Privacy Policy
What Idle9 collects, why, who it is shared with, and how long it is kept.
1. Who we are
Idle9 is operated by TurningMatter DBA of Colossus Rentals LLC, a limited liability company organised under the laws of the State of Texas, United States. We are the controller of the personal data described here. For any privacy question, or to exercise the rights in section 7, email [email protected].
2. What we collect
- Account details. Your email address, and your name and profile photo if you choose to set them. Authentication is handled by Clerk; we do not store your password.
- Billing details. Your subscription status, plan quantities and renewal dates, an identifier linking your account to your Stripe customer record, and — so that we can show you which card a renewal will be charged to — the brand, expiry date and last four digits of each card on your account. Card numbers, billing addresses and tax identifiers are held by Stripe, not by us — we never see or store your card number.
- Environment content. The files, installed packages and data inside your environments, and the snapshots taken when they sleep.
- Operational records. Activity timestamps used to decide when an environment should sleep, audit logs of privileged operator actions, and standard server logs including IP address, which we use for security and abuse investigation.
We do not use tracking cookies or third-party advertising or analytics on this site. The only cookies set are the session cookies Clerk needs to keep you signed in.
3. Why we process it, and on what basis
- To provide the service — account details, environment content and activity timestamps. Basis: performance of our contract with you.
- To take payment — billing details. Basis: performance of our contract, and compliance with tax and accounting law.
- To keep the service secure — server logs and audit records. Basis: our legitimate interest in preventing abuse and protecting other customers.
- To contact you about the service — your email address, for billing notices, security notices and material changes to our terms. Basis: performance of our contract. We do not send marketing email without your consent.
4. Who we share it with
We share personal data only with the providers needed to run Idle9, each acting as our processor or, where noted, as an independent controller:
- Clerk — authentication and account management.
- Stripe — payment processing, invoicing and tax calculation. Card details are collected by Stripe directly from your browser and never pass through our servers. Stripe is an independent controller of the payment data it holds, and its handling of that data is governed by its own privacy policy.
- Our hosting and infrastructure providers — the dedicated servers your environments run on, and the network in front of them.
We do not sell personal data, and we have never done so. We do not use your environment content to train machine-learning models, and we do not provide it to anyone else for that purpose.
We may disclose data where legally required, but we will notify you first unless we are prohibited from doing so.
5. Where data is processed
Idle9 runs on infrastructure located in the United States and the European Union. If you are in the European Economic Area or the United Kingdom, transfers outside your region rely on the European Commission's Standard Contractual Clauses.
6. How long we keep it
- Environment content and snapshots — for as long as your subscription is active. When a subscription ends, environments and their snapshots are permanently deleted 7 days later. The same 7-day window applies to an environment holding a storage add-on you have cancelled. Deleting your account destroys them immediately.
- Account details — until you delete your account, then removed within 30 days from our active systems.
- Billing records — retained for as long as tax and accounting law requires, generally seven years, even after account deletion.
- Server and audit logs — 90 days.
7. Your rights
You can update your name, photo and email addresses, and delete your account entirely, from your account settings. Deleting your account cancels your subscription and destroys your environments and snapshots.
Depending on where you live you may also have the right to access the personal data we hold about you, correct it, delete it, restrict or object to how we use it, receive it in a portable format, and lodge a complaint with your data protection authority. Email [email protected] and we will respond within 30 days. We do not charge for this and we will not treat you differently for asking.
8. Security
Every environment runs fully isolated from the others and can reach only its own snapshot storage. Access tokens are stored as hashes, never in plaintext, so a database compromise does not yield working credentials. Traffic is encrypted in transit. Privileged operator access to customer environments is audit-logged with the identity of the person acting.
No system is perfectly secure. If a breach affects your personal data we will notify you and, where required, the relevant supervisory authority without undue delay and in any case within 72 hours of becoming aware of it.
9. Children
Idle9 is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
10. Changes to this policy
We may update this policy. For material changes we will give at least 30 days' notice by email to the address on your account, and update the effective date above.
Contact
TurningMatter DBA of Colossus Rentals LLC
Texas, United States
[email protected]