Privacy Policy

1. Who is responsible for your data

PAASNEXT is the controller of the personal data described in this policy about our own customers, their team members and visitors to our website. You can reach us about privacy at support@paasnext.com.

Where you run a SaaS on the platform, or deploy an application that stores other people’s data, you are the controller of that data and we process it for you as your processor or service provider — see section 4.

2. The data we collect

3. How we use it and our lawful bases

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Data we process for our customers

When our customers deploy applications or run a SaaS on PAASNEXT, the personal data of their own users is processed on the customer’s instructions under our Data Processing Addendum. We do not use it for our own purposes. If you are the user of an application or SaaS hosted on PAASNEXT, please contact that business about your data; we will help them respond to your request.

5. Who we share it with

We share personal data only with the providers below, each under a written contract that limits their use of it to providing their service to us and requires them to protect it; with professional advisers under a duty of confidentiality; with authorities where the law requires it; and with a buyer or successor if our business is sold or restructured, who must honour this policy.

6. International transfers

Several of our providers, including our database and application servers, are located in the United States, so your data may be transferred outside the United Kingdom. Where it is, we protect it by relying on the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”) for certified recipients, or on the UK International Data Transfer Addendum to the EU standard contractual clauses, together with the supplementary measures described in section 9. You can ask us for a copy of the relevant safeguards.

7. Cookies

We use only cookies that are strictly necessary to provide the Service, so under the Privacy and Electronic Communications Regulations they do not require consent. We do not use advertising, analytics or third-party tracking cookies.

8. How long we keep it

• Account, profile and service content: for as long as your account is open. When you delete your account we permanently delete your applications, deployments, account data and our copies of your invoices and email records straight away.
• Payment and tax records: invoices and payment records are retained by our payment providers, Stripe and PayPal, for as long as tax and accounting laws require — in the United Kingdom, six years.
• Records of emails we send you: 90 days.
• Security and operational logs: only as long as needed for security and troubleshooting, and resolved incident records for 90 days.
• Deleted data can remain in our database provider’s encrypted point-in-time backups for a limited period until those backups roll off.

9. How we protect it

Data is encrypted in transit using TLS. Passwords are stored only as salted hashes, and credentials and environment variables you store are encrypted at rest with AES-256. Password-reset links are single-use, expire, and are stored only as hashes. Access to production systems is limited to staff who need it, two-step verification is available on every account, and we monitor for errors and abuse. No system is perfectly secure; if a personal data breach is likely to put you at risk, we will tell you and the regulator as the law requires.

10. Your rights

• UK residents have the right to access their personal data, to have it corrected or erased, to restrict or object to its use, to data portability, and to withdraw consent at any time where we rely on it.
• Residents of California and other US states with comprehensive privacy laws have the right to know what personal information we collect and how we use and disclose it, to access a copy, to correct and delete it, and to opt out of its sale, sharing or use for targeted advertising — which we do not do. Where your state provides one, you may appeal a decision we make about your request.
• You can view, correct and delete much of your data yourself from your account settings.
• To exercise any right, email support@paasnext.com from the address on your account. We may need to verify your identity. We respond within one month (UK) or 45 days (US), and may extend this where the law allows. You may use an authorised agent, who must show your written permission. We will not discriminate against you for exercising your rights.
• If you are in the UK and are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk. We would appreciate the chance to resolve your concern first.

11. Notice for California residents

In the past 12 months we have collected the following categories of personal information described in the CCPA: identifiers (such as name, email and IP address); customer records and commercial information (such as plan and payment history); internet or network activity (such as logs of your use of the Service); and professional information (such as company name). We collect it from the sources and for the business purposes in sections 2 and 3, and disclose it only to the service providers in section 5. We do not sell or share personal information, and we have no actual knowledge of selling or sharing the data of anyone under 16. The only sensitive personal information we collect is account login credentials, which we use solely to provide and secure your account.

12. Children

PAASNEXT is intended for people aged 18 and over, and we do not knowingly collect personal data from children. If you believe a child has given us their data, contact us and we will delete it.

13. Changes to this policy

We will update this policy when our practices change. For material changes we will email you before they take effect, and we always show the date of the latest version at the top of this page.