Privacy Policy

1Who is responsible

The controller is Idlefy, a sole trader (Empresário em Nome Individual) established in Portugal, NIF PT321558472, Leiria, Portugal. Contact: privacy@idlefy.com. We have not appointed a data protection officer; that address reaches the person responsible.

Where the Service processes personal data contained in your cloud resource metadata (for example an owner's name in an instance tag) on your instructions, we act as your processor. That processing is governed by the data processing terms in section 16 of the Terms of Service, which bind both parties from the moment a Cloud Account is connected; a separately signed Data Processing Agreement prevails. Ask at hello@idlefy.com.

2Data we collect

• Account and organization data. Email address, display name, password hash (never the password), preferred language and time zone, notification preferences, organization name, your role and team assignments, who invited you and the name entered by the inviter. If you sign in with Google or your company's single sign-on, we receive your email, name and a provider user ID (Google scopes: openid, email, profile). If you link Slack or Telegram, we store your Slack user and workspace ID or your Telegram user ID. If an owner enables Dev Boxes, we record that acceptance of the Terms (the User, the time and the version of the Terms). If you use Dev Boxes, you can save SSH public keys, each with a name, to your account so you can choose them when you create a box; we keep them until you delete them or your account is deleted, and only you can see your saved keys in Idlefy.
• Billing data. Plan, subscription status, credits and invoices are managed by our payment partner Polar, which collects your billing name, address and payment method under its own privacy policy. We store only a Polar customer reference and subscription status; we never see or store card numbers.
• Cloud resource metadata. For the Cloud Accounts you connect: instance IDs, names, tags and labels, instance type, region and zone, state, launch time, autoscaling group or cluster name, pricing data, and the usage signals exposed by your cloud provider's monitoring API (currently CPU utilization and network bytes in and out, hourly) for the audit window of 30 days. We do not access the contents of your instances, disks or network traffic. If you use Dev Boxes, we also store each box's settings (name, region, instance type, disk size, public-address choice, automatic deletion date, cost estimate), the SSH public keys and the source address ranges your Users enter, the cloud identifiers of the resources we create, and a log of each create and delete operation with the User who requested it. We pass the keys and address ranges to your cloud provider when the box is created; we never hold a private key.
• Usage and technical data. Actions taken in the Service (leases started, extended and ended; settings changed) with the channel used (web, Slack, Telegram, macOS widget, MCP or API), timestamps, IP address (also shown to you as a suggested source address when you create a Dev Box), browser and user agent, and server logs. Error reports contain a request path, stack trace and technical identifiers, without user identifiers.
• Support and chat. Messages you send to support and to the website chat, including any text you type.
• Website analytics. Page URL, referrer, browser and device class, country derived from the IP address. See section 7 for how this is collected.
• Partner attribution. If you arrive via a partner link, the partner code and optional campaign tag stored in a cookie and, on sign-up, linked to your organization.

Account and sign-in details are required to have an account, and cloud resource metadata is required for anything that touches a Cloud Account; without them the corresponding features do not work. Billing details are collected by Polar at checkout as needed to complete a purchase and meet tax rules. Slack, Telegram, the website chat and the macOS widget are optional; not using them withholds only their data.

3Why, and on what legal basis

Where we rely on legitimate interest, the interest is ours and the Customer's in running the Service for the organization that subscribed, in keeping it secure, in understanding how the website is used, and in paying partners for referrals. We have weighed these against your rights, and you can object as described in section 10.

We do not sell personal data, do not use it for advertising, and do not train machine-learning models on your data. We make no decisions with legal or similarly significant effects by automated means.

4Recipients and sub-processors

People in your own organization also see data about you: owners and administrators see your membership, role and Service activity to the extent their role allows, and the notification channels your organization configures (Slack, Telegram, email) receive the lease and idle notifications those features send.

We may also disclose data when required by law, to protect rights and safety, or to a successor if the business is transferred, with notice. We update this table before adding a sub-processor that processes customer data.

6Retention

7Cookies and similar technologies

• Essential: authentication and session cookies on app.idlefy.com, needed to log in. No consent is required for these.
• Partner attribution: if you follow a partner link, a first-party cookie idlefy_ref is set for 60 days so the partner can be credited if you sign up. It is not set otherwise, and it does not track you across sites. The attribution recorded at sign-up is kept as described in section 6; you can object to it at any time by writing to the address in section 10.
• Local storage: the website chat keeps your conversation in your browser's local storage; the app stores interface preferences. You can clear both in your browser.
• Analytics: we use Umami, a privacy-focused tool that we host ourselves; it sets no cookies and does not track you across sites, and IP addresses are not stored.
• We do not use advertising or cross-site tracking cookies.

8International transfers

We host the Service in the EU. Some recipients in section 4 are in the United States, as is our own error-monitoring server, which receives technical data only. Transfers to the US recipients rely on the EU-US Data Privacy Framework where the recipient is certified, or on the European Commission's Standard Contractual Clauses, with additional measures where needed. Copies of the safeguards are available on request.

9Security

TLS 1.2+ for all connections, encryption at rest for the database, keyless access to your cloud with the default setup (short-lived OIDC and Workload Identity tokens; a legacy encrypted-key mode remains available), least-privilege IAM scoped to enabled instances and, for Dev Boxes, a separate optional role limited to the regions, instance types and disk sizes you allow, which cannot reach inside a machine, and access controls and logging on our side. No method is perfect; we will notify you and, where required, the CNPD of personal-data breaches as the GDPR requires.

10Your rights

You have the right to access, rectify, erase, restrict and object to processing of your personal data, to data portability, and to withdraw consent where processing is based on consent (withdrawal does not affect processing carried out before it). Where we rely on legitimate interest, including partner attribution and the weekly digest, you may object on grounds relating to your particular situation, and we stop unless we have compelling legitimate grounds. Each right is subject to the conditions in the GDPR. Write to privacy@idlefy.com; we respond within one month. You may also lodge a complaint with the Portuguese supervisory authority, Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, cnpd.pt, or with the authority of your residence.

If you are a User invited by a Customer organization, some requests (for example deleting analytics that belong to the organization) are handled together with that organization.

11Children

The Service and website are not directed at children under 16, and we do not knowingly collect their data.

12Changes

We post changes here with a new date. For material changes we email organization owners and show a notice in the Service to everyone affected at least 30 days before they apply, and we always tell you before using your data for a new purpose.