Version: 1.0 · Effective: 24 October 2026 · Last updated: 24 October 2026
This policy explains what personal data we handle when you visit the SrvYard website, use the SrvYard console and documentation, or contact us, and what your rights are. It follows Articles 13 and 14 of the UK GDPR (and the same Articles of the EU GDPR). It is written to be read, and it says what we do not do as well as what we do.
Who we are
SrvYard is operated by Spykra Technologies UK Ltd, a company registered in England & Wales (No. 14554019), 86–90 Paul Street, London, England, EC2A 4NE, United Kingdom. For the personal data described in this policy, Spykra Technologies UK Ltd is the controller.
| Privacy contact | [email protected], or by post to the address above, or through the contact form |
| Phone | +44 (0)7769 243907 |
| Data protection officer | We are not required to appoint one, and we have not. Privacy questions go to the contact above and are answered by a person. |
Two roles. If you use SrvYard to manage servers that hold other people's personal data (for example the customers of a site you deploy), you decide what that data is and why it is processed. For that data we act as your processor, under the Data Processing Agreement, and this policy does not describe it. This policy covers the data we handle for our own purposes as controller: your account, your billing, our security, support and website.
What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Name, email address, a hashed password (we never see or store it in a readable form), a profile picture if you add one, language and time zone, your organisations, roles and memberships. If you sign in with GitHub, Google, GitLab or Apple: the provider's identifier, your name and email address from it, and the sign-in token, stored encrypted. Two-factor secrets and recovery codes, and passkey public keys, if you add them. | You, and the social provider you choose. |
| Sign-in and security records | Each sign-in attempt, successful or not, with time, IP address, browser and system, and method; your last sign-in time and IP address; the list of your active sessions with IP address and last activity; the IP address and time an API token was last used. | Generated when you use the service. |
| Audit records | Who changed what in an organisation and when, with the IP address; for a staff action on your behalf, the staff member's name. | Generated when you use the service, or when staff act for you. |
| Billing | Your Stripe customer reference, the brand and last four digits of the payment method, the plan and billing interval, and the status and dates of the subscription. Invoices and receipts are held by Stripe and shown to you in the console. We never receive or store a full card number. | You, through Stripe's checkout. |
| What you connect | Credentials for servers, cloud providers, Git hosts, DNS and storage providers, certificates and keys, .env files and database passwords. They are stored encrypted, decrypted only inside the job that needs them, and used only to do what you ask. |
You. |
| Server, site and deployment metadata | Names, addresses and IPs of your servers, site and domain names, settings, deployment history, logs of commands and deployments (with values known to be secret masked), metrics, activity and webhook delivery records. This describes your infrastructure, not the data your sites hold. | You, and the servers you connect. |
| Support | Tickets (subject, messages, attachments, the organisation they concern), and the conversations you have with the support chat: your messages, the replies, optional email address you give, the page you were on, attachments, and the rating you give. If you are signed in, the chat is linked to your account. | You. |
| Contact form | Name, email address, phone number and company if you give them, topic, message, whether you want updates, and your IP address. | You, on the website. |
| The emails we send you (sign-in codes, verification, invitations, notifications, receipts, trial and subscription notices) and delivery information from our email provider. | Generated by us. | |
| Analytics | None. The website and the console run no analytics, advertising or tracking scripts, and we do not build advertising profiles. |
Data about other people. If you invite someone to an organisation, we hold their email address and role until they accept or the invitation expires. Tell people before you add them.
Special category data. We do not ask for it and the service does not need it. Please do not put it in tickets, chats or messages to us.
