Privacy Policy

Effective Date: 10.11.2026

Version: 1.1

This Privacy Policy explains which personal data Sliplane processes when you visit our website, create an account, use the Sliplane dashboard or API, or contact us, why we process it, and which rights you have. Which trackers we use on the website, and how you control them, is described in detail in our Cookie Policy.

1. Controller and Contact

The controller responsible for the processing described here is:

Sliplane GmbH c/o ECOSIA Gerichtstraße 23, Innenhof 4 13347 Berlin Germany

Email: support@sliplane.io

You can contact us at this address with any question about data protection or to exercise your rights.

If you run workloads, databases or other content on Sliplane, we process the personal data contained in them on your behalf as a processor. That processing is governed by our Data Processing Agreement, not by this Privacy Policy.

2. Overview

Purpose	Typical data	Legal basis
Delivering the website and keeping it secure	IP address, browser and device information, requested pages, time of access	Legitimate interest (Art. 6(1)(f) GDPR)
Account, sign-in and providing the service	Name, email address, GitHub account data, team memberships, resources you create	Contract (Art. 6(1)(b) GDPR)
Payments, invoices and tax	Billing name and address, VAT ID, payment information, invoices	Contract and legal obligation (Art. 6(1)(b) and (c) GDPR)
Service and account emails	Email address, account and usage information	Contract (Art. 6(1)(b) GDPR)
Product news and marketing emails	Email address, name	Consent (Art. 6(1)(a) GDPR) or, for existing customers, legitimate interest (Art. 6(1)(f) GDPR)
Support and live chat	Messages, contact details, technical information you share	Contract or legitimate interest (Art. 6(1)(b) and (f) GDPR)
Records of legal acceptances and cookie choices	Choices made, document versions, time, IP address, browser fingerprint	Legal obligation and legitimate interest (Art. 6(1)(c) and (f), Art. 7(1) GDPR)
Infrastructure monitoring and abuse prevention	Logs, metrics, IP addresses, technical identifiers	Legitimate interest (Art. 6(1)(f) GDPR)
Analytics	Usage data, trackers	Consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG)
Advertising, conversion measurement and remarketing	Usage data, trackers, ad click identifiers, hashed email address	Consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG)

The sections below describe each of these in detail.

3. Visiting the Website

When you open sliplane.io, your browser automatically sends technical information to our servers and to our content delivery network: your IP address, the date and time of the request, the page requested, the referring page, the HTTP status code, the amount of data transferred, and your browser and operating system. We need this data to deliver the website, to detect and fend off attacks, and to fix errors. Our legitimate interest lies in operating a secure and working website (Art. 6(1)(f) GDPR).

We deliver the website through Bunny CDN (BunnyWay d.o.o., Slovenia), which processes the request data on our behalf to serve content quickly from servers close to you.

Server logs are deleted or anonymised after a short period, usually within 30 days, unless we need a specific log entry longer to investigate a security incident.

4. Your Account

Registration and Sign-in

You sign in to Sliplane with your GitHub account (GitHub OAuth, GitHub Inc., USA). When you do, GitHub shares your GitHub user name, user ID, email address and profile picture with us. If you grant access to repositories, we also process the repository information needed to build and deploy your services. We process this data to create and run your account and to provide the service (Art. 6(1)(b) GDPR).

Using the Service

When you use Sliplane, we process the data needed to provide it: your account and team details, invitations, the servers, services, databases and other resources you create, their configuration, deployment and audit events, and the IP addresses from which you access the dashboard and the API. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in keeping the platform secure and preventing abuse (Art. 6(1)(f) GDPR).

When you sign up, we may also store how you found us: the campaign parameters (UTM parameters), the referring website and the landing page of your first and most recent visit. If you consented to marketing trackers, this also includes the click identifiers that ad networks append to their links (for example gclid or rdt_cid). We use this to understand which channels bring customers to Sliplane (Art. 6(1)(f) GDPR, and Art. 6(1)(a) GDPR for click identifiers).

