Docdeploymill://docs/privacy-policy

Privacy Policy

Last updated: June 26, 2026

This policy explains what personal data DeployMill collects, why, what we do with it, and what rights you have over it. It's written to be read, not just filed, if anything here is unclear, email [email protected] and a human will answer.

DeployMill is the neutral, agent-safe control plane for shipping web apps: you connect an AI coding agent (Claude, Codex, or any MCP client) and it deploys and operates apps on your behalf, with a web dashboard at /account and public docs at /docs. That product shape matters for privacy, so this policy is explicit about what the agent can and cannot see, most notably, secret values are never returned to the agent.

This policy covers the DeployMill service at https://deploymill.com, the customer apps it serves under subdomains of deploymill.app, the MCP tool surface, and the dashboard. It does not cover what the apps our customers build do with their users' data. That's between those customers and their users (see "Two roles" below).

Two roles: controller and processor

DeployMill handles two very different kinds of data, and we play a different legal role for each. This distinction runs through this whole policy:

DeployMill is a data controller for the account, identity, billing, and
usage data of the people who sign up to use DeployMill itself, your name, email, sign-in identity, organization membership, audit trail, support tickets, and operational logs. We decide why and how this data is processed, and this policy is the primary document governing it.
DeployMill is a data processor for the application data your deployed
apps store, your databases, object storage, and source code, and whatever your users put into the apps you ship. That content belongs to you (our customer). We process it only to provide the service, only on your instructions (including instructions issued through your AI agent), and under the terms of our DPA. You are the controller of that data. If you collect personal data from your own users, the privacy obligations to them are yours.

If you're an end user of an app deployed on DeployMill and have a privacy question about that app, contact the app's operator. They control that data. If they ask us to assist with a deletion or access request, we will.

Personal data we collect, and why

Here is what we collect when you use DeployMill, in our controller role:

Data category	Examples	Purpose	Legal basis (GDPR Art. 6)
Account & identity	Name, email address, hashed password or OAuth identity from Google or GitHub sign-in / enterprise SSO	Creating and securing your account; signing you in	Contract (Art. 6(1)(b))
Organization & workspace	Organization/workspace membership, roles, invites (invitee email addresses)	Running multi-user workspaces; access control	Contract (Art. 6(1)(b))
App & preview metadata	App and preview names, configuration from `.deploymill/project.json`, attached domains, deployment history	Providing the deploy lifecycle, the core service	Contract (Art. 6(1)(b))
Secrets (org-scoped)	Environment secrets you enter for your apps	Injecting them server-side into your app's runtime environment. Encrypted at rest with AES-256-GCM; entered by a human via a single-use browser link; never returned to the AI agent	Contract (Art. 6(1)(b))
Audit trail	An append-only record of actions taken in your workspace, who (or whose agent) did what, when, including the source IP address and device/user-agent of sign-ins and security-relevant events	Security, accountability, and giving you an attributable record of agent activity; the IP/device on a security event is kept for forensics, answering "where and from what did this sign-in happen?" during an incident investigation	Legitimate interests (Art. 6(1)(f)), security and fraud prevention
Sign-in session	Your active dashboard session record, including the IP address and user-agent captured when the session was created	Maintaining your signed-in session and tying it to the device/network it was established from, so a session can be recognized and, if needed, investigated or revoked during a suspected account compromise	Legitimate interests (Art. 6(1)(f)), account security
Support data	Support tickets you file from the dashboard, and the mapping of each ticket to your organization	Answering your questions and tracking issues	Contract (Art. 6(1)(b)); legitimate interests for service improvement
Operational & usage logs	IP address, request metadata, timestamps, user-agent	Keeping the service up, debugging, rate limiting, abuse and fraud prevention	Legitimate interests (Art. 6(1)(f)), service security and reliability
Communications	Emails you send us; transactional emails we send you (e.g. invites)	Communicating with you about the service	Contract (Art. 6(1)(b)); legal obligation where applicable

We do not collect more than we need, and we don't collect sensitive/special category data. Please don't put it in support tickets or app names.