Why we use it and our legal bases
| Purpose | Data | Legal basis (UK GDPR Art. 6) |
|---|---|---|
| Create and run your account, sign you in, manage organisations and roles, provide the service | Account, sign-in, what you connect, server and deployment metadata | Contract: we need it to provide the service you asked for. |
| Take payment, manage subscriptions, send receipts and billing notices, handle refunds | Billing, account | Contract; and legal obligation for accounting and tax records. |
| Secure the service and your account: detect and block attacks, abuse, fraud and automated sign-in attempts; rate limiting; keep audit records | Sign-in and security records, audit records, IP addresses | Legitimate interests: keeping the service and your servers secure. We have balanced this against your rights and use only what is needed. |
| Support you: tickets, the chat assistant, answers to your messages | Support, account, contact form | Contract (for customers); legitimate interests (answering people who contact us). |
| Send service messages: security alerts, verification and sign-in codes, invitations, notifications and trial or subscription notices | Account, email | Contract; legitimate interests. |
| Optional product updates from the contact form | Contact form | Consent. You can withdraw it at any time by writing to us. |
| Improve the documentation and the assistant: we look at the questions asked, with secrets removed, to find gaps in the documentation | Chat questions and outcomes | Legitimate interests. |
| Comply with the law, answer lawful requests from authorities, establish and defend legal claims | As needed | Legal obligation; legitimate interests. |
| Enforce our terms and protect our rights | As needed | Legitimate interests. |
We do not sell personal data, and we do not use it for third-party advertising.
Automated decisions and AI
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects on you. Some features use AI models (see below) to produce text, such as an explanation of a failed deployment or an answer in the chat. A person can read the chat, take it over, or answer your ticket instead. Automated rate limiting may refuse requests that exceed a limit; that is a technical safeguard, not a decision about you.
Who receives your data
We share personal data only with the following, and only as needed:
| Recipient | Role | What they receive | Where |
|---|---|---|---|
| Hosting provider | Processor | Everything the platform stores | Data centres in the UK or EU |
| Email delivery provider | Processor | Your email address and the content of the emails we send you | Provider under contract (UK or EU) |
| Stripe | Payments; acts as controller for payment processing and fraud prevention and as our processor for some services | Name, email, billing details and payment details you enter at checkout, plan | Stripe operates in the UK, EEA and the United States |
| Anthropic | Processor, for optional AI features | Chat questions (with secrets removed) and, if you are signed in, the account details the assistant looks up for you; failed-deployment output with secrets removed, if you turn on the AI explanation | United States |
| OpenAI | Processor, for documentation search | Public documentation text and your documentation search or chat query, turned into numbers (embeddings) for matching. No account or server data. | United States |
| Cloudflare | Processor | For a free subdomain: the name you chose and your server's public IP address, as a DNS record | Global network |
| iDrive e2 | Processor | Website and documentation images and media. No customer personal data. | Object storage |
| Our advisers, insurers and authorities | Controllers | What is needed for advice, claims, or a legal duty | UK |
Servers, cloud providers, Git hosts and storage that you connect are your choice, are not our sub-processors, and receive data from SrvYard only because you asked it to act on them. The current list of sub-processors is also in the Data Processing Agreement.
International transfers
Platform data (accounts, organisation data, deployment logs, and backups of the platform) is stored in UK and EU data centres. Some of the providers above are outside the UK and EEA, mainly in the United States: Anthropic and OpenAI for the optional AI features, and Stripe for payments. Where personal data is transferred to a country without an adequacy decision, we rely on an Article 46 safeguard: the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and the EU Standard Contractual Clauses, as the case requires, together with a transfer risk assessment. The UK-US and EU-US data bridges (the Data Privacy Framework) are an additional mechanism that we may rely on only where a recipient participates in it. Ask us for a copy of the safeguards we use.
Personal data about people in the EEA is moved to the UK under the EU's adequacy decision for the UK.
How long we keep data
We keep personal data no longer than we need it. Where a period is set by the software, it is listed. Where no automatic period exists, we say so, and we remove the data on request or when the account or organisation it belongs to is deleted.
