Privacy Policy
Last updated 5 October 2026
This policy explains how Two Trick Pony Enterprise, trading as Django Cloud ("we", "us") handles personal data when you visit our website, create an account or use our deployment service. We are based in the Netherlands and follow the EU General Data Protection Regulation (GDPR).
1. Who is responsible
For the data described in this policy we are the controller: Two Trick Pony Enterprise, Lloyd Webberhof 15, 3543 EG Utrecht, the Netherlands, registered with the Chamber of Commerce under KvK 89010701. Privacy questions: djangocloud@petervandoorn.com.
Where you use Django Cloud to deploy an application that contains other people's personal data (your own users, for example), we act as your processor for that data. That is covered by our Data Processing Agreement, not by this policy.
2. What we collect and why
| Data | Why we use it | Legal basis |
|---|---|---|
| Account data: email address, password (stored only as a salted hash), login timestamps, and the optional company name and "how did you hear about us" answer you give at sign-up | Create and secure your account, sign you in, contact you about the service | Contract |
| Billing data: Stripe customer and subscription IDs, subscription status, billing period. Card details are entered at Stripe and never reach our servers | Charge you, show your plan, suspend access after failed payment, keep financial records | Contract; legal obligation |
| AWS connection: your AWS account ID, region, the ARN of the IAM role you connect and its ExternalId (neither is a secret), or, if you connect with an access key instead, the key ID and your secret access key (stored encrypted) | Deploy and manage your application in your own AWS account on your behalf | Contract |
| GitHub connection: GitHub App installation ID, account name, the repositories and branch you choose, commit hashes of pushes | Create releases when you push code. We request read-only access to the repositories you select | Contract |
| Deployment data: deployment names, settings, sizes, release history, image references, environment settings you provide | Run the service, roll back, show your dashboard | Contract |
| Logs and metrics: log lines from your deployments and build steps, and CPU/memory measurements. Logs can contain whatever your application prints | Show you logs and graphs, diagnose problems | Contract |
| Technical data: IP address, browser type, request logs, security events | Keep the service secure, prevent abuse, fix errors | Legitimate interest |
| Usage analytics and session recordings (marketing site and dashboard): pages viewed, clicks, device information, and recordings of how you use pages. When you are signed in this is linked to your user ID and email | Understand and improve the product | Consent |
We do not sell personal data and do not use it for advertising.
3. Cookies and similar technologies
We use a session cookie to keep you signed in and a CSRF cookie to protect forms. These are strictly necessary and set without consent.
Our analytics tools (Mixpanel and Microsoft Clarity) use browser storage and may record your interactions. We load them only with your consent. You can withdraw consent at any time and clear your browser storage.
4. Who we share data with
We use the following service providers (sub-processors). Each processes data only to provide its service to us:
- Stripe (payments and invoicing).
- GitHub (reading your selected repositories and receiving push events).
- Amazon Web Services (hosting the Django Cloud platform in Frankfurt, Germany (AWS eu-central-1)). When you connect your own AWS account we also call AWS APIs in your account on your behalf; your application runs in the AWS region you choose.
- Kaashosting (hosts our database).
- Redis Ltd. (formerly Redis Labs; hosts our task queue).
- Mixpanel (EU data residency) and Microsoft Clarity (analytics and session recordings, with consent).
- jsDelivr (CDN that serves front-end libraries; it sees your IP address when your browser loads them).
We may also disclose data if the law requires it, or to protect our rights, and to a successor if the business is sold (you would be told).
5. Transfers outside the EU
Some providers (for example Stripe, GitHub, Microsoft) may process data in the United States. We rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.
6. How long we keep data
- Account and deployment data: while your account exists. When you close your account (Settings, Close account) we cancel your subscription and delete your deployments, databases (after a final snapshot), stored uploads and account right away; invoices and payment records we must keep by law stay with our payment provider.
- AWS role details and secret access key (if you used one): deleted immediately when you disconnect AWS or close your account.
- Logs: 30 days.
- Metrics: 30 days.
- Invoices and payment records: 7 years, as Dutch tax law requires.
- Waiting list emails: when sign-ups are closed you can leave your email address to be told when they open. We use it only for that and delete it once sign-ups open or when you ask us to.
- Analytics: until you unsubscribe
7. Security
Passwords are hashed. With a role we store no secret and assume it only for short sessions; if you connect an access key instead, its secret is encrypted at rest. Either is used only to deploy and manage your application. Traffic is encrypted in transit. We recommend a role with only the permissions listed in your dashboard, and you can revoke access in AWS at any time by deleting the role (or the key). No system is perfectly secure; if a breach affects your data we will notify you and the authority as the GDPR requires.
8. Your rights
You can ask us to access, correct, delete or export your data, to restrict or object to processing, and to withdraw consent at any time (this does not affect earlier processing). Email djangocloud@petervandoorn.com; we answer within one month. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or your local authority.
9. Children
Django Cloud is for developers and is not directed at anyone under 16.
10. Changes
If we change this policy in a way that matters to you, we will tell you by email or in the dashboard before it takes effect. The date at the top shows the latest version.