A note on IP address and device/user-agent. These appear in three places above, for one shared reason (security and forensics) but with different lifetimes, so we keep them distinct rather than letting the overlap read as over-collection:

On the audit trail, the IP/device attached to a sign-in or other
security-relevant event is the attributable forensic record, kept for the audit-log retention period (see Data Retention & Deletion) so a security event stays investigable across an audit cycle.
On your sign-in session, the IP/user-agent is captured when the session
is created and lives only as long as that session. It's gone when the session expires or you sign out. It is not a long-term store.
In operational/server logs, IP and request metadata are short-lived
exhaust kept for a much shorter window and rotated automatically.

We do not store a profile photo or avatar. Even when you sign in with Google or GitHub (which would otherwise hand us an avatar URL) we discard it rather than save it, because nothing in the product uses it (the dashboard shows a letter derived from your email instead). It's data we'd have no purpose for, so we don't keep it.

How we collect it

Directly from you, when you sign up, configure an organization, invite
teammates, enter a secret through the single-use browser link, file a support ticket, or email us.
From your sign-in provider, if you use "Continue with Google" or
"Continue with GitHub", or enterprise SSO, we receive the identity assertion (typically your email and name) from that provider. Authentication is OAuth 2.0 + PKCE via Better Auth. The provider receives no application data, source, secrets, or database content from us.
From your AI agent, acting on your instruction, tool calls your agent
makes (deploys, config changes, env-var updates) become app metadata and audit-trail entries attributed to you.
Automatically, server logs capture IP address and request metadata, and
the dashboard uses strictly-necessary session cookies. Details are in the Cookie Policy. Control-plane telemetry is off by default and only engaged if the operator enables it.

How we use personal data

To provide, operate, and secure the service, accounts, workspaces, deploys,
previews, domains, secrets injection, rollbacks, logs, and health checks.
To attribute actions: the append-only audit trail records what you and your
agent did, so production changes are never anonymous.
To communicate with you: invites, security notices, support replies, and
service announcements. We do not send marketing email without a lawful basis and an unsubscribe path.
To keep the platform safe: detecting abuse, enforcing rate limits, and
investigating incidents using operational logs.
To meet legal obligations (tax, accounting, lawful requests).

We do not use your personal data, your application data, your source code, or your secrets to train AI models. The AI agent in the loop is yours. It connects to DeployMill as your authorized client. We don't operate it and we don't feed your data to it beyond the tool responses your own requests produce.

Where the GDPR applies, we rely on the bases in the table above: contract for everything needed to deliver the service you signed up for; legitimate interests for security, abuse prevention, audit logging, and service reliability (balanced against your rights, and you can object, see "Your rights"); legal obligation where laws require retention or disclosure; and consent only where we ask for it explicitly (e.g. any future optional analytics, see the Cookie Policy), which you can withdraw at any time.

Customer application data (our processor role)

Your deployed apps' databases, object storage, and source code are your content. In handling it:

We process it only to provide the service (building, running,
health-gating, backing up, and restoring your apps) and only on your documented instructions, which include the tool calls your AI agent issues on your behalf. The DPA governs this processing.
We don't read, mine, sell, or use it for our own purposes.
Where third-party backends are involved (an optional managed database
provider, object storage, source hosting), they act as subprocessors. The full, honest inventory of which vendor receives what (including which ones are only engaged if the operator configured them) is maintained at Subprocessors. We keep that page current rather than duplicating it here.
The default database backend is internal Postgres on operator-run
infrastructure. By default, no third party receives your database content at all.

We do not sell personal data, and we never have. We share data only in these cases:

Subprocessors, third-party services that help us run the platform
(source hosting, optional managed databases, object storage, transactional email, support tooling, optional sign-in providers). Each one, what it receives, and why is listed at Subprocessors. Several are only engaged if the operator has configured them.
Inside your organization, your name, email, and audit-trail activity
are visible to other members of your workspace as part of how teams work.
Legal and compliance, if required by law, regulation, legal process, or
an enforceable governmental request, or to protect the rights, safety, or property of DeployMill, our users, or the public. Where lawful, we'll tell you before disclosing your data.
Business transfers, if DeployMill is involved in a merger,
acquisition, or sale of assets, personal data may transfer as part of that transaction. We'll notify you and this policy will continue to apply until amended with notice.