| Data | How long |
|---|---|
| Account, organisation membership, profile | While your account exists; deleted when you delete the account |
| Sessions | Expire after 120 minutes without activity |
| Email sign-in codes | Valid for 10 minutes |
| Password reset links | Valid for 60 minutes |
| Organisation invitations | Valid for 7 days |
| One-time server credentials (sudo and database administrator passwords SrvYard generates) | The stored copy is encrypted, emptied by the first download and expires after 24 hours |
| API request idempotency keys | 24 hours |
| Activity feed of a server or site | 14 days |
| Server metrics | 30 days |
| Webhook and channel delivery records | 30 days |
| Migration scan reports | 30 days; scanned environment values 7 days |
| Migration import tokens | Removed when the import finishes or after 1 hour; import session records are deleted after 30 days |
| Configuration exports | Downloadable for 7 days; the file is removed 30 days after it expires. An uploaded import bundle waits 24 hours; import reports are kept for 7 days |
| Records of customer backup runs | Removed 90 days after they expire |
| Audit records | No automatic expiry while the organisation exists |
| Sign-in and security records | No automatic expiry while the account exists. When an account is deleted the records are no longer linked to it; we delete them on request |
| Deployment history and logs | With the organisation, until it is deleted |
| Support tickets and chat conversations | With the account; deleted when the account is deleted. We delete them earlier on request |
| Contact form messages | No automatic expiry; we delete them when you ask |
| Billing records | Stripe holds payment records as the law requires. We keep invoice and tax records for as long as UK law requires accounting records to be kept, normally six years |
| Operational backups of the platform, where they are made | Held in the UK or EU on a limited rolling cycle; data deleted from live systems ages out of them on that cycle |
Deleting an account. You can delete your account yourself from your profile page after entering your password. It is deleted at once, together with the organisations you own, and this cannot be undone (your servers themselves are not touched and keep running). To delete only an organisation, its servers must be removed from SrvYard first. A deleted organisation is switched off and hidden immediately; if you want its remaining records removed immediately, write to us and we will do so within one month.
Your rights
Under the UK GDPR, and under the EU GDPR if you are in the EEA, you have the right to:
- be informed about how we use your data (this policy);
- access the personal data we hold about you and receive a copy. A JSON export of your account data is available from your profile page;
- have it corrected if it is wrong (most of it you can edit yourself);
- have it erased in the circumstances the law sets out. You can delete your account yourself, or erase your security data (two-factor, passkeys and sessions) from your profile page;
- restrict how we use it;
- data portability: receive the data you gave us in a structured, commonly used, machine-readable form (the JSON export and the configuration exports serve this);
- object to processing that is based on legitimate interests, and to direct marketing at any time; and
- withdraw consent where we rely on it, without affecting what we did before.
To use a right, write to [email protected] from the address on your account. We reply within one month. We may ask for proof of who you are and, rarely, extend the time by up to two further months for complex requests; we will say so. We do not charge, unless a request is clearly unfounded or excessive.
If your data is in someone else's SrvYard account because they invited you or because it is held on their servers, ask that organisation first; we will help them respond.
Complaints. You can complain to us first and we will try to put it right. You also have the right to complain to the supervisory authority. In the UK that is the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, https://ico.org.uk. If you are in the EU you can complain to the data protection authority of the country where you live, work, or where you think a breach took place.
Security
We protect personal data with technical and organisational measures that are described on the Security page and in Annex II of the Data Processing Agreement: secrets encrypted at rest, two-factor authentication and passkeys, roles with least privilege, an audit log, one-time credentials, rate limiting, signed webhooks and separation between organisations. No system is perfect. If a breach is likely to put your rights at risk, we tell the ICO within 72 hours, and tell you without undue delay where the law requires it.
Cookies and similar technologies
The website and console use only the cookies and browser storage that are needed to run them or that remember a setting you chose, and no analytics or advertising cookies. The list, with names and durations, is in the Cookie Policy.
Children
SrvYard is not for anyone under 18, and we do not knowingly collect personal data from children. If you think a child has given us data, write to us and we will delete it.
Changes to this policy
We update this policy when what we do changes. The version number and the effective date at the top change each time. If a change matters to you, such as a new purpose or a new kind of recipient, we tell you by email or in the console before it takes effect. Earlier versions are available on request.
Contact
Spykra Technologies UK Ltd, 86–90 Paul Street, London, England, EC2A 4NE, United Kingdom. Email: [email protected] · Phone: +44 (0)7769 243907 · Contact form.
Related documents: Terms of Service, Cookie Policy, Data Processing Agreement, all legal documents.