Privacy Policy

1. Introduction

Vashana is a product and service operated by Alvesta Systems AS, a company registered in Norway (Org. nr. 936 927 548) ("we," "our," or "us"). We are the data controller for the personal data of our own users — your account, your billing, your use of the Service. This policy is about that data.

There is a second relationship, and a different document covers it. For the people who use the sites you build — your visitors, your customers, your renters — you are the controller and we act as your processor. Those terms are in our Data Processing Agreement, and the third parties involved are listed on our sub-processor page.

We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website creation and hosting services ("the Service").

Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the Service.

2. Information We Collect

2.1 Personal Information

We collect personal information that you voluntarily provide to us when you:

• Register for an account (email address, name)
• Use our services (website content, files, preferences)
• Contact us for support
• Subscribe to our newsletter or marketing communications
• Make a purchase or payment (payment information processed by FastSpring)

2.2 Automatically Collected Information

When you access our Service, we may automatically collect:

• IP address and approximate geolocation
• Browser type and version
• Operating system
• Access times and dates
• Pages viewed and time spent on pages
• Unique device identifiers
• Referring website addresses

2.3 Cookies and Tracking

We use cookies and similar tracking technologies. Please see our Cookie Policy for detailed information about our use of cookies.

2.4 Website Analytics

We measure traffic to vashana.com with Plausible Analytics, a privacy-focused analytics service that processes data within the EU. We chose it specifically so that understanding our own traffic does not require tracking you:

• It sets no cookies and stores nothing on your device
• It does not collect or store personal data, and does not create a profile of you
• Your IP address is used only transiently to derive a country and is never stored
• It cannot follow you across other websites
• We record one additional event — that an account was created — with no information about who created it

Because no personal data is collected and nothing is stored on your device, this processing does not rely on your consent. This applies to our own marketing site only; websites built by our customers are covered by their own policies.

3. How We Use Your Information

We use the information we collect for:

• Service Delivery: Providing, operating, and maintaining our Service
• Account Management: Processing transactions and managing your account
• Improvement: Improving, personalizing, and expanding our Service
• Analytics: Understanding and analyzing how you use our Service
• Communication: Customer service, updates, and marketing (with consent)
• Security: Detecting, preventing, and addressing security threats
• Legal Compliance: Complying with legal obligations

3.1 Legal Basis for Processing (GDPR)

For users in the European Economic Area, we process your data based on:

• Contract: Processing necessary to provide our Service
• Consent: Where you have given explicit consent (e.g., marketing emails)
• Legitimate Interest: Analytics, security, and service improvement
• Legal Obligation: Compliance with applicable laws

4. Information Sharing and Disclosure

4.1 Third-Party Service Providers

We share your information with third-party service providers who perform services on our behalf:

• Cloudflare R2: File storage and content delivery (US-based)
• OpenAI: AI-powered content generation (US-based)
• FastSpring: Payment processing and merchant of record (US-based, PCI-DSS compliant)
• Fly.io: Application hosting and deployment (US/EU)
• Supabase: Authentication and database services (US-based)
• Resend: Transactional email, including account and billing notices (US-based)
• Sentry and Grafana Cloud: Error monitoring and application logs (EU-hosted)
• Tucows Domains Inc. (OpenSRS): Domain registration services (Canada-based)
• Plausible Analytics: Cookieless, aggregated traffic statistics for vashana.com (EU-based). No personal data is shared — see Section 2.4

These providers are contractually obligated to protect your data and only use it for the specified purposes.

4.2 Domain Registration Data

When you purchase a domain through Vashana, additional data sharing occurs as required by ICANN (the Internet Corporation for Assigned Names and Numbers):

• Registrant contact information: Your name, address, email, and phone number are shared with our registrar partner (OpenSRS/Tucows) and the relevant domain registry (e.g., Verisign for .com domains)
• WHOIS database: Your registrant information may be published in the public WHOIS database unless privacy protection is enabled
• Registry requirements: Certain TLDs (top-level domains) may have additional data requirements mandated by their registry operators
• Verification: Your contact information may be verified by ICANN or the registry to ensure accuracy

This data sharing is required to complete domain registration and cannot be opted out of while maintaining domain ownership. For more details, see Section 8 (Domain Registration Services) in our Terms of Service.

4.3 Legal Requirements

We may disclose your information if required by law or in good faith belief that such action is necessary to:

• Comply with legal process or government requests
• Enforce our Terms of Service
• Protect the rights, property, or safety of Vashana, our users, or others
• Investigate or prevent illegal activities

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal information may be transferred. We will provide notice of such changes and any choices you may have.

4.5 No Sale of Personal Information

We do not sell your personal information to third parties. We do not share your information for third-party advertising purposes.

5. Data Storage and Security

We implement appropriate technical and organizational security measures including:

• Encryption in transit (TLS/SSL) and at rest
• Access controls and authentication
• Regular security assessments
• Secure data centers (AWS, Cloudflare)

However, no method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as necessary to:

• Provide our Service to you
• Comply with legal obligations
• Resolve disputes and enforce agreements

After account deletion, we may retain certain data for up to 30 days for backup purposes, and longer if required by law.

7. Your Privacy Rights

Depending on your location, you may have the following rights:

• Access: Request access to your personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information
• Portability: Request a copy of your data in a portable format
• Restriction: Request restriction of processing
• Objection: Object to certain types of processing
• Withdrawal: Withdraw consent at any time

To exercise these rights, please contact us at [email protected]. We will respond within 30 days (or as required by applicable law).

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have different data protection laws.

For transfers from the EEA/UK, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with our service providers

9. Children's Privacy

Our Service is not intended for children under 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you are a parent and believe your child has provided us with personal information, please contact us.

10. AI and Automated Processing

Our Service uses AI to provide features such as content generation. This processing may involve:

• Analyzing your content to provide suggestions
• Generating text and images based on your prompts
• Learning from usage patterns to improve our AI models

You can opt out of certain AI features through your account settings. AI-generated content is subject to our Terms of Service.

11. California Privacy Rights (CCPA)

California residents have additional rights under the CCPA:

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information
• Right to opt-out of the sale of personal information (we do not sell your data)
• Right to non-discrimination for exercising privacy rights

To make a CCPA request, contact us at [email protected].

12. European Privacy Rights (GDPR)

If you are in the European Economic Area, you have rights under the GDPR including all rights listed in Section 7. You also have the right to lodge a complaint with your local supervisory authority if you believe your rights have been violated.

Our Data Protection Contact: [email protected]

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated policy on our website
• Updating the "Last Updated" date
• Sending an email notification for significant changes

Your continued use of our Service after such modifications constitutes acceptance of the updated Privacy Policy.

14. Contact Information

If you have questions about this Privacy Policy or our data practices:

• Data Controller: Alvesta Systems AS (Org. nr. 936 927 548), Norway
• Privacy inquiries: [email protected]
• Data Protection Contact: [email protected]
• General: [email protected]