This policy explains what personal data KVNest collects, why, how long we keep it and what rights you have. It applies to the website at kvnest.com, the dashboard and the KVNest API. We wrote it to meet the EU General Data Protection Regulation (GDPR) and the ePrivacy rules on cookies.
In short
- We only collect what we need to run your account and your instances.
- Everything is stored on servers in Germany.
- We use Google Analytics only if you allow it. We use no advertising or cross-site tracking, and we never sell your data.
- Without your consent we only set the cookies that sign-in needs.
- You can ask us at any time for a copy of your data, or to delete it.
1. Who is responsible
The controller under Art. 4(7) GDPR is:
KVNest
Amsterdam, the Netherlands
Email: legal@kvnest.com
For anything about your data, write to that address.
2. What we process and why
2.1 Your account
You sign in with Google or GitHub. We never see your password for those services. When you sign in, the provider sends us:
- your user ID with that provider,
- your email address, and whether the provider has verified it,
- your name,
- the address (URL) of your profile picture.
From Google we request the openid, email and profile scopes. From GitHub we request read:user and user:email and use only your primary email address. We store your account ID, email, name, profile picture URL, which providers you use, when you created your account and when you last signed in. If you sign in with a second provider that uses the same verified email, both are linked to one account. You can change your name in the dashboard.
Why: to create your account, sign you in and show you your instances. Legal basis: performance of a contract, Art. 6(1)(b) GDPR. We store the last sign-in time to detect misuse; the basis for that is our legitimate interest in security, Art. 6(1)(f) GDPR. Kept: until your account is deleted.
2.2 Your instances
For each instance we store the name you choose, its engine, its plan, region and creation time, and the password we generate for it.
Why: to provide the instance. Legal basis: Art. 6(1)(b) GDPR. Kept: until you delete the instance. Its password, storage and configuration are removed with it.
If you create API tokens, for each one we store the name you give it, its first characters, a one-way hash of it (never the token itself), when it was created, when it expires and when it was last used. Why: to let your scripts and AI tools act for you, and to show you which tokens are in use. Legal basis: Art. 6(1)(b) GDPR. Kept: until you delete the token or your account.
If you contact support from the dashboard, we store your request: its subject, the messages you and our support team write, the instance you chose (if any), when it was opened and closed, and the rating and comment you give it. While answering, our support team can see your email address and that instance's settings and status, but never the data stored in it or its passwords. Why: to help you and to improve our support. Legal basis: Art. 6(1)(b) GDPR. Kept: until you delete your account.
2.3 Data you store in your instances
We do not look at, analyse or use the data you put into your instances. If it contains personal data, we process it only on your behalf and on your instructions, as a processor under Art. 28 GDPR. You remain the controller for that data. Business customers can request a data processing agreement at legal@kvnest.com.
2.4 Technical data
To deliver web pages and database connections, our servers process your IP address while the connection is open. We keep no access logs containing IP addresses. Our application logs record your account ID, the requested path, the result and the timing of each dashboard request, plus a random request ID.
Why: to operate the service, find faults and protect it from abuse. Legal basis: our legitimate interest in a secure, working service, Art. 6(1)(f) GDPR. Kept: 30 days, then deleted automatically.
2.5 Analytics, only with your consent
If you allow it in the cookie banner, we use Google Analytics 4 to understand how the website is used: which pages are visited, where visitors come from, and the type of device and browser. Google Analytics sets cookies with a random identifier and derives an approximate location from your IP address; Google Analytics 4 does not store IP addresses. We have turned off advertising features, so the data is not used for ads. If you decline, the Google Analytics script is never loaded.
Legal basis: your consent, Art. 6(1)(a) GDPR and Art. 11.7a of the Telecommunicatiewet. Kept: at most 14 months in Google Analytics. Processor: Google Ireland Limited, under Google's data processing terms. You can withdraw your consent at any time, as easily as you gave it, . Withdrawing deletes the analytics cookies; it does not affect processing before that.