International transfers

DeployMill and its subprocessors may process data in countries other than yours. Where personal data subject to the GDPR is transferred outside the EEA/UK to a country without an adequacy decision, we rely on appropriate safeguards, [Standard Contractual Clauses (SCCs) / UK IDTA, as executed with the relevant subprocessors]. The hosting region of the default managed stack is operator-determined. See Subprocessors for per-vendor region notes. Contact [email protected] for a copy of the relevant safeguards.

Data retention

Short version: we keep personal data while your account is active and for a limited period after, audit logs longer (for security and compliance), and deleted apps drop their databases and storage. The full retention schedule (including periods, the deletion grace window, and how deletion propagates to backups) lives in Data Retention & Deletion.

Security

Security is product surface for us, not an afterthought. The whole point of DeployMill is being safe enough to hand an autonomous agent the keys to production. Highlights:

Secrets are encrypted at rest with AES-256-GCM, entered through a
single-use browser link, never returned to the AI agent or echoed into a transcript, and injected server-side into your app's runtime environment.
Encryption in transit, TLS everywhere.
Tenant isolation, workspaces are isolated. Previews get isolated
databases and storage so experiments can't touch production data.
Attributability, the append-only audit trail means every change to
production is traceable to an identity.
Backend credentials never reach clients, agents authenticate to
DeployMill with OAuth tokens. Infrastructure credentials stay server-side.

More detail is at Trust & Security. To report a vulnerability, email [email protected]. No system is perfectly secure. If a breach affects your personal data, we'll notify you and the relevant authorities as required by law.

Your rights

You have the right to:

Access the personal data we hold about you, and get a copy.
Rectify inaccurate or incomplete data.
Erase your data ("right to be forgotten"), subject to legal retention
obligations, see Data Retention & Deletion.
Port your data, receive it in a structured, machine-readable format.
Object to processing based on legitimate interests, and to any direct
marketing.
Restrict processing while a dispute about the data is resolved.
Withdraw consent at any time, where processing is based on consent.
Complain to a supervisory authority, your local one, or our lead
supervisory authority, [lead supervisory authority].

If you're a California resident (CCPA/CPRA)

You have the right to:

Know what personal information we collect, use, and disclose (this
policy is that disclosure. You can also request specifics).
Delete personal information we hold about you, subject to exceptions.
Correct inaccurate personal information.
Opt out of sale or sharing, moot in practice: **we do not sell personal
information and do not share it for cross-context behavioral advertising.**
Non-discrimination, we will not penalize you for exercising any of
these rights.

How to exercise your rights

Email [email protected] from the address associated with your account (or with enough information for us to verify you, we have to verify identity before acting, to avoid handing your data to someone else). We respond within the timelines the applicable law requires (one month under GDPR, 45 days under CCPA, extendable where the law allows). You may use an authorized agent where the law permits. We'll still verify the request. Account deletion is also available self-serve, see Data Retention & Deletion.

If your request concerns data inside a customer's deployed app (where we're a processor), we'll refer you to that customer and assist them as the DPA requires.

Children's privacy

DeployMill is a developer tool, not a service for children. It is not directed at anyone under 16 (or under 18 where local law sets a higher bar for this kind of service), and we don't knowingly collect personal data from children. If you believe a child has created an account, email [email protected] and we'll delete it.

Automated decision-making and the AI agent

Because DeployMill is agent-first, it's worth being precise here. The AI agent that drives deploys is your agent, acting on your instructions. DeployMill executes the tool calls it makes on your behalf, guarded by preview isolation, health gates, auto-rollback, and the audit trail. DeployMill does not make solely automated decisions that produce legal or similarly significant effects on data subjects within the meaning of GDPR Article 22. Automated systems we do run (health checks, rate limits, abuse detection) affect service operation, not your legal rights, and a human review path is available via [email protected].

Changes to this policy

We'll update this policy as the service and the law evolve. The "Last updated" date at the top always reflects the current version. For material changes we'll give notice (by email or a prominent dashboard notice) before they take effect. Continued use after the effective date constitutes acceptance, but for changes that require consent we'll ask for it.

Contact

Privacy & data-subject requests: [email protected]
Security: [email protected]
Support: [email protected]

Controller of record: DeployMill.

This policy is governed by the laws of the jurisdiction in which DeployMill is established, without prejudice to mandatory protections you have under your local law. Related documents: Terms of Service, DPA, Cookie Policy, Data Retention & Deletion, Subprocessors, Trust & Security.