legitimate interest (art. 6(1)(f)). Linking usage measurement to your account is done on your consent (art. 6(1)(a)), which you may withdraw at any time without affecting the service. Deleting your account removes it from our database at once. The encrypted backups of that database are kept for 30 days, so it is gone from them 30 days later. Invoices are kept for 5 years, as the Danish Bookkeeping Act requires; Stripe holds them.

5. Processors & transfers

We use a small set of sub-processors: Hetzner (control-plane hosting, EU), Stripe (payments), Resend (transactional email), PostHog EU Cloud (product analytics, error diagnostics and feature flags, EU), and Sentry EU (crash diagnostics, EU). The full list, with what each one receives, is at provisore.com/legal/subprocessors. Transfers outside the EU/EEA are covered by Standard Contractual Clauses.

6. Your rights

You have the right to access, correct, export, restrict, or delete your personal data, and to object to processing based on our legitimate interest. Access, portability (art. 15 and 20) and erasure (art. 17) are self-service: Account settings → Your data & account deletion downloads a complete JSON export immediately, and deletes your account and team without waiting on us. Your name you can change there too.

Deletion erases your account and your team and cancels any active subscription. Stripe keeps your team's customer record (name, email address, billing address and payment method), because the invoices we must keep (section 4) are attached to it. If you agreed to link product analytics to your account, the PostHog profile that created (your name and email address) is deleted too: PostHog removes the profile within minutes and the usage recorded under it in its weekly deletion run. PostHog keeps its record of your team's plan, subscription status and billing figures, with the team's name removed. Deletion does not touch the servers you manage with Provisore: those are your own machines, so nothing is uninstalled and no cloud instance is destroyed. We stop holding any record of them. The export excludes live credentials (private keys, database passwords, API tokens, and the contents of your environment variables), because a downloaded file is the wrong place to keep them; they remain available inside the product.

For anything not covered by those two (correction, restriction, objection, or a question about an export), email privacy@cavas.dk from the address on your account and we will respond within one month of receiving it, as GDPR art. 12(3) requires. We will tell you if we need to extend that, and why. You may lodge a complaint with Datatilsynet, the Danish DPA.