Records of Your Acceptances

When you accept our Terms of Service, our Fair Use Policy, the Data Processing Agreement or another legal document, we record which document and which version you accepted, when, and from which IP address and browser fingerprint (a JA4H hash derived from your browser's request headers). When you make or change a choice in our cookie banner, we record that choice in the same way, together with a random identifier stored in your browser. We keep these records to be able to prove the acceptance or consent (Art. 7(1) GDPR; Art. 6(1)(c) and (f) GDPR).

5. Payments

Payments are handled by Stripe (Stripe Payments Europe, Limited, Ireland). You enter your payment details directly with Stripe; we do not see or store full card numbers. Stripe shares with us the data needed for billing, such as your name, billing address, email address, the payment method type and its last digits, and your purchase history. We use this data to bill you, to prevent fraud and to meet our accounting and tax obligations (Art. 6(1)(b) and (c) GDPR).

Invoices and accounting records are kept for the periods required by commercial and tax law, generally 8 to 10 years (§ 147 AO, § 257 HGB).

6. Emails

We send emails about your account and the service, such as sign-in and security notices, billing information, deployment and resource notifications, and important changes to our terms. These emails are part of the service (Art. 6(1)(b) GDPR). You can adjust which notifications you receive in your account settings, except for messages we must send to you.

We may also send you onboarding tips, product news and offers. We do this with your consent (Art. 6(1)(a) GDPR) or, if you are already a customer, for similar services of our own based on our legitimate interest (Art. 6(1)(f) GDPR, § 7(3) UWG). You can unsubscribe at any time using the link in every such email; this does not cost anything beyond the basic transmission rates.

We deliver emails through Amazon SES (Amazon Web Services EMEA SARL, Luxembourg). We may measure whether an email was opened or a link was clicked, to improve our emails.

7. Support and Live Chat

When you contact us by email or through the chat on our website, we process the content of your message, your contact details and any technical information you share, to answer your request (Art. 6(1)(b) GDPR for customer requests, otherwise Art. 6(1)(f) GDPR).

The chat on our website is provided by Crisp (Crisp IM SARL, France), which processes the chat on our behalf. We use Crisp in its Total Privacy Mode: the chat button is loaded from Crisp's servers, which transmits your IP address and browser information, but no chat session is started and no trackers are stored in your browser until you open the chat yourself (Art. 6(1)(f) GDPR). When you open it, Crisp stores an identifier for your chat session in your browser, which is strictly necessary to provide the chat you asked for (§ 25(2) no. 2 TDDDG). You can also reach us by email at any time.

8. Hosting, Infrastructure and Monitoring

Our Own Systems

We run the Sliplane website, dashboard and API, and store the data described in this policy, on the infrastructure of the following providers, each of which processes data on our behalf under a data processing agreement:

Hetzner Online GmbH (Germany): servers and data storage in Germany and Finland.
Impossible Cloud GmbH (Germany): encrypted backups of our databases, stored in Frankfurt, Germany.
Grafana Labs (Grafana Cloud): monitoring of our infrastructure, which can include IP addresses and technical identifiers in logs and metrics.

The legal basis is our legitimate interest in running a reliable and secure platform (Art. 6(1)(f) GDPR).

Resources You Create

For each server, database and storage bucket you create, you choose the region. Where the data in it is processed depends on that choice:

EU regions (Germany, Finland and Germany (Confidential)): the data is processed only in the European Union, and only by providers based in the European Union.
Regions outside the EU (United States and Singapore): the data is processed in that country by the infrastructure provider for the region, with the safeguards described in section 13.

We process the data in your resources on your behalf, as a processor. Our Data Processing Agreement lists the providers for each region.

9. Cookies and Similar Technologies

We use cookies and similar technologies ("trackers") on our website. Trackers that are strictly necessary to provide the website and the service, such as the session cookie that keeps you signed in or the cookie that stores your cookie choices, are always active (§ 25(2) no. 2 TDDDG; Art. 6(1)(b) and (f) GDPR).

All other trackers are only used with your consent (§ 25(1) TDDDG; Art. 6(1)(a) GDPR). You choose in our cookie banner which of the following categories to allow:

Measurement: analytics that show us how the website is used.
Marketing: advertising, conversion measurement and remarketing.

