Data export and account deletion

This page describes the tools in the panel. The privacy notice is at privacy. Time limits below are our current settings and may change before launch.

Export your data

• Ask under Account, Privacy for a zip of JSON files with your own data. An organisation owner or admin can ask for the organisation's data too. It needs a signed-in browser session (never an API token) and a recent password check. At most three requests a day, one at a time.
• We email you when it is ready. The download link is made when you click, is valid for five minutes, works once and only in the session that made it. The archive is kept for seven days, then deleted.
• It holds your profile, preferences, sessions, memberships, your own audit events, tickets you opened, SSH keys and API token details. For an organisation: details, members, billing profile, servers, invoice references, tickets, keys, webhooks and activity.
• It never holds passwords or hashes, authenticator secrets, recovery codes, passkey credentials, token secrets, webhook secrets, your servers' user-data and scripts, staff notes, other customers' data or card details. A manifest in the archive lists every file with a checksum and says what was left out.

Delete your account or an organisation

You can ask to delete your account, or, as an owner, an organisation (not a personal organisation on its own). It needs a signed-in browser session, a recent password check and typing your sign-in email or the organisation's name.

What must be cleared first

The request is refused, with the reasons listed, while any of these is in the way:

• A server that is not destroyed, or was destroyed less than 72 hours ago.
• Any volume, floating IP, private network, snapshot or ISO. These are yours to delete first; nothing is deleted for you.
• Backups that still exist, or a restore in progress. Backups of a destroyed server go after their retention.
• An order or payment in flight, a billing question with support, an open quote or plan change.
• Money owed or in flight, an open dispute, or credit on the account (support refunds it first).
• You are the only owner of an organisation with other members: hand it on or delete it first. Staff accounts are not deleted this way.

The waiting period

If nothing blocks it, the request waits a grace period (currently 14 days). You, and for an organisation its owners and admins, are emailed. You can cancel at any moment without a password check, and nothing is erased while you wait. At the end we check again, and if something is in the way the request is marked blocked and you are told.

What deletion does

• Deleted: members, invitations, SSH keys of the erased organisation, webhooks, organisation variables, startup scripts and user-data, authenticator app, recovery codes, passkeys, sessions, email preferences and mail sent to the old address.
• Kept, because the law requires it: invoices and credit notes, the ledger, tax records, payments, refunds and disputes, and the service and subscription history.
• Your name and email on remaining records are replaced where that is allowed.

Honest limits

• Database backups and off-site copies keep erased data until each copy expires. We do not edit a backup. If we ever restore from a backup older than your deletion, we re-run deletions made since.
• The payment provider keeps what card-scheme and tax rules require. Cards are detached from your account, but deleting the provider's record is not built yet.
• Our audit log is append-only. It keeps your account's internal id and, for requests you made, the address they came from.
• Mail you already received and files you downloaded are yours and stay with you.

Other requests

For anything else, such as correcting data or a question about how it is used, email support@vexelia.com.