Privacy policy
This policy explains what personal data Beyond Cloud (“we”, “us”) handles when you visit usebey.com, use the dashboard at app.usebey.com, the API at api.usebey.com or the Android app, and what you can do about it. We have written it in plain language. If something is unclear, email [email protected].
The short version
- We collect what we need to run your account and your clusters, and nothing for advertising.
- We don't sell personal data or share it for advertising.
- This marketing site sets no cookies and runs no analytics or tracking scripts.
- Cloud provider tokens you give us are encrypted at rest with AES-256-GCM.
- You can ask us to export or delete your data at any time.
What we collect
| Data | Why |
|---|---|
| Account details: name, email address, a hashed password, and, if you sign in with a third-party identity provider, the identifier that provider gives us | To create your account, sign you in and contact you about it |
| Workspace data: workspace names, members and their roles | To share access with your team |
| Credentials you store, such as a Hetzner Cloud API token | To create and manage infrastructure in your cloud account on your instruction. Stored encrypted. |
| Infrastructure records: cluster names, regions, node counts, server IDs, IP addresses, endpoints, kubeconfigs, Talos configuration, and workflow history and logs | To provision, show and manage your clusters |
| Technical logs: IP address, browser or app version, request times and errors | To keep the service secure and working, and to debug problems |
| Messages you send us | To answer you |
The dashboard stores your sign-in token and display preferences in your browser's local storage. These are not used for tracking.
Who processes data for us
We use a small number of service providers. Each one only gets the data it needs to do its job for us:
- Cloudflare serves this website and our app downloads, and processes request data such as IP addresses to do that.
- Cloud infrastructure providers host our API, database and backups.
- Sentry receives error reports from the dashboard when it crashes. These can include the page you were on, your browser version and your user ID.
- An email delivery provider sends account emails on our behalf.
Your cloud provider. When you create a cluster, we call the Hetzner Cloud API with your token to create resources in your Hetzner account. Hetzner handles that data under your own agreement with Hetzner, not ours.
We may disclose data if the law requires it, or to protect the security of the service or its users. If Beyond Cloud is ever acquired, this policy will continue to apply to data collected under it.
How long we keep it
We keep account, workspace and infrastructure data for as long as your account exists. When you delete a cluster, we remove its provider resources and its records. Technical logs are kept for a limited period for security and debugging, then deleted. When you ask us to delete your account, we delete your personal data within 30 days, unless the law requires us to keep part of it.
Security
Traffic to our services is encrypted with TLS. Passwords are stored hashed, never in plain text. Credentials you store are encrypted with AES-256-GCM. Access to production systems is limited to the people who operate them. No system is perfectly secure. If we learn of a breach that affects your data, we will tell you without undue delay.
Your choices and rights
You can ask us to give you a copy of your data, correct it, export it, restrict how we use it, or delete it. Email [email protected] from the address on your account. Depending on where you live, for example in the EU, UK or California, you may have additional rights, including the right to complain to your data protection authority. We will not treat you differently for exercising them.
International transfers
Our service providers may process data in countries other than yours. Where the law requires it, we rely on appropriate safeguards such as standard contractual clauses.
Children
Beyond Cloud is a tool for professionals. It is not directed at children under 16, and we don't knowingly collect their data.
Changes
If we change this policy, we will update the date at the top. If a change is significant, we will also tell account holders by email or in the dashboard before it takes effect.
Contact
Questions or requests: [email protected].