Privacy Policy

How we handle your data at statichost.uk.

Effective date: 11 February 2025 Last updated: 11 February 2025

Static Host UK and Static Site Hosting UK are trading styles of be braver Ltd, a company registered in England and Wales (company number 06612298), with registered office at Crown House, 27 Old Gloucester Street, London, WC1N 3AX (“we”, “us”, “our”).

This Privacy Policy explains what data we collect, why we collect it, and how we handle it when you use the statichost.uk platform (“Service”).

1. Data Controller

be braver Ltd is the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Contact: hello@statichost.uk

2. Data We Collect

2.1 Account Data

When you create an account, we collect:

  • Email address — to authenticate you and send service notifications
  • Name (optional) — if you choose to provide one
  • OAuth profile data — if you sign in via GitHub or GitLab, we receive your username, email, and avatar URL from the provider

Legal basis: Contract (Article 6(1)(b) UK GDPR) — necessary to provide the Service.

2.2 Site and Build Data

When you create and deploy a site, we process:

  • Repository URL and deploy key — to clone your code
  • Build logs — generated during the build process
  • Deployed site files — the output of your build, served to visitors

Legal basis: Contract — necessary to provide the hosting service.

2.3 Analytics Data (Your Visitors)

If you enable analytics on your site, we collect aggregate data about your visitors:

  • Page URLs and referrers
  • Country (derived from IP, then IP is discarded)
  • Device type and browser family
  • UTM campaign parameters

We do not collect or store:

  • IP addresses (beyond initial geo-lookup, then immediately discarded)
  • Cookies or local storage identifiers
  • Personal data or fingerprints
  • Individual visitor profiles

Unique visitor counts use HyperLogLog with daily-rotating salted hashes. This makes it mathematically impossible to identify or track individual visitors.

Legal basis: Legitimate interest (Article 6(1)(f) UK GDPR) — providing site owners with aggregate performance data without tracking individuals.

2.4 Form Submissions

If you use our form processing feature, we relay form submissions to your configured email address or webhook URL. Form data is not stored on our servers — it is processed in memory and forwarded immediately.

Legal basis: Contract — providing the form relay service.

2.5 Server Logs

Our infrastructure generates standard server logs containing:

  • IP addresses (truncated/anonymised)
  • Request URLs and status codes
  • Timestamps

These logs are retained for a maximum of 7 days for security and debugging purposes, then automatically deleted.

Legal basis: Legitimate interest — security monitoring and service reliability.

3. Data We Do Not Collect

  • We do not use cookies for tracking or advertising
  • We do not use third-party analytics services (Google Analytics, etc.)
  • We do not use third-party advertising networks
  • We do not sell, rent, or share your data with third parties for marketing purposes
  • We do not build user profiles or perform behavioural tracking

4. Where Your Data Is Stored

All data is processed and stored on Hetzner Cloud and UK infrastructure. We do not use US-based cloud providers (AWS, Google Cloud, Azure, or Cloudflare).

Your data is not transferred to the US.

5. Data Sharing

We share your data only in the following circumstances:

  • Infrastructure providers — Hetzner Cloud for hosting; Hetzner DNS for subdomain management. Hetzner is a German company subject to GDPR.
  • Email delivery — transactional emails (magic links, notifications) are sent through our mail infrastructure.
  • Law enforcement — if required by law, court order, or binding legal process.

We do not share your data with advertising networks, data brokers, or any other third parties.

6. Data Retention

  • Account data — retained while your account is active. Deleted within 30 days of account deletion.
  • Build logs — retained for 30 days, then automatically deleted.
  • Deployed site files — retained while the site is active. Deleted within 7 days of site deletion.
  • Analytics data — retained for 12 months in aggregate form. No individual visitor data is ever stored.
  • Server logs — retained for 7 days maximum.

7. Your Rights

Under UK GDPR, you have the right to:

  • Access your personal data (Article 15)
  • Rectify inaccurate data (Article 16)
  • Erase your data (“right to be forgotten”) (Article 17)
  • Restrict processing of your data (Article 18)
  • Data portability — receive your data in a structured format (Article 20)
  • Object to processing based on legitimate interest (Article 21)

To exercise any of these rights, email us at hello@statichost.uk. We will respond within 30 days.

8. Account Deletion

You can delete your account through the dashboard at any time. When you delete your account:

  • Your account data is deleted within 30 days
  • Your sites and deployed files are removed within 7 days
  • Build logs are deleted immediately
  • Aggregate analytics data is retained (it contains no personal data)

9. Children

The Service is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email at least 14 days before they take effect. The “Last updated” date at the top indicates the most recent revision.

11. Contact and Complaints

For questions or concerns about this policy or your data:

  • Email: hello@statichost.uk
  • Post: be braver Ltd, Crown House, 27 Old Gloucester Street, London, WC1N 3AX

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):