Privacy Policy

1. Scope and who we are

dply is operated by Shafer LLC, a company in Arizona, USA (“dply”, “we”, “us”). We are the controller of the personal data described in this policy: data about the people who sign up for dply, belong to an organization on dply, pay for it, contact us, or visit dply’s own website.

2. Data inside your apps

This policy does not cover the data that our customers put into the sites, apps, databases and storage they host on dply, or data about the people who visit those sites. For that data, the customer is the controller and dply is the processor. We handle it only on the customer’s instructions, under the Data Processing Addendum. If you are a user of a site hosted on dply and have a question about your data, contact the site’s owner.

Visitor counts. To show customers how many people visit their sites and which pages they read, dply counts page views at the edge, for the customer and under the same terms. It sets no cookies and stores nothing on the visitor’s device. For each page view it records the site, the page path (without the query string), the referring site’s host name, the country, and a visitor code: a one-way keyed hash of the IP address, browser user agent and date, with a different key for each site. The IP address itself is not stored, and the code changes every day, so a visit cannot be linked to visits on other days. Bots, files such as images and scripts, and dply’s own checks are not counted.

3. What we collect

• Account data. Your name, email address, password (stored hashed), passkeys, two-factor settings, and profile settings. If you sign in with GitHub, GitLab or Bitbucket, the profile details that provider shares with us, such as your username and email.
• Organization data. Organization names, members, roles, invitations, and the settings of your apps and resources.
• Billing data. Your plan, subscription status, invoices, and billing contact details. Payments are handled by Stripe. We do not receive or store your card number; we receive a customer reference and limited card details such as brand and last four digits.
• Git provider tokens. When you connect GitHub, GitLab or Bitbucket, we store access tokens so we can read your repositories and deploy them. They are encrypted.
• Usage data. What your apps use, such as requests, bandwidth, storage, build time and compute, which we measure to bill you and to show you usage.
• Logs and security data. IP addresses, browser user agent, sign-in and session records, the organization activity (audit) log, API token use, and request logs for your apps.
• Communications. What you send us by email or support request.

We get this data from you, from the Git provider you sign in with, from Stripe, and from running the service. We do not buy personal data.

4. Cookies and similar technology

dply uses only what it needs to work:

• Session cookie to keep you signed in, and a “remember me” cookie if you choose it.
• Security cookie (XSRF-TOKEN) that protects forms against cross-site request forgery.
• Browser storage for interface preferences, such as whether the sidebar is collapsed. It stays in your browser.

dply does not use advertising cookies or third-party analytics or tracking on its website or dashboard. Our web fonts are loaded from Bunny Fonts (fonts.bunny.net), which receives your IP address when your browser fetches them.

5. How we use it and why

If you are in the EU, UK or Switzerland, the law requires a legal basis for each use. Ours are:

We do not use your data for advertising, we do not sell it, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

6. Who we share it with

• Service providers that run dply for us: Cloudflare (hosting, storage, delivery, DNS and email), DigitalOcean (databases), Hetzner (uptime checks), Stripe (payments), and GitHub, GitLab or Bitbucket if you connect them. The current list is on the Security & compliance page. They may use the data only to provide their service to us.
• Your organization. Other members of an organization you belong to can see your name, email, role and the changes you make there.
• Legal and safety. Authorities or others when the law requires it, or when needed to protect the rights, safety or property of our customers, the public or dply.
• Business transfer. A buyer or successor if dply is merged, acquired or sold, under this policy.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined in California law.

7. International transfers

dply is based in the United States, and your account data is processed in the US. Some providers process data elsewhere, such as Cloudflare’s global network and Hetzner in Germany. When we transfer personal data from the EU, UK or Switzerland to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses, with the UK Addendum and Swiss adjustments where they apply, or another lawful transfer mechanism.

8. How long we keep it

• Account and organization data: while your account is open. You can delete your account from your profile.
• Paused organizations: if an organization is paused because it has no paid plan, its apps, resources and data are deleted 30 days after the pause, after emailed warnings 7 days and 1 day before. The organization, its members and billing history remain.
• Request logs: 7 days.
• Visitor counts for customers’ sites (section 2): three months.
• Audit log: 365 days.
• Database backups: 7 days on Starter, 14 on Pro, 30 on Team; a deleted database’s backups within a week.
• Billing records: as long as tax and accounting laws require.
• Support email: as long as needed to handle your request and keep a record of it.

We may keep data longer when the law requires it or to resolve a dispute or investigate abuse.

9. Security

All traffic uses HTTPS. Secrets, Git provider tokens and connection strings are encrypted in our database with AES-256, and passwords are hashed. Access inside organizations is controlled by roles, and two-factor authentication is available on every account. The Security & compliance page has the details. Report a vulnerability to security@dply.io.

10. Your rights

Depending on where you live, including under the EU GDPR, the UK GDPR and California’s CCPA as amended by the CPRA, you have the right to:

• Access the personal data we hold about you, and know how we use it.
• Correct data that is wrong or incomplete.
• Delete your data.
• Portability: get a copy in a common, machine-readable format.
• Object to or ask us to restrict processing based on legitimate interests.
• Opt out of the sale or sharing of personal information. We do neither, so there is nothing to opt out of.
• Withdraw consent where we rely on it.
• Not be discriminated against for using these rights.
• Complain to your data protection authority. We would like the chance to help first.

Much of this you can do yourself: edit your profile, export or delete your apps and resources, and delete your account.

11. How to exercise your rights

Email hello@dply.io from the address on your account. We may need to confirm your identity before acting. You can use an authorized agent; we may ask for proof that they act for you.

We respond within one month under the GDPR and UK GDPR, and within 45 days under California law. If a request is complex, we may extend that as the law allows (by up to two more months under the GDPR, or 45 more days under California law) and will tell you why.

12. Children

dply is not for anyone under 16. We do not knowingly collect personal data from children under 16. If you believe a child has given us data, contact us and we will delete it.

13. Changes to this policy

We may update this policy. The date at the top shows the current version. For material changes, we email account holders before they take effect.

14. Contact

Shafer LLC, Arizona, USA. Email hello@dply.io for privacy questions and requests.