Privacy Policy
Overview
OneStack, Inc. ("OneStack", "we", "us") operates the OneStack platform and associated services. This Privacy Policy explains what data we collect when you use our services, how we use it, and the choices you have.
We built OneStack for developers and businesses that care about infrastructure reliability. We take the same care with your data: collect only what we need, use it only for stated purposes, and never sell it.
Information we collect
Account information. When you register, we collect your name, email address, and a hashed password. For billing, we collect the payment details your card processor needs (we use Stripe; we never store raw card numbers).
Usage data. We log API requests, dashboard activity, server provisioning events, and feature usage. Logs include timestamps, request IDs, and IP addresses.
Sign-in and order addresses. To keep accounts safe and spot abuse, we keep the IP address you signed up and placed orders from, and the address and browser of your recent sign-ins and failed sign-in attempts (up to 100 per account, never longer than 180 days). Only the site owner can see this.
Job applications. If you apply for a role, we keep the name, email, link and message you send, plus a private note from us, only to consider your application. Only the site owner can see them, and they are deleted after 12 months (or sooner if you ask us to).
Reseller enquiries. If you ask about reselling our hosting, we keep the name, email, business details, website and message you send, plus a private note from us, only to reply and agree terms. Only the site owner can see them, and they are deleted after 12 months (or sooner if you ask us to).
Server metadata. Hostname, region, plan, and configuration options you set. We do not access the content of your servers, databases, or files.
Billing data. Invoice history, plan changes, and payment status. All payment processing is handled by Stripe under their own privacy policy.
Support communications. If you contact support, we retain the content of those communications to resolve your issue and improve our service.
How we use it
- Provision, operate, and monitor your servers and services
- Send transactional emails: invoices, security alerts, and service notifications
- Investigate and resolve support issues
- Detect abuse, fraud, and violations of our Terms of Service
- Improve product reliability and plan capacity based on aggregate usage
- Comply with legal obligations
We do not use your data to serve third-party advertising or build profiles for sale.
Data sharing
We do not sell or rent your personal data. We share it only in these cases:
- Service providers. Stripe (payments), Postmark (transactional email), and our infrastructure partners operate under strict data processing agreements.
- Legal requirements. We may disclose data when required by law, subpoena, or court order. Where legally permitted, we will notify you before disclosing.
- Business transfers. If OneStack is acquired or merges with another entity, your data may transfer as part of that transaction. We will notify you 30 days in advance.
Data retention
We retain account data for the duration of your account and for 90 days after deletion (to allow account recovery). Billing records are retained for 7 years for tax and legal compliance. Server logs are retained for 90 days. Support ticket history is retained for 3 years.
You can request deletion of your personal data at any time. See Your rights below.
Your rights
Depending on your jurisdiction, you may have the right to:
- Access a copy of the personal data we hold about you
- Correct inaccurate or incomplete data
- Request deletion of your data (subject to legal retention requirements)
- Object to or restrict certain processing activities
- Request data portability in a machine-readable format
- Withdraw consent where processing is based on consent
To exercise these rights, send us a message through the contact page and choose the topic "Something else", or open a ticket. We will respond as soon as we can. For EU/EEA residents, you also have the right to lodge a complaint with your local supervisory authority.
Security
Passwords are stored as salted hashes, card payments are handled by Stripe, and we limit who can see account data. No system is perfectly secure. If you find a security problem, please tell us through the contact page.
Despite these measures, no system is perfectly secure. Please report suspected security incidents immediately.
Cookies
We use session cookies (required for authentication), preference cookies (your dashboard settings), and first-party analytics cookies to understand aggregate feature usage. We do not use third-party advertising cookies.
You can disable cookies in your browser settings, but some dashboard features require session cookies to function.
Changes to this policy
We may update this Privacy Policy as our practices evolve. If we make material changes, we will email registered users at least 30 days before they take effect. The "last updated" date at the top always reflects the most recent version.
Contact us
For privacy-related questions or requests, use the contact page or open a ticket. Our mailing address is: OneStack, Inc., 350 Fifth Avenue, New York, NY 10118.