You can change or withdraw your choices at any time through the "Cookie settings" link in the footer of our website. Withdrawing consent does not affect the lawfulness of processing before the withdrawal. The Cookie Policy lists every tracker, its provider and its storage period.

We use Google Tag Manager (Google Ireland Limited / Google LLC) to manage the scripts on our website. We load it only after you allowed measurement or marketing trackers; until then, your browser does not connect to it. Google Tag Manager itself does not set cookies for us, but when it loads, your browser connects to Google's servers.

10. Analytics

With your consent to measurement trackers we use:

Meta Events Manager (Meta Platforms Ireland Limited / Meta Platforms, Inc.): insights into traffic and interactions on our website, based on the Meta pixel.
Visit records (Sliplane): with your consent to measurement or marketing trackers, your browser sends us where each page load came from (page, time, UTM parameters, external referrer). We store a record when it is your browser's first or names a new source, linked to your consent record and, once you sign in, to your account.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

11. Advertising and Conversion Measurement

With your consent to marketing trackers, we use the services below to measure whether our ads lead to sign-ups and purchases, to show our ads to people who may be interested in Sliplane, and to show ads to people who have visited our website before. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Google Ads (Google Ireland Limited / Google LLC): conversion tracking, remarketing, Optimized Targeting and Smart Bidding. With enhanced conversions, we send a hashed (pseudonymised) version of the email address of signed-in users to Google to match conversions more accurately.
Meta (Meta Platforms Ireland Limited / Meta Platforms, Inc.): the Meta pixel for conversion tracking, Custom Audiences, Lookalike Audiences, the Audience Network and lead ads. With Custom Audiences, a hashed version of your email address can be matched against Meta accounts.
Reddit Pixel (Reddit, Inc., USA): conversion tracking and targeted ads on Reddit. The pixel collects page views, actions on our website, your IP address and browser information.
OpenAI Ads (OpenAI Ireland Ltd. / OpenAI, L.L.C.): measurement of the actions you take after interacting with an ad shown in ChatGPT or other OpenAI services. An attribution identifier from the landing page link is stored in a first-party cookie; events such as sign-ups and purchases can also be sent from our servers.

We also send conversion events from our servers: sign-ups, purchases and upgrades of servers, databases and storage buckets, and the first payment method. This way they are measured reliably, also when you use Sliplane through our API, CLI or MCP server. For this, our visit records also store the ad click identifiers from ad links and the browser identifiers set by the providers' scripts, linked to your consent record and your account. The events contain these identifiers, a hashed version of your email address and user ID, the product and monthly price of a purchase, and your IP address and browser information if the event came from a request. We do all of this only if you have allowed marketing trackers, and we stop when you withdraw that consent; records stored before stay as stated in section 14. The Cookie Policy describes the details.

These providers may combine the data with other data they hold about you and use it for their own purposes, for which they are responsible themselves. You can find out more, and object to personalised advertising, in the settings of your Google, Meta and Reddit accounts and on the opt-out pages listed in our Cookie Policy.

12. Recipients

Inside Sliplane, only the people who need your data for their work have access to it. Outside Sliplane, we share personal data only with the providers named in this policy, who mostly act as our processors under a data processing agreement, with tax advisers and auditors who are bound to confidentiality, and with authorities where we are legally obliged to do so. We do not sell your personal data for money.

13. Transfers Outside the EU

Some of the providers named in this policy are located in, or access data from, countries outside the European Union and the European Economic Area, in particular the United States. Where the European Commission has not decided that a country provides an adequate level of data protection, we protect the transfer with the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). For US providers that are certified under the EU-U.S. Data Privacy Framework, the transfer is based on the Commission's adequacy decision (Art. 45 GDPR). You can request a copy of the safeguards from us.