3. Cookies and local storage
Without your consent, we only store what the website needs to work, or what you ask for:
| Name | Purpose | Lifetime |
|---|---|---|
kvnest_session | Keeps you signed in. Encrypted, so only our server can read it. | 7 days, or until you sign out |
nuxt-auth-state | Protects sign-in against forged requests. | 10 minutes |
kvnest-login-redirect | Returns you to the page you came from after signing in. | 10 minutes |
kvnest-tutorial-lang | Remembers the programming language you picked in the tutorials. | 1 year |
nuxt-color-mode (local storage) | Remembers your light or dark mode choice. | Until you clear it |
kvnest-analytics-consent (local storage) | Remembers whether you allowed analytics, so we don't ask on every visit. | Until you clear it |
kvnest-tutorial-<track> (local storage) | Your tutorial progress: completed levels, achievements and XP. Never sent to us. | Until you clear it or reset your progress |
kvnest:metrics-range (local storage) | Remembers the time range you picked for instance metrics in the dashboard. | Until you clear it |
These are strictly necessary for a service you asked for, so they need no consent (Art. 5(3) of the ePrivacy Directive 2002/58/EC, and in the Netherlands Art. 11.7a(3) of the Telecommunicatiewet). Fonts and icons are served from our own servers.
Only if you accept analytics (see 2.5):
| Name | Purpose | Lifetime |
|---|---|---|
_ga | Google Analytics: distinguishes visitors with a random ID. | 13 months |
_ga_<ID> | Google Analytics: keeps the state of the current visit. | 13 months |
We use no advertising or cross-site tracking cookies.
4. Who receives your data
- Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, hosts our servers in Germany. Hetzner acts as our processor under a data processing agreement (Art. 28 GDPR).
- Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and GitHub (GitHub, Inc., 88 Colin P. Kelly Jr. St., San Francisco, CA 94107, USA) run the sign-in when you choose them. They process your data as independent controllers under their own privacy policies (Google, GitHub).
- Google Analytics (Google Ireland Limited), only if you consent, as our processor (see 2.5).
- Your profile picture is loaded by your browser directly from Google or GitHub. That request sends your IP address to the provider whose account you used to sign in.
We do not sell or rent personal data, and we do not share it for advertising. We disclose data to authorities only when the law requires it.
5. Transfers outside the EU
We store your account and instance data in Germany. Google and GitHub may process sign-in data, and Google may process analytics data if you consent, in the United States. Both participate in the EU-U.S. Data Privacy Framework, covered by the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR).
6. Your rights
Under the GDPR you have the right to:
- get a copy of your personal data (Art. 15),
- have incorrect data corrected (Art. 16),
- have your data deleted (Art. 17),
- restrict how we process it (Art. 18),
- receive your data in a machine-readable format (Art. 20),
- object to processing based on our legitimate interests (Art. 21),
- withdraw your consent to analytics at any time (Art. 7(3)).
To use any of these, email legal@kvnest.com from the address of your account. We answer within one month (Art. 12(3) GDPR). To delete your account, ask us at that address; we then delete your account, your linked sign-in methods and all your instances, without undue delay.
You can also complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live or work, or where you think your rights were infringed. In the Netherlands this is the Autoriteit Persoonsgegevens.
7. Other information
- Is it required? We need a verified email from Google or GitHub to create your account. Without one you cannot use KVNest. Nothing else is required.
- Automated decisions: we make no decisions about you by automated means alone and do no profiling (Art. 22 GDPR).
- Security: connections to the website and to instances are encrypted with TLS. Every instance runs isolated in its own namespace, and only you can retrieve its password.
- Children: KVNest is not meant for anyone under 16.
8. Changes to this policy
When the service changes, we update this page and the date at the top. If a change materially affects how we use your data, we will tell you by email or in the dashboard before it takes effect.