Privacy notice
Last updated 12 November 2026. Takes effect when the service opens to customers.
This notice says what personal data Vexelia LLC holds when you use the Vexelia panel, API and website, why, how long, and who else handles it.
Who is responsible
Vexelia LLC, 8 the Green, Ste B, Dover, DE 19901, USA (Delaware file number 10183713), decides why and how your account and billing data is used. For the contents of your servers, backups and snapshots we act on your behalf: see the data processing terms. Contact: [email protected].
Why we use it
- To provide the service you ordered, and to bill for it (the contract).
- To keep the service and your account secure, and to prevent abuse (our legitimate interest).
- To keep accounting and tax records (a legal obligation).
- To email you about your account, billing, servers and security.
We do not sell personal data and we run no advertising or analytics on the website or the panel.
What personal data we store
| Data | What it holds | Why |
|---|---|---|
| Account | Email address, display name, a password hash (never the password), authenticator-app secret, recovery-code hashes, passkeys, whether the email is verified | Sign-in and security |
| Sessions | IP address, browser user agent, times of creation and last use | Keeping you signed in, security |
| Audit log | Who did what, to which resource, when, and from which IP address. Entries are chained so they cannot be altered afterwards | Security and accountability |
| Organisation | Organisation name, members and their roles, invitations (the invited email address) | Running the service for a team |
| Billing details | Name, address, city, postal code, country and tax ID, as you enter them | Invoices and tax |
| Payment methods | Card brand, last four digits, expiry and Stripe's references. The full card number is held by Stripe and never reaches our servers | Taking payment |
| Orders, invoices, credit notes, ledger | What you bought, amounts, tax, invoice numbers, payments and refunds | Providing the service, accounting and tax law |
| Tax evidence | For each sale: billing country, card country, the country used, tax ID and its check result | Charging the correct tax |
| Support tickets | Subject, messages, attachments (up to 5 MiB each), the server concerned | Support |
| Recipient address, subject and text of every email we send you, and bounce and complaint notices from the mail provider | Sending notices, receipts and reminders | |
| SSH public keys, API tokens, webhooks | Public keys and fingerprints, token hashes and scopes, webhook URLs | Access to your servers and the API |
| Your servers | Hostnames, IP addresses, labels, user-data and startup scripts you write, console sessions, usage and bandwidth counts | Providing the service |
| Backups and snapshots | Copies of your server's disks, encrypted. Their content is whatever you keep on the disk | Backups and snapshots you ask for |
We do not store a phone number or run analytics on this website.
How long we keep it
- Text of emails we sent you: 30 days. Recipient, subject and status of those emails: 365 days.
- Inbound support email held for processing, and finished webhook deliveries: 30 days.
- Closed console sessions (who, when, from where): 365 days.
- Expired sessions, used or expired email links and sign-in challenges: 30 days after they expire.
- Sign-in history for alerts (browser string, network, first address): up to a year after last use.
- Data export archives you request: 7 days.
- Invoices, credit notes, the ledger, tax records, payments and refunds: kept as tax and accounting law requires, 10 years by default. They are not deleted when you delete your account.
- Our audit log: kept. It is append-only and holds an internal id rather than your name.
- Support tickets and their files: kept for now, with no automatic deletion.
- A server that is not paid for is stopped, and deleted with its data no sooner than 30 days after the due date.
- Backups of our own database and off-site copies keep erased data until each copy expires. We do not edit a backup.
Who else handles it (subprocessors)
| Provider | Used for | Data |
|---|---|---|
| Cloudflare | Serving and protecting this website | Website request data, including IP address |
| Stripe | Card payments, saved cards, refunds and dispute handling | Card details (entered with Stripe, never on our servers), billing name and address, email, amounts |
| Transactional email provider | Sending our emails to you: receipts, reminders, security alerts | Recipient address, subject, text |
| Infrastructure and hosting providers | Running the control plane and the host machines your servers run on | Everything listed in the table above |
| Object storage for backups | Storing encrypted backups, and an encrypted off-site copy where that is switched on | Encrypted copies of your disks and game data |
Sign-in history
To warn you about unfamiliar sign-ins we keep, for each person, up to 25 browsers and up to 50 networks. For a browser we keep a hash of a random cookie, its browser string and the first IP address it signed in from. For a network we keep the first part of an IP address. Each sign-in alert also records the full IP address and browser string. We use no location database, so we learn nothing about where you are. Entries are forgotten a year after you last used them.
Your rights
You can ask for a copy of your data, to correct it, to delete it, or to stop us using it in a particular way. Most of this you can do yourself: see data export and deletion. For anything else email [email protected]. Where the law where you live gives you more rights, those apply. You can also complain to your local data protection authority.
What deletion keeps
When an account or organisation is deleted we keep what the law requires: invoices, credit notes, the ledger and tax records, payments, refunds and disputes, and the service and subscription history. Our audit log keeps an internal id. Database backups and off-site copies keep erased data until each copy expires. The payment provider keeps what card-scheme and tax rules require; we detach your cards, but we cannot yet delete the provider's own record of you, so ask Stripe or us if you need that.
Who else handles it
See the subprocessors list. Data may be processed outside your country, including in the United States.
Cookies
This website sets no cookies. The panel uses cookies to keep you signed in. The full list is in the cookie notice.
Changes
If we change this notice in a way that matters to you, we email the account's owners before it applies.