This policy explains what Zevonix, LLC collects when you use zevonix.cloud and My Cloud Manager, why we hold it, and what we do not do with it.
Two different roles. For our own business records, meaning your account, your invoices and our support correspondence, we are the controller, and this policy applies. For the content and visitor data inside the websites we host for you, you are the controller and we are the processor. That relationship is described in the Data Processing Addendum.
On this page
1. What we collect
When you enquire
The contact form on this site collects the name, business, email address, phone number and message you type into it, so we can reply. Nothing more.
The form is delivered to Zoho CRM, which we use to manage enquiries. Its anti-spam image is loaded from Zoho when this page opens, so Zoho receives your IP address even if you do not send the form.
When you have a portal account
| Data | Why |
|---|---|
| Name and email address | To identify your account and contact you about it |
| Password, stored only as a hash | To sign you in. We cannot read it back. |
| Two-factor secret and recovery codes, encrypted | To verify your second factor, if you use an authenticator app |
| Passkey public keys, if you register one | To check the signature your device produces when you sign in |
| Time of your last sign-in | So we and you can spot access that was not yours |
What a passkey does not give us. A passkey keeps its private half on your device and never sends it anywhere. We receive only the public half and a signature, which prove the device is yours but cannot be used to sign in as you, so this is one of the few credentials that is not worth stealing from us.
Your fingerprint or face never reaches us either. The biometric check happens on your own device and unlocks the key locally; what crosses the network is the signature, not the measurement. We do not receive, store or have any means of obtaining biometric data.
We do store, alongside the public key, a label you choose, when it was added and last used, and an identifier for the make and model of authenticator, for example that it is a particular brand of security key or a platform passkey. That last item is a property of the device, not of you, and we use it only to help you tell your own passkeys apart. You can name, review and remove any passkey from My Cloud Manager at any time; removing it deletes the record.
About the servers we manage for you
We record hostname, IP address, region, plan, and hourly measurements of CPU, memory, disk and network use. These are measurements of a machine, not of a person. They are what the charts in My Cloud Manager are drawn from.
Pictures of your websites
My Cloud Manager shows a small screenshot of each published website so you can recognise it at a glance. We take these by loading the site the way any visitor would, on a schedule, and keeping the most recent image. It captures only what a member of the public would see on the public page. We do not sign in, and we do not photograph anything behind a login. The image is stored alongside the portal and replaced each time it is retaken.
Staging copies of your website
If your website has a staging environment, that environment is a complete copy of the site, including its database, so any personal data your live site holds also exists in the copy. It lives on the same server, in the same country, under the same protections as the live site. Publishing, and the recovery points either side of it, create further short-lived copies. These are described under How long we keep it.
Operational records
Backup history, patch history, security alerts and support correspondence, so we can run the service and answer questions about it later.
Cookies
zevonix.cloud sets no cookies. My Cloud Manager sets two, both needed to sign in: a session cookie that keeps you signed in, and a security token that protects forms against forged requests. Both expire after a short period of inactivity. We use no advertising or analytics cookies anywhere.
2. Why we hold it
To provide the service you are paying for, to bill for it, to keep it secure, and to answer you when you contact us. We rely on the performance of our contract with you, and on our legitimate interest in keeping the platform secure and working.
3. What we do not do
- We do not sell your data, or your visitors' data, to anyone.
- We do not use your data, or your site's content, to advertise to you or anyone else.
- We do not place advertising or analytics trackers on this site.
- We do not read the contents of the websites we host except where it is necessary to provide support, investigate a security incident, or comply with the law.
4. How long we keep it
| Data | Kept for |
|---|---|
| Enquiries that do not become accounts | No longer than we need to follow up |
| Portal account records | While the account exists. A withdrawn account is disabled rather than deleted, so we can answer who had access and when; you can ask us to delete it. |
| Per-minute server measurements | 14 days, then folded into hourly averages |
| Hourly server measurements | 35 days |
| Website backups | The retention period in your Service Summary |
| Website screenshots | Only the latest image per site is kept; each retake replaces the previous one |
| Staging environments | Until you or we remove them. A staging copy persists indefinitely while it exists, so remove one you have finished with |
| Publish recovery points | Kept for the three most recent publishes per site, then deleted. This covers the copy of the previous files, the database dump taken beforehand, and any files a publish set aside |
| Everything after you leave | Website data, staging environments, recovery points and managed backups may be permanently deleted 30 days after termination. Request any export before then. |
| Invoices and business records | As long as tax and company law require |
5. Who we share it with
We use third-party infrastructure providers to deliver the service: hosting, network and edge, and backup storage. They process data on our instructions to run the platform. The current list, and what each one handles, is in the Data Processing Addendum.
For our own business records we also use:
- Zoho Corporation: enquiries from the form on this site, and our business correspondence.
- SuperOps Inc.: our support desk, support correspondence, and the names and email addresses of your named contacts.
- Cloudflare, Inc.: the bot check on the My Cloud Manager sign-in and password-reset pages.
- BunnyWay d.o.o. (Bunny Fonts): serves the typefaces used by My Cloud Manager. Your browser requests them directly, so Bunny receives your IP address. It sets no cookies.
Mail your website sends does not pass through a third party. Your server delivers it directly, signed as your own domain with a signing key held only on that server. Nobody else handles the contents of a form notification, an order confirmation or a password reset on the way to its recipient. We do not run a shared mail relay, so one customer's mail never travels through infrastructure shared with another's.
We may share information with employees, contractors and service providers to the extent reasonably necessary to provide the service, subject to confidentiality obligations. We may also disclose information where the law requires it.
6. How it is protected
Passwords are hashed. Two-factor secrets, recovery codes and provider credentials are encrypted at rest. Backups are encrypted before they leave the server. Access to the management console requires two-factor authentication. Details are in the Security Overview.
No security system removes all risk, and we do not claim your data can never be compromised. If we become aware of a material security incident affecting data within our control, we will notify you as required by applicable law and the circumstances.
7. Your choices
You can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it where we are not required to keep it. Portal account holders can see and change their own details in My Cloud Manager, and turn two-factor authentication on or off there.
Depending on where you live, you may have further rights under laws such as the GDPR or the CCPA. Write to us and we will deal with your request within the time the applicable law allows.
8. Children
This is a business service. It is not directed at children, and we do not knowingly collect personal data from anyone under 16.
9. Changes
We will update this policy as the service changes, and the date at the top will say when. If a change materially affects how we handle your personal data, we will tell you rather than rely on you noticing.
Contact
Privacy questions and requests about your data: [email protected]. You can also use the contact form. Zevonix, LLC · zevonix.com