Privacy policy

Effective 5 August 2026. This page describes how foro.sh (“we”, “us”) processes personal data when you use the service: what we collect, why, where it lives, how long we keep it, and how you delete it. It mirrors what the platform actually does today.

Questions and data-subject requests: [email protected]. Security vulnerability reports: [email protected]. The terms of service govern use of the product; this policy covers personal data.

Who we are, and who is responsible

foro.sh is an EU-hosted platform that builds and runs MCP servers from repositories or archives you connect. It is operated by DJH Tech, a sole proprietorship registered in the Netherlands, which is the controller for the account data described below:

Contact for privacy matters: [email protected].

Roles under the GDPR. For account data — your identity, email, encrypted repository tokens, session identifiers, and billing-related account records when they exist — we act as controller. For the content you deploy and the data your MCP server processes (including logs and metrics produced by that server), we act as processor and you (or your organisation) are the controller. A data processing agreement (DPA) is available on request for paid plans.

You remain responsible for what your deployed server does with any personal data it receives or sends, including compliance with the GDPR when you are controller of that processing.

What we process, and why

Account and sign-in. Sign-in runs through an identity service we self-host on the same EU infrastructure (not a hosted identity SaaS). We store the email address you verify and the identity subject id from that service. You may also federate sign-in via GitHub. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR), and our legitimate interest in securing accounts (Art. 6(1)(f)).

Repository connection. When you connect GitHub, GitLab, or Codeberg so we can deploy a repo, we store the provider account id, username, and an OAuth token. Tokens are encrypted at rest (libsodium) and decrypted only server-side to call that provider’s API and clone on your behalf. Connecting a provider is optional; you can upload a project archive instead. Legal basis: Art. 6(1)(b).

Project and workspace data. Repository or archive contents used to build, the pyproject.toml or package.json read from them and related configuration, deployment history, encrypted secrets, workspace membership, and invitation emails you send to teammates. Secrets are encrypted at rest (libsodium secretbox) with a host-held master key and injected only into your own container. Archives live in EU object storage until the project is deleted. Legal basis: Art. 6(1)(b).

Dashboard chat (optional). Chat is bring-your-own-key. If you configure an OpenAI-compatible LLM endpoint, chat messages and tool results are sent to that endpoint under your key and your agreement with that provider. Provider settings (base URL, API key, model) are encrypted at rest; chat history is stored with the project and pruned on a rolling window (see retention below). Where that provider processes data is determined by your choice, not by us. Legal basis: Art. 6(1)(b).

Logs and metrics. We collect build and runtime logs and per-request metrics (tool name, duration, outcome, client name) so you can operate your server and so we can keep the platform secure and operable. How long they are kept depends on your plan: Free 24 hours, Starter 7 days, Team 30 days, Enterprise 90 days. Past that window they are deleted, not merely hidden — a background job removes the stored log files themselves, and deleting a project removes all of its logs immediately. Metrics keep a second, smaller record for longer: daily totals per tool and client, carrying no error text and nothing timed more precisely than a date, on their own plan ladder of Free 7 days, Starter 30 days, Team 1 year, Enterprise 2 years. Deleting a project or your account removes both. Secret values known to the project are redacted before logs are shown or persisted. On Starter plans and above, structured PII scrubbing (emails, IBANs, card numbers, Dutch BSNs, phone numbers) can also apply to tool-call results in the dashboard playground and in chat, where it masks them before they are sent to your own LLM provider; it does not currently run on persisted container logs. Legal basis: Art. 6(1)(b) and 6(1)(f).

Billing and payments. For paid plans, payment is processed by Mollie. Mollie receives the personal data needed to take payment and manage the subscription (typically name, email, and payment-method details). We do not store full card numbers ourselves; we keep plan status and Mollie customer/subscription identifiers so we can apply entitlements and handle billing events. Legal basis: Art. 6(1)(b). Mollie’s own privacy notice also applies to data it processes as payment provider.

Waitlist. If you join a waitlist we store the email you submit only to contact you about access. Email [email protected] to have it removed at any time. Legal basis: Art. 6(1)(b) or 6(1)(f), depending on context.

Cookies and similar. We set a signed HTTP-only session cookie for sign-in, and a short-lived HTTP-only cookie during OAuth flows to protect against CSRF. We do not use analytics or advertising cookies.

We do not sell personal data. We do not use your content to train foundation models.

Where your data lives

Customer data is stored in the European Union by default:

Compute. The platform (API, database, Redis, identity service, reverse proxy) and every deployed container run on EU cloud infrastructure operated by OVH (France). PostgreSQL and Redis are self-hosted on that infrastructure, not as separate managed third-party databases.

Object storage. Persisted logs, nightly database backups, and uploaded archives are stored in OVH Object Storage in France.

We host exclusively with EU providers that have no non-EU parent company, for compute and object storage alike (currently OVH only). If we change or add a hosting provider we update the subprocessor list below before the change takes effect.

When data can leave the EU

We do not claim that nothing ever leaves the EU. These paths can:

GitHub and GitLab. If you federate sign-in via GitHub, or connect a GitHub or GitLab repository, we call that provider’s API with your token and may clone over HTTPS at deploy time. This is customer-initiated. Codeberg (Germany) and direct archive upload are EU-local alternatives for the repository path.

Your LLM provider. Dashboard chat sends messages and tool results to the endpoint you configure. That provider’s location and terms apply.

Build-time registries. Building your image may fetch base images and packages from public registries (for example Docker Hub or PyPI). Those requests are ordinary package downloads, not an upload of your project secrets.

Supporting services. Cloudflare (DNS and certificate challenges), Let’s Encrypt (certificates), UptimeRobot and Healthchecks.io (health probes), and our EU SMTP relay for account email. GitHub, Inc. and Cloudflare, Inc. participate in the EU–US Data Privacy Framework.

Subprocessors

The parties below process personal data on our behalf or as part of the paths described above. Self-hosted components on our EU hosts (including our identity service and Redis) are not listed as separate subprocessors.

How long we keep it

Retention below is enforced in code or by object-storage lifecycle rules, not only by this document:

Security measures

Secrets, repository tokens, and LLM API keys are encrypted in-process with libsodium before storage; the master key is a Docker secret on the host, not an environment variable in the database. Containers are isolated per project on separate Docker networks, with capability drops and resource limits. TLS terminates at the reverse proxy for the dashboard, API, and every <slug>.foro.sh endpoint. This is a single-host, application-level encryption model without an external KMS: a full compromise of the host could expose the key. We state that plainly rather than overclaim.

Deleting your account

You can delete your account at any time from the account menu in the dashboard. Deletion stops and removes every container you own, purges that account’s persisted logs from object storage, and deletes your user, owned workspace, projects, secrets, deployment history, metrics, and chat history from the platform database. Deletion of that platform data is immediate and unrecoverable once completed.

Residual copies may remain in encrypted database backups for up to 30 days until those backups expire. Waitlist addresses are separate from the account; email [email protected] to remove one. If you need confirmation that a related identity record at our self-hosted sign-in service has been cleared, contact the same address.

Your rights

Under the GDPR you have the right to access, rectify, erase, and port your personal data, to restrict or object to certain processing, and to lodge a complaint with your supervisory authority. Account erasure is self-serve (see above). For access, rectification, or other requests, email [email protected]; we aim to respond within 30 days.

The service is not directed at children. If you are below the age at which you can consent to information-society services in your country (16 in many EU states, or lower where local law sets a lower age), do not use the service without appropriate parental authority.

Changes

We update this page when our processing changes and adjust the effective date above. Material changes are announced to signed-in users before they take effect.