Privacy Policy (v1)

Effective date: 1 September 2026

Version v1; archived, never edited in place.

The honest summary: we store the minimum needed to run a prepaid cloud, Stripe handles your card, there is no tracking anywhere, and you can export or delete everything yourself through the API.

Controller and processor

TIMY LLC, a limited liability company organized under the laws of the State of California, United States, at 15090 Kensington Park Dr #430-145, Tustin, CA 92782. It owns and operates AGIdock. Contact: hello@agidock.cloud.

For your account, billing and usage data we are the controller: we decide what is collected and why, and the rest of this policy describes it. For what you put on your VMs and volumes and send through the mail relay, **you are the controller and we are only processing it for you** — on your instruction, plus the automated spam scoring of outbound mail and the legal process described below. What that content is, and whose personal data is in it, is yours to know and to answer for.

What we store, and why

• Account data: your email address, TOTP enrollment, API key hashes, session records, and the ToS/AUP version you accepted. Basis: contract.
• Billing data: credit ledger, usage records (which VM used how many vCPU-hours, per hour), top-up history. Payments are processed by Stripe; we store a Stripe customer reference, payment status, and a description of the card you saved — brand, last four digits, expiry, funding type, issuing country, and the cardholder name — so the dashboard can tell you which card is on file rather than only that one is. We also keep two things you are not shown back: Stripe's fingerprint for the card, an identifier that is the same for the same card number, and the billing address you entered with it. We use both to notice one person funding several accounts, and they are visible only to our staff. **The card number and the security code never touch our systems** (see Stripe's privacy policy). Removing the card removes all of this. Basis: contract; legitimate interest (abuse prevention) for the fingerprint and the billing address; plus California and US federal record-keeping law for retention.
• Operational logs: API access logs and service logs, containing IPs and request metadata. Kept 90 days, then deleted. Basis: legitimate interest (security, abuse prevention, debugging).
• Abuse data: signals, scores, and case records where triggered (including third-party abuse reports about your resources). Basis: legitimate interest and legal obligation.
• Your VM and volume contents and relayed mail: stored/transmitted to provide the service; we process them only on your instruction, for automated abuse scoring of outbound mail (spam filtering), or under legal compulsion. We do not read, mine, or train on your data.

What we don't do

No analytics scripts, no tracking pixels, no ad tech, no sale or sharing of personal data for marketing. Two companies other than us touch your data, and only for the job named:

• Stripe — payments, as described above.
• Cloudflare — terminates TLS for our public endpoints and passes requests to us, so it sees the IP address and request metadata of every request to the site, the API and the dashboard.

Everything else is ours: the machines that run your VMs sit in a single facility in Los Angeles, and a small rented server elsewhere serves the public site when that facility is unreachable. Its web logs follow the same 90-day retention as ours.

The dashboard sets only cookies that are strictly necessary to operate it: an encrypted session cookie so you stay signed in, a short-lived login CSRF token, and a one-shot cookie carrying a newly minted API key across a single redirect. All are HttpOnly and Secure, none is read for analytics or advertising, and the public site sets none at all.

Where

All infrastructure is in a single region: **Los Angeles, California, United States**, and we are a US company, so that is where everything we hold is processed. If you are in the EEA or the UK, signing up sends your data to the United States and keeps it there. Stripe processes payments on its own infrastructure under its own terms and safeguards.

How long

• Account and billing records: life of the account, then seven years for the financial records US and California tax rules expect us to keep.
• Logs: 90 days.
• VM/volume contents: deleted with the resource (zero-balance lifecycle: stop after 7 days, deletion no earlier than 30 days after that).
• Account deletion: DELETE /v1/account with a 14-day grace window, then credentials are revoked, resources removed, and personal data erased except what financial-record law requires us to keep.

Security

The safeguards are the ordinary ones, kept honestly: TLS on everything public, API keys stored only as hashes, TOTP on the account, production access limited to the people who operate the service and logged when used. None of that is a guarantee, so the commitment that matters is the other one: **if a breach affects your personal data we will tell you and the relevant regulator without undue delay**, with what we know at the time and what we are doing about it.

Legal process

We answer subpoenas, court orders and other legal process that is valid and binding on us, and we give up nothing beyond what it actually demands. Where we are lawfully allowed to, we tell you first, so you can respond — the exceptions we cannot get around are gag orders and emergencies involving a risk to someone's life.

Your rights (GDPR)

Access, rectification, erasure, restriction, portability, objection — most of them self-service and immediate:

• Export: POST /v1/account/export returns everything we hold on you in machine-readable form.
• Erasure: DELETE /v1/account (grace period above).
• Everything else, or if the API can't express your request: hello@agidock.cloud. You can also complain to the supervisory authority where you live or work.

California residents

The same rights, under the CCPA as amended: know what we hold, have it corrected or deleted, and receive it in a portable form — the export and deletion endpoints above do all three immediately, and hello@agidock.cloud covers anything they cannot express. **We do not sell or share personal information**, and we run no financial-incentive programme, so there is nothing to opt out of and nothing you could be treated differently for asking about.

Children

AGIdock is sold to businesses and professionals. It is not directed to children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, write to hello@agidock.cloud and we will delete it.

Changes

New versions get a new URL and email notice at least 30 days before taking effect; this v1 stays archived at its versioned URL.