1. Who is responsible for your data
Selfmade Ninja Academy, India, operates Selfmade Ninja Cloud and is the controller of the personal data described in this policy — the data about you as an account holder. Reach us about anything in this document at privacy@selfmade.ninja; this address is also our grievance contact for the purposes of India’s Digital Personal Data Protection Act, 2023.
For the data you put on your workspaces — your users, your databases, your files — you are the controller (the “data fiduciary” under the DPDP Act) and we are your processor. That relationship is governed by the Data Processing Addendum, not by this policy.
2. What we collect
| Category | What | Where it comes from |
|---|---|---|
| Account | Name, email address, organisation, phone number, country, preferred currency, the version of the terms you accepted and when | You, at signup and in your settings |
| Sign-in | A hash of your password (never the password), the public half of any passkey you register, your second-factor secret, session records, and a hint about the devices you sign in from so a new one can be recognised | You; your browser |
| Identity providers | Your verified email address and a stable user id from Google or GitHub, if you choose to sign in with one; the GitLab account a trial platform starts with | The provider you chose |
| Billing | Invoices, credit notes, payment references and amounts, your prepaid balance and its history, GST details you give us. Card and bank details are entered on our payment processor’s form and never reach us. | You; the payment processor |
| Operational | Which workspaces you have, their sizes, public addresses, domains, snapshot schedule, the state the control plane observes them in; every action taken on your account and by whom, kept as an audit log you can read | The service, as you use it |
| Logs | Console access logs (IP address, time, path, user-agent), connection logs for the platform network, and control-plane logs that record commands sent to your workspace and their outcome | The service |
| Support | What you write to us by email or in the chat widget, and the pages you were on while the chat was open | You; the chat provider |
| Website | The enquiry form (organisation, sector, size, timeline, what you need); the signals our human-check provider collects; a currency preference cookie | You; your browser |
We do not collect special-category data, and we do not want it in your account details.
3. Why, and on what basis
- To run the service you signed up for — creating and operating workspaces, billing, support, security notices. Basis: performance of a contract.
- To keep the platform secure — session checks, second factors, rate limits, the audit log, abuse detection. Basis: our legitimate interest in running a platform that is not misused, and in some cases legal obligation.
- Because the law requires it — tax records, and the log and identity retention the CERT-In directions of 28 April 2022 impose on service providers in India. Basis: legal obligation.
- To answer an enquiry you sent us. Basis: your request, and our legitimate interest in replying.
- To tell you about the service — changes to terms, prices, incidents. These are service notices, not marketing, and every account gets them. We do not send marketing email without asking first.
4. The contents of your workspaces
We do not read the contents of your machines, databases or snapshots. Our operators can reach a workspace only through the control plane, and every command it sends is recorded. We access a workspace’s contents in three situations: you asked us to (a support request), we are required to by a lawful order, or it is necessary to stop an ongoing attack on the platform or on third parties. In each case the access is logged, and where the law allows we tell you.
5. Who we share it with
The companies that process data on our behalf are listed, with what each one sees, at /subprocessors. Beyond them we share personal data only with authorities when a lawful request requires it, with professional advisers under a duty of confidence, and with a successor if the service changes hands — in which case you are told and this policy continues to apply.
6. Where it is stored, and international transfers
Your workspaces and their data are in Hyderabad, India. Account records are held in India. Some sub-processors are outside India — the list says where each one is. For customers in the European Economic Area and the United Kingdom, transfers to us rest on the European Commission’s Standard Contractual Clauses and the UK Addendum, incorporated into the Data Processing Addendum. Transfers we make to sub-processors outside India are covered by the same instruments or by an adequacy decision.
7. How long we keep it
| Data | Kept for | Why |
|---|---|---|
| Workspace disks and databases | Until you delete the workspace. The delete is verified before it is reported. | Yours to keep or remove |
| Snapshots | Per the retention you set; all of them when the workspace is deleted | Yours to keep or remove |
| Account identity details | Life of the account, then five years | CERT-In directions of 28 April 2022 |
| Access and connection logs | 180 days, within India | CERT-In directions of 28 April 2022 |
| Per-account audit log | Life of the account, then with the identity details | Your record of who did what; ours for incident response |
| Invoices and payment records | As long as tax law requires — currently up to eight years in India | Legal obligation |
| Support conversations | Two years after the last message | Context for later questions |
| Enquiry form submissions | One year after the last contact, unless you become a customer | Answering and following up |
8. Your rights
Wherever you are, you can ask us what we hold about you, ask us to correct it, ask us to delete it, and complain. If the GDPR or UK GDPR applies to you, you also have the rights to restrict processing, to object to processing based on legitimate interest, to portability of the data you gave us, and to complain to your supervisory authority. If the DPDP Act applies to you, you have the rights of access, correction, erasure, grievance redressal, and to nominate a person to exercise your rights if you cannot.
How to exercise them. Much of it you can do yourself: your details, sessions, second factors and audit log are in your account settings, and deleting a workspace deletes its data. For anything else, email privacy@selfmade.ninja from the address on your account, or tell us how to verify that you are the person concerned. We answer within one month, and tell you if a complex request needs longer. Where a legal retention period prevents deletion — the CERT-In and tax periods above — we tell you that too, and restrict the data to that purpose.
9. Cookies
The console sets a session cookie so you stay signed in, and a cookie that remembers the currency you chose on the price pages. Neither is used for advertising. The human check on our forms and the support chat widget set cookies of their own, under their operators’ policies, listed at /subprocessors.
We use Meta’s advertising tools to learn which of our ads bring people here, and to improve
them. In your browser, Meta’s pixel runs only if you choose Allow in the cookie banner. From
our side, our CRM tells Meta, server to server, when you sign up, start a trial or pay. Meta
receives the event, its value, the page, your browser’s Meta cookies (_fbp,
_fbc) and your email, phone, name and country in hashed form — never anything on
your workspaces. We keep your answer, and the ad that brought you, in cookies of our own.
In the EU, the EEA, the UK and Switzerland, and wherever we cannot tell where you are, our CRM sends Meta nothing unless you chose Allow. If you choose Decline, nothing is sent, from your browser or from us, wherever you are. People Meta may hear about can be included, hashed, in audiences we use to show or to exclude our ads. You can change your answer at any time from Cookie settings in the footer or in your account settings.
10. Security
The controls that protect this data — and the ones we have not built yet — are described plainly at /security.
11. If something goes wrong
If a security incident affects your personal data we tell you without undue delay, and where the GDPR or UK GDPR applies we notify the relevant supervisory authority within 72 hours of becoming aware of it. Qualifying incidents are reported to CERT-In within the time its directions require, and to the Data Protection Board of India where the DPDP Act requires it. The notice says what happened, what data was involved, what we have done and what you can do.
12. Children
The service is for adults and organisations. We do not knowingly hold an account for anyone under 18; if you believe we do, tell us and we will close it.
13. Changes to this policy
The version date at the top changes when the policy does. For a change that affects your rights we email account holders before it takes effect.