Privacy policy

Hetscale is operated by Ahmet Bora, a sole proprietorship registered in Türkiye, Golden Tulips Residence No: 145/29, Kartal/İstanbul, Türkiye. We decide what the data described here is used for, except where we process it for your organisation as its processor. Write tosupport@hetscale.com about anything on this page.

This site sets no cookies and writes nothing to your browser's local or session storage. That is verifiable in the site's own build, and it is why there is no consent banner: there is nothing to consent to.

Page views are counted with Umami, a cookieless analytics tool, hosted in the EU. Umami states that it does not use cookies, does not collect personal data and does not track visitors across websites. The site records exactly two events: a click on the "Connect read-only" call to action or on the button that opens the explainer video, and a use of the cost calculator. Umami keeps each page view's address with its query string. A link in one of our posts on X or LinkedIn adds campaign parameters to it (utm_source, utm_medium and, on X, utm_content) that name the network and, on X, which of our accounts posted the link; a shared calculator link adds the calculator's own parameters. None of them says anything about you. Umami records nothing else.

Cloudflare, which serves this site, also measures page views and page speed with Cloudflare Web Analytics, through a small script Cloudflare adds to the pages it serves. Cloudflare states that this script uses no cookies and no local storage and does not fingerprint visitors. No other third-party script is loaded.

The calculator's results can be shared as a link. That link carries only the calculator's own parameters (server type, server count, traffic profile); it contains no personal data.

The site is static files served by Cloudflare. Cloudflare processes the requests it serves under its own terms; this site adds nothing to them and keeps no server logs of its own. The explainer video is served from media.hetscale.com, a Cloudflare R2 storage bucket; it sets no cookie, and your browser fetches it only when you open the video.

A link to the application from this site or from one of our posts carries a ref parameter naming the page or channel it came from, so we can tell which page or channel led to a trial. That is the only thing the site passes to the application. The application keeps that name with the organisation you create and, when an ad link brings you there, that link's campaign parameters (utm_source, utm_medium, utm_campaign, utm_term and utm_content); a later visit changes neither. None of it is about you as a person.

When you sign up on app.hetscale.com we keep your name, your email address, a hash of your password, the time zone you may pick to show times in, the organisations you create and your membership in them; if you add an authenticator app, also its secret, encrypted, and its recovery codes, as hashes. We use them to run your account and to send the mail the application sends: address verification, password resets, a notice when GitHub or Google starts signing you in, and alerts about your own groups. The owner of an organisation may also get a personal note from us about that organisation's own account, such as help towards going Live, a trial about to end or a payment that failed; to write it we look up the owner's name and address, and each look-up is recorded. We send no marketing mail.

If you sign in with GitHub or Google, they send us your basic profile: your name, your email address and their id for your account. We accept only an address they have verified, use the name and the address for your account, keep their id to recognise you and keep no GitHub or Google token. GitHub and Google are not our processors here: you choose to sign in with them, under their own terms.

The application sets only the cookies it needs: one that keeps you signed in, one that protects its forms against cross-site requests and, if you tick "Remember me", one that keeps you signed in longer. It loads no analytics or advertising script. On the billing page it loads Paddle's checkout script, and what you enter there goes to Paddle.

The API tokens you connect are stored encrypted. With them the application reads your servers, load balancers, networks and their metrics and, once a group is Live, acts as theterms describe. It keeps what it reads and the timeline of what it did, to run your groups and show you their history. This is data about your infrastructure; it holds personal data only where you put some into names or labels. We process this data, and the record of what your members do in your organisation, for your organisation as its processor, under the data processing agreement.

The read-only token of an Observe trial is deleted 7 days after the last trial on its project ends. A read-only token that never starts a trial is deleted 21 days after you connect it, and one you give to refresh a report 7 days after that report is ready. You can have it deleted earlier by erasing it on the project page, replacing it with a new token or archiving the project; the report is kept. A trial is identified by the ids of your Hetzner servers and load balancer, not only by the email address you signed up with.

Paddle.com, the merchant of record, handles payments: your card or other payment details and your billing address go to Paddle, never to us, under Paddle'sprivacy notice. We keep your Paddle customer id, the billing email, your plan and its status, and each invoice's number, amount and status, to show them on the billing page.

When an organisation is deleted, its billing name and email are erased. Its Paddle customer id, plan and invoices (number, amount, dates) stay, without them, until our accountant confirms the law no longer requires them; Paddle keeps its own records as the merchant of record.

Mail you send to support@hetscale.com is kept in our mailbox, which Google Workspace runs. The application's servers log requests, including IP addresses, to keep the service secure and to find faults, and keep those logs only as long as these purposes need.

Hetzner Online GmbH runs the application's servers and backups in the European Union. Amazon Web Services delivers the application's mail from Frankfurt (Amazon SES), keeps the off-site copies of its backups there (Amazon S3) and holds there the master key that protects the tokens and secrets you give us (AWS KMS). Google runs the support mailbox. Cloudflare serves this website, measures its page views and speed, serves our DNS and runs the network in front of the application, so every request to app.hetscale.com and api.hetscale.com passes through it. Umami counts this website's page views in the EU. Instatus runs our status page at hetscale.instatus.com. Paddle.com handles payments as the merchant of record, a controller in its own right. Each receives only what its part needs.

The application's data is stored in the EU, on Hetzner servers in Germany. We run Hetscale from Türkiye, so