14. How Long We Keep Your Data

We keep personal data only as long as we need it for the purpose for which we collected it. In particular:

Account data is kept for as long as your account exists, and deleted when you delete your account, unless we must keep it longer for legal reasons.
Invoices and accounting records are kept for 8 to 10 years, as required by commercial and tax law.
Records of legal acceptances are kept for as long as the accepted agreement applies and for the statutory limitation period afterwards (generally three years from the end of the year in which the agreement ended).
Records of cookie choices are kept for three years after the choice was made.
Visit records, including the ad click and browser identifiers they contain, are kept as long as your account exists. Records of a browser that never signed in are deleted 12 months after its last cookie choice.
Server logs are deleted or anonymised after a short period, usually within 30 days.
Data processed based on your consent is kept until you withdraw your consent or the purpose ceases to apply.

The storage periods of trackers are listed in our Cookie Policy.

15. Your Rights

Under the GDPR, you have the right to:

access the personal data we hold about you (Art. 15 GDPR);
have inaccurate data corrected (Art. 16 GDPR);
have your data deleted (Art. 17 GDPR);
restrict the processing of your data (Art. 18 GDPR);
receive your data in a structured, commonly used and machine-readable format, and have it transferred to another controller (Art. 20 GDPR);
withdraw your consent at any time with effect for the future (Art. 7(3) GDPR); for trackers, use the "Cookie settings" link in the footer of our website;
lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), but you can also contact the authority in the place where you live or work.

Right to object (Art. 21 GDPR): Where we process your data based on our legitimate interest, you can object to the processing at any time on grounds relating to your particular situation. Where we process your data for direct marketing, you can object at any time without giving reasons, and we will then stop processing it for that purpose.

To exercise your rights, write to support@sliplane.io. We answer without undue delay and within one month at the latest. We may ask you to confirm your identity before we act on a request.

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).

You are not legally or contractually required to provide personal data. However, we cannot create an account or provide the service without the data needed for it.

16. Users in Switzerland

If you are in Switzerland, the Swiss Federal Act on Data Protection (FADP) also applies. You have the right to access your personal data, to have incorrect data corrected, to object to the processing of your data (including asking us to stop processing, delete your data or not disclose it to certain third parties), and to receive your data in a portable format. Send your request to support@sliplane.io.

17. Users in the United States

If you live in a US state with a consumer privacy law (such as California, Virginia, Colorado, Connecticut, Utah or Texas), the following applies in addition.

Categories of personal information. In the past 12 months, we collected the categories of personal information described in sections 3 to 11: identifiers (such as name, email address, IP address and online identifiers), commercial information (such as purchase history), internet and network activity (such as pages viewed and interactions with our website and ads), and, through our payment provider, payment information. We collect this information from you directly, automatically when you use our website, and from GitHub when you sign in.

Selling, sharing and targeted advertising. We do not sell personal information for money. However, if you allow marketing trackers, the transfer of identifiers and activity data to advertising partners (section 11) may count as "selling" or "sharing" for cross-context behavioural advertising, or as "targeted advertising", under some state laws.

Your rights. Depending on your state, you have the right to know and access the personal information we hold about you, to correct it, to delete it, to receive a copy in a portable format, to opt out of the sale or sharing of your personal information and of targeted advertising, and to limit the use of sensitive personal information. We will not discriminate against you for exercising these rights.

How to opt out. You can opt out at any time by rejecting marketing trackers through the "Cookie settings" link in the footer of our website. We also treat a Global Privacy Control (GPC) signal sent by your browser as a valid request to opt out.

How to make a request. Write to support@sliplane.io. We need to verify your identity before we respond. You can make a request through an authorised agent. If we deny your request, you can appeal by replying to our decision.

18. Users in Brazil

If you are in Brazil, the Lei Geral de Proteção de Dados (LGPD) also applies. We process your personal information on the legal bases described in this policy: your consent, the performance of a contract with you, compliance with legal obligations, the exercise of rights in legal proceedings, and our legitimate interests where your fundamental rights do not prevail. You have the right to confirmation of processing, access, correction, anonymisation, blocking or deletion of unnecessary data, portability, information about the third parties we share data with and about the consequences of refusing consent, withdrawal of consent, and to file a complaint with the ANPD. Send your request to support@sliplane.io.

19. Changes to This Privacy Policy

We update this Privacy Policy when our processing or the law changes. The current version is always available on our website, and the version and effective date at the top show when it last changed. If a change affects processing that is based on your consent, we will ask for your consent again where required.