1. Who we are
ServersCamp is operated by ServersCamp S.R.L., a company registered in Romania. When this policy says "we", "us", or "ServersCamp", it means that company. When it says "you", it means the person or organisation using our services or visiting this website.
Contact for any privacy question: [email protected].
2. What we collect
Account information
- Email address (required to sign in and receive service notifications)
- Display name and any avatar image you upload
- Authentication identifiers from OAuth providers if you sign in with Google, GitHub, etc.
Billing information
- Company name, billing address, VAT/tax ID - needed to issue compliant invoices
- Card details are entered directly with our payment processor (Stripe). We never see or store full card numbers; we only store the last 4 digits and the card brand for display.
- Wire transfer details - when you pay by SEPA bank transfer, we see the standard bank reference fields visible on the transaction.
Service usage
- Resource usage metrics (CPU, RAM, disk, network bandwidth) - needed to bill correctly and to enforce quotas
- Audit record of important account actions (creating, modifying, or destroying resources; changing security settings) - kept while your account is active so you have a history of what happened, and so we can investigate abuse complaints
We do not currently run a centralised log collector. Application processes write to standard output inside their containers, but those streams are not aggregated, archived, or queryable. Once a container restarts, those lines are gone.
HTTP request metadata is observed by our reverse proxy provider, Cloudflare. We also temporarily store first-party product analytics such as your IP address, browser and device information, pages visited, referrer, campaign parameters, clicks, form submissions (form names and actions, not entered values), scroll depth, and session activity. If you sign in, these events may be associated with your user and organisation.
Network abuse monitoring
Traffic leaving our network passes sensors that look for known attack patterns: contact with cryptocurrency mining pools, port scans, brute-force attempts, high-rate automated crawling, outbound spam, and traffic floods. This is pattern matching on network behaviour, not reading your data. Nothing at all is recorded for traffic that matches nothing, which is almost all of it.
When a pattern does match, we record:
- The time, which of your machines the traffic came from, the destination address and port, and which rule fired
- The protocol involved, and where the connection carries them in the clear: the hostname and path requested, the client identifier your software sends (the User-Agent), the method and response code
- For encrypted connections, the server name and certificate details the connection announces before encryption starts. We do not decrypt anything.
- For domain lookups, the name that was queried
We record these because a rule number on its own cannot be checked or argued with. When we act on a match, you get the same lines we did, so you can compare them against your own logs and tell us we are wrong. Request bodies, payloads, headers beyond the ones listed, credentials and cookies are never captured.
We use these records to stop attacks that originate on our platform, to answer abuse complaints, and to enforce the acceptable use rules in our terms of service. On trial accounts a match can suspend the account automatically, or open a support ticket asking you to explain the traffic, depending on how conclusive the pattern is: see section 2 of the acceptable use policy. The records are kept for 14 days and then deleted.
What we do NOT look at
We do not inspect the contents of your virtual machines, databases, or object storage. Block storage volumes are encrypted at rest. Object storage data is private by default. The only time we would access workload contents is if compelled by valid legal order, or if we have an active abuse complaint and need to verify it (e.g., to confirm reported phishing content). Even then, only authorised staff with audit logging.
Identity check (only if you choose it)
Some new accounts are offered a short identity check as one way to get the welcome credit. It is optional: the same account can start with a top-up or by contacting support instead. If you take the check, it runs on the site of our verification provider, Didit. You show an ID document to your camera and take a selfie with a short liveness video. Didit compares your face with the photo on the document and checks whether the same face already went through a check for another ServersCamp account.
This is biometric data. Didit processes it on our behalf, only to confirm that you are a real person holding that document and to stop one person from opening many accounts for the free credit. We do not receive the images or the face data. We receive only the result (approved, declined or under review), the document's country and type, and a note when the same face was seen on another account.
Support communications
When you contact us by email or chat, we keep the messages and any attachments you send. We use them to help you and to improve our docs.
Website and panel analytics
We operate our own first-party analytics on the marketing site and Cloud Panel. It helps us understand traffic sources, navigation, conversion, errors, and feature use. We use MaxMind GeoIP and minFraud to derive location, network, proxy or VPN indicators, device intelligence, and a fraud-risk score from login and signup traffic. MaxMind's fraud-prevention device tracking can recognise the same device across network changes and participating sites. We do not use this data for advertising.
3. Cookies
This site uses a small number of cookies. None of them are used for advertising or cross-site tracking.
- Session cookie - keeps you signed in to the dashboard. Deleted when you log out or after 1 hour of inactivity.
- CSRF token - prevents cross-site request forgery. Required for form submissions.
- Analytics visitor cookie (
sc_vid) - recognises repeat visits across our website and panel. Lasts up to 1 year. - Analytics session cookie (
sc_sid) - groups activity into a visit. Lasts 30 minutes and is extended while you are active. - MaxMind device identifier (
__mmapiwsid) - first- and third-party cookies plus local storage used to recognise devices for fraud prevention, including when an IP address changes. Lasts up to 2 years.
