Privacy,
plainly.

Værft ApS, Ryesgade 3, 2200 København N, Denmark, CVR 43 27 19 44, is the data controller for the personal data described in this policy. Contact: [email protected].

For personal data inside the applications and databases you deploy on Værft, you are the controller and we are your processor — that relationship is governed by the Data Processing Agreement, not this policy.

• Account data — name, email address, avatar, and the identifiers your sign-in provider (GitHub, Google, GitLab, Gitea, Codeberg, or your SSO) shares with us.
• Team and project data — team membership, roles, project configuration, connected repositories, deployment history, and activity logs (which include the acting user and IP address).
• Billing data — plan, invoices, and payment status. Card details go directly to our payment providers; we never see or store full card numbers.
• Operational data — server logs, IP addresses, session and security events (sign-ins, two-factor challenges, token usage), and error diagnostics.
• Support correspondence — emails you send us.

We do not buy data about you, and we do not run third-party advertising trackers.

• Providing the Service (accounts, deployments, billing) — performance of a contract, GDPR art. 6(1)(b).
• Security (session management, rate limiting, abuse prevention, audit logs) — legitimate interest, art. 6(1)(f), in keeping the platform and your account safe.
• Legal obligations (bookkeeping, tax) — art. 6(1)(c); Danish law requires us to keep accounting records for 5 years.
• Product emails about your deployments, teams, and account — contract performance. Marketing email is sent only with consent, art. 6(1)(a), and every message has an unsubscribe link.

The dashboard uses strictly necessary cookies only: your session and CSRF protection. The marketing site sets no tracking cookies. Because we use no non-essential cookies, there is no consent banner to click.

We share personal data only with the vendors needed to run the Service — payment providers, email delivery, and infrastructure — each bound by a data processing agreement. The current list is on the subprocessors page. We may also disclose data when the law requires it. We never sell personal data.

Our infrastructure runs in the European Union. Where a vendor processes data outside the EU/EEA, the transfer is protected by an adequacy decision or the EU Standard Contractual Clauses — details per vendor on the subprocessors page.

• Account data — for the life of the account, then deleted within 30 days of account deletion.
• Activity and security logs — up to 12 months.
• Server logs — up to 90 days.
• Invoices and bookkeeping records — 5 years (Danish Bookkeeping Act).
• Backups — rotated automatically; deleted data leaves backups within the retention window (28 days).

Under the GDPR you can ask us for access to, rectification, erasure, or portability of your personal data, ask us to restrict processing, and object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time. Write to [email protected]; we answer within a month.

You can also complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk — or to your local supervisory authority.

When this policy changes materially, we announce it by email or in the dashboard before the change takes effect. The “last updated” date above always reflects the current version.