Privacy policy
This is a courtesy translation. Only the French version is legally binding.
Last updated: 8 June 2026.
This policy explains what personal data ho.ma collects, why, how long it keeps it, and what your rights are. It is written in application of the General Data Protection Regulation (GDPR).
Data controller
The data controller is Ephais SAS, whose details are in the legal notice. For any question about your data: vincent@ephais.eu.
Data collected, and why
1. Customer data (contract holder)
Purpose: performing the contract (creating the tenant, billing, support).
Legal basis: performance of the contract (art. 6.1.b GDPR).
- Contact identity: last name, first name, work email.
- Company identity: legal name, SIRET number, address, EU VAT number.
- Billing data: payment method (IBAN or Stripe token — the Provider never stores a card number in the clear).
2. Technical logs (cluster audit)
Purpose: operational security, incident response, compliance.
Legal basis: the Provider's legitimate interest (art. 6.1.f GDPR) in keeping the service secure.
- The authenticated identity (SA token or OIDC email) that made a request to the Kubernetes API.
- The verb and the resource targeted (“who did what to what, and when”).
- For mutating operations: the request body.
- For secret access: the request and response bodies (so an incident can be reconstructed).
These logs are not read as a matter of routine. They are only read in the event of an incident, an abuse report, or a judicial order.
3. Content the Customer puts in the tenant
Content put there by the Customer (manifests, configmaps, secrets, persistent volumes) is never read by the Provider outside the two cases listed in article 6 of the terms of use (explicit request from the Customer, or a judicial order).
Who receives the data
Your data is not passed on to any third party for commercial purposes. The only recipients are:
- the Provider itself, in order to deliver the service;
- the hosting company, for the technical data strictly needed to run the service (see the legal notice);
- the payment provider (Stripe, once it is enabled), to process transactions;
- the competent public authorities, in the event of a lawful order.
Retention periods
| Data | Retention |
|---|---|
| Contact details of an active Customer | The whole term of the contract + 1 year |
| Invoices and accounting records | 10 years (legal obligation) |
| Cluster audit logs | 30 days (automatic rotation) |
| Tenant content after termination | 30 days (export window), then permanent erasure |
| Support emails | 3 years after the last interaction |
Your rights
Under articles 15 to 22 of the GDPR, you have the following rights over your personal data:
- Access: get a copy of the data concerning you.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask for your data to be deleted (subject to the Provider's legal obligations, accounting ones in particular).
- Restriction: ask for processing to be suspended in certain cases.
- Portability: receive your data in a structured, machine-readable format.
- Objection: object to processing based on the Provider's legitimate interest.
To exercise these rights, write to vincent@ephais.eu. You will get an answer within one month at most.
You also have the right to lodge a complaint with the CNIL, the French data protection authority.
Transfers outside the EU
All data is hosted and processed inside the European Union. If a transfer to a third country ever becomes necessary, the Provider will inform Customers and put the appropriate safeguards in place (standard contractual clauses).
Security
The Provider puts technical and organisational measures in place to keep data secure: end-to-end TLS (Let's Encrypt), per-tenant isolation (Capsule + RBAC), short-lived token authentication, full auditing of access, and least privilege for internal operations.