4. Sub-processors
To run the service we share specific data with the following companies. We've picked them because they are widely used, EU-friendly, and have their own published privacy commitments.
| Company | What it's used for | What it sees | Location |
|---|---|---|---|
| Stripe | Payment processing for cards | Card details, billing address, transaction amount | Ireland (EU) |
| Oblio | Romanian-compliant invoice generation | Billing name, address, VAT ID, line items | Romania (EU) |
| BCR (Banca Comercială Română) | Bank account for SEPA transfers | Standard bank-transfer metadata | Romania (EU) |
| Cloudflare | CDN, DDoS protection, reverse proxy | Public IP, request URL, headers, bytes transferred (kept on their systems for ~30 days) | Global edge network |
| Didit | Identity checks, only for people who choose one | Images of the ID document and the data on it, a selfie and a liveness video, the face data derived from them, IP address and device signals | Spain (EU) |
| MaxMind | IP geolocation, device intelligence, and fraud prevention | IP address, browser and device signals, language, account identifier, and login or signup context | United States (SCCs) |
We also run our own internal tooling (Grafana for metrics, OpenSearch for logs) on infrastructure we control. These are not third parties - your data does not leave our systems for those.
If we add or replace a sub-processor we'll update this list. For material changes we will notify you by email at least 14 days in advance so you can object.
5. How we use your data
- Operate the service - provision your VMs, store your files, route your traffic
- Bill you - calculate usage, generate invoices, charge cards, reconcile transfers
- Send transactional email - incident notifications, billing receipts, security alerts. You cannot opt out of these - they are required for the service.
- Send product updates - occasional emails about new features. You can opt out at any time from your account settings or via the unsubscribe link.
- Prevent abuse - detect and stop fraud, spam, malware, network abuse
- Comply with the law - respond to valid legal requests, fulfil tax and accounting obligations
6. Legal basis (GDPR)
If GDPR applies to you, we process your data on the following legal bases:
- Contract - most processing is necessary to provide the service you signed up for
- Legal obligation - accounting, tax, fraud prevention
- Legitimate interest - security, abuse prevention, basic product analytics, transactional communications
- Consent - optional marketing emails. You can withdraw at any time.
- Explicit consent (GDPR Article 9(2)(a)) - the identity check, which processes biometric data. You give it on the check's first screen, and you can start without the check instead. You can withdraw it at any time by writing to us; we then have the check deleted at Didit.
7. How long we keep data
- Account data - kept while your account is active. When you close your account, it is deleted immediately and irreversibly along with all your resources.
- Workload data (the contents of your VMs, databases, object storage buckets) - destroyed immediately and irreversibly when you delete the resource. We do not keep a backup or recovery copy. If you need point-in-time recovery, use our snapshots or PITR features while the resource is still alive.
- Billing and invoice records - we do not store these on our own systems. They are held by our payment processor (Stripe) and our invoicing partner (Oblio) under their own retention policies, driven by Romanian tax law (10 years for fiscal documents) and PCI compliance for card data. Deletion of those records is outside our control.
- Audit and usage records - kept while your account is active; deleted together with your account on closure
- Application logs - we do not collect them centrally; container stdout is ephemeral
- Cloudflare edge logs - retained by Cloudflare on their systems for roughly 30 days; we do not store them
- Network abuse records - the signature matches described above (time, source machine, destination, rule, and the connection metadata listed there) are kept for 14 days, then deleted automatically
- Identity checks - the document images and face data are kept by Didit for 12 months after the check, then deleted. They are not used to train Didit's models. On our side the result, the document's country and type, and a duplicate note are kept while the account exists.
- First-party analytics - visitor and session profiles expire after 2 days; daily aggregates and MaxMind results expire within 7 days; the realtime event stream is size-limited and older events are continuously discarded
8. Your rights
Under GDPR (and similar laws in many other countries) you have the right to:
- Get a copy of your personal data we hold
- Correct inaccurate data
- Delete your data ("right to be forgotten") - subject to our legal obligations to keep certain records
- Export your data in a portable format
- Object to processing based on legitimate interest
- Withdraw consent for marketing emails
- Lodge a complaint with your local data protection authority. In Romania this is ANSPDCP.
Email [email protected] with any of these requests. We'll respond within 30 days.
9. International transfers
Your data is hosted in EU datacenters by default. Some of our sub-processors (notably Cloudflare) operate global edge networks, which means request metadata (your IP, the URL you visited) may pass through servers outside the EU. Where data leaves the EU, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission.
10. Security
We take security seriously. Some of what we do:
- All website and API traffic is HTTPS-only with modern TLS
- Workload data on block storage is encrypted at rest
- Internal admin access requires SSO and is audit-logged
- Hardware lives in physically secure datacenters with controlled access
If you discover a security issue, please email [email protected] with the subject line "SECURITY". We will respond promptly.
11. Children
ServersCamp is not directed at children. We don't knowingly collect data from anyone under 16. If you believe a child has signed up, contact us and we'll delete the account.
12. Changes to this policy
If we make material changes we will notify you by email and post a banner on the site at least 14 days before the change takes effect. Minor edits (typos, clarifications, new sub-processors that don't change how we use your data) we'll update silently with a new "Last updated" date at the top of this page.
13. Contact
ServersCamp S.R.L.
Șos. Colentina 16, Bl. A5, Ap. B44
Sector 2, Bucharest 021177, Romania
CUI: 50730737
Nr. Reg. Com.: J2024032843002
EUID: ROONRC.J2024032843002
Email: [email protected]