Privacy Policy

SrvYard is operated by Spykra Technologies UK Ltd, a company registered in England & Wales (No. 14554019), 86–90 Paul Street, London, England, EC2A 4NE, United Kingdom. For the personal data described in this policy, Spykra Technologies UK Ltd is the controller.

Two roles. If you use SrvYard to manage servers that hold other people's personal data (for example the customers of a site you deploy), you decide what that data is and why it is processed. For that data we act as your processor, under the Data Processing Agreement, and this policy does not describe it. This policy covers the data we handle for our own purposes as controller: your account, your billing, our security, support and website.

Data about other people. If you invite someone to an organisation, we hold their email address and role until they accept or the invitation expires. Tell people before you add them.

Special category data. We do not ask for it and the service does not need it. Please do not put it in tickets, chats or messages to us.

We do not sell personal data, and we do not use it for third-party advertising.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects on you. Some features use AI models (see below) to produce text, such as an explanation of a failed deployment or an answer in the chat. A person can read the chat, take it over, or answer your ticket instead. Automated rate limiting may refuse requests that exceed a limit; that is a technical safeguard, not a decision about you.

We share personal data only with the following, and only as needed:

Servers, cloud providers, Git hosts and storage that you connect are your choice, are not our sub-processors, and receive data from SrvYard only because you asked it to act on them. The current list of sub-processors is also in the Data Processing Agreement.

Platform data (accounts, organisation data, deployment logs, and backups of the platform) is stored in UK and EU data centres. Some of the providers above are outside the UK and EEA, mainly in the United States: Anthropic and OpenAI for the optional AI features, and Stripe for payments. Where personal data is transferred to a country without an adequacy decision, we rely on an Article 46 safeguard: the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and the EU Standard Contractual Clauses, as the case requires, together with a transfer risk assessment. The UK-US and EU-US data bridges (the Data Privacy Framework) are an additional mechanism that we may rely on only where a recipient participates in it. Ask us for a copy of the safeguards we use.

Personal data about people in the EEA is moved to the UK under the EU's adequacy decision for the UK.

We keep personal data no longer than we need it. Where a period is set by the software, it is listed. Where no automatic period exists, we say so, and we remove the data on request or when the account or organisation it belongs to is deleted.

Deleting an account. You can delete your account yourself from your profile page after entering your password. It is deleted at once, together with the organisations you own, and this cannot be undone (your servers themselves are not touched and keep running). To delete only an organisation, its servers must be removed from SrvYard first. A deleted organisation is switched off and hidden immediately; if you want its remaining records removed immediately, write to us and we will do so within one month.

Under the UK GDPR, and under the EU GDPR if you are in the EEA, you have the right to:

• be informed about how we use your data (this policy);
• access the personal data we hold about you and receive a copy. A JSON export of your account data is available from your profile page;
• have it corrected if it is wrong (most of it you can edit yourself);
• have it erased in the circumstances the law sets out. You can delete your account yourself, or erase your security data (two-factor, passkeys and sessions) from your profile page;
• restrict how we use it;
• data portability: receive the data you gave us in a structured, commonly used, machine-readable form (the JSON export and the configuration exports serve this);
• object to processing that is based on legitimate interests, and to direct marketing at any time; and
• withdraw consent where we rely on it, without affecting what we did before.

To use a right, write to [email protected] from the address on your account. We reply within one month. We may ask for proof of who you are and, rarely, extend the time by up to two further months for complex requests; we will say so. We do not charge, unless a request is clearly unfounded or excessive.

If your data is in someone else's SrvYard account because they invited you or because it is held on their servers, ask that organisation first; we will help them respond.

Complaints. You can complain to us first and we will try to put it right. You also have the right to complain to the supervisory authority. In the UK that is the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, https://ico.org.uk. If you are in the EU you can complain to the data protection authority of the country where you live, work, or where you think a breach took place.

We protect personal data with technical and organisational measures that are described on the Security page and in Annex II of the Data Processing Agreement: secrets encrypted at rest, two-factor authentication and passkeys, roles with least privilege, an audit log, one-time credentials, rate limiting, signed webhooks and separation between organisations. No system is perfect. If a breach is likely to put your rights at risk, we tell the ICO within 72 hours, and tell you without undue delay where the law requires it.

The website and console use only the cookies and browser storage that are needed to run them or that remember a setting you chose, and no analytics or advertising cookies. The list, with names and durations, is in the Cookie Policy.

SrvYard is not for anyone under 18, and we do not knowingly collect personal data from children. If you think a child has given us data, write to us and we will delete it.

We update this policy when what we do changes. The version number and the effective date at the top change each time. If a change matters to you, such as a new purpose or a new kind of recipient, we tell you by email or in the console before it takes effect. Earlier versions are available on request.

Spykra Technologies UK Ltd, 86–90 Paul Street, London, England, EC2A 4NE, United Kingdom. Email: [email protected] · Phone: +44 (0)7769 243907 · Contact form.

Related documents: Terms of Service, Cookie Policy, Data Processing Agreement, all legal documents.