1. Who We Are
Stavra Cloud is operated by Sylox Tech (OPC) Private Limited, Jharkhand, India. We are the data controller under the EU and UK General Data Protection Regulation ("GDPR") and the data fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") for the personal data described in this policy.
For any privacy question, write to [email protected].
2. Data We Collect
2.1 Data you give us
- Account: name, email address, password (stored only as a one-way hash), phone number if provided.
- Billing: billing address, billing country, company name and GSTIN if provided, invoices and payment records.
- Orders: server configuration, data-centre location, hostname, chosen operating system and SSH public keys.
- Support: the content of tickets, emails and contact-form messages.
2.2 Data collected automatically
- Technical: IP address, approximate country (from our network provider), browser and device type, login times.
- Security logs: sign-ins, two-factor events, failed logins and actions in your account.
- Usage: pages visited on our website and dashboard. Third-party analytics run only where described in section 10.
2.3 Data from others
- PayPal: payment status, transaction ID, payer name, payer email and country.
- Referrals: the referral code used when you signed up.
3. Why We Use It (Legal Bases)
| Purpose | Legal basis |
|---|---|
| Creating your account, provisioning servers, support | Performance of a contract (GDPR Art. 6(1)(b)); the specified purpose you gave it for (DPDP Act s.7(a)) |
| Invoicing, GST returns, accounting records | Legal obligation (GDPR Art. 6(1)(c); DPDP Act s.7(b) and (c)); CGST Act 2017, Companies Act 2013 |
| Fraud prevention, security, abuse handling | Legitimate interests in protecting our network and customers (GDPR Art. 6(1)(f)) |
| Service emails: invoices, reminders, security alerts, policy changes | Performance of a contract and legal obligation |
| Optional website analytics | Consent (GDPR Art. 6(1)(a); DPDP Act s.6), which you can withdraw at any time |
| Responding to lawful requests from authorities | Legal obligation |
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Data on Your Server
Files, databases and other content you store on your server are under your control. For any personal data in that content, you are the controller and we act only as your processor. We do not access, inspect or analyse it, except:
- when you ask us to in a support request;
- to investigate a specific abuse report under the Acceptable Use Policy; or
- when Indian law or a competent court or authority requires it.
Businesses that need a data processing agreement under GDPR Art. 28 can request one at [email protected].
5. Who We Share It With
We do not sell, rent or trade personal data, and we do not share it for advertising. We share it only with the service providers below, each bound by contract to use it only to provide its service to us:
| Provider | Purpose | Data |
|---|---|---|
| PayPal | Payment processing and refunds | Invoice amount and reference; PayPal collects your payment details directly |
| Mailgun | Sending service email; receiving ticket replies | Name, email address, message content |
| Cloudflare | Website security, DDoS protection and delivery | IP address, request metadata |
| Upstream data-centre providers | Supplying and operating your server | Technical order details only (configuration, location, hostname, OS, SSH public key). We place orders in our own name. |
| Our hosting infrastructure | Running this website and dashboard | All account data, stored on servers we control |
| Google Analytics, Microsoft Clarity | Website analytics, only when enabled | Pseudonymous usage data, IP address |
We also disclose personal data where required by law, a court order or a lawful request from a government authority; to our professional advisers, such as our chartered accountant, under a duty of confidentiality; and to a successor in the event of a merger or sale of the business, which remains bound by this policy.
6. International Transfers
We are based in India, and some providers listed above process data in other countries. Transfers from the EU or UK rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard offered by the provider. Transfers out of India comply with the DPDP Act and any restrictions notified under section 16.
7. How Long We Keep It
| Data | Retention |
|---|---|
| Invoices, payment and tax records | 8 years from the end of the financial year (Companies Act 2013 s.128; CGST Act 2017 s.36) |
| Account and order data | While the account is open, then deleted or anonymised within 90 days of closure |
| Support tickets | 3 years after the ticket is closed |
| Security and access logs | Up to 1 year, or longer where needed for an open investigation |
| Data on your server | Permanently deleted when the server's cancellation takes effect |
8. Security
- All traffic to the website and dashboard is encrypted with TLS.
- Passwords are stored as one-way hashes.
- Two-factor authentication is available to staff accounts. Staff access to customer data is limited to what each role needs, and administrative actions are logged.
- Payment details are handled by PayPal, a PCI DSS compliant processor.
No system is perfectly secure, and we cannot guarantee the absolute security of data sent over the internet.
9. Personal Data Breaches
If a breach affects your personal data, we notify the competent authority without undue delay, within 72 hours of becoming aware of it where the GDPR applies, and as required by the DPDP Act and CERT-In directions. Where the breach is likely to put you at risk, we also tell you directly, and explain what happened and what we are doing about it.
10. Cookies
We use strictly necessary cookies for sign-in, security and your preferences. Analytics cookies are set only when analytics are switched on. The Cookie Policy lists each cookie and its duration.
11. Your Rights
Depending on where you live, you have the right to:
- Access a summary of the personal data we hold about you and how it is processed;
- Correct or complete inaccurate data (most details can be changed in your profile);
- Erase data we no longer need, subject to the legal retention periods in section 7;
- Export the data you provided, in a machine-readable format (GDPR);
- Object to or restrict processing based on legitimate interests (GDPR);
- Withdraw consent at any time, without affecting processing that took place before;
- Nominate another person to exercise your rights in the event of death or incapacity (DPDP Act s.14); and
- Complain to our Grievance Officer, then to the Data Protection Board of India, or to your local supervisory authority in the EU or UK.
Send requests to [email protected] from the email address on your account. We may ask you to confirm your identity. We respond within 30 days, free of charge.
12. Grievance Officer
In accordance with the Information Technology Act, 2000, the rules made under it, and the DPDP Act, 2023, complaints about the processing of personal data can be sent to our Grievance Officer:
Grievance Officer
Sylox Tech (OPC) Private Limited, Jharkhand, India
Email: [email protected]
The Grievance Officer acknowledges complaints within 24 hours and resolves them within 30 days of receipt.
13. Children
The Service is for businesses and adults. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we delete it.
14. Changes to This Policy
When we make a material change, we notify account holders by email at least 15 days before it takes effect and update the effective date at the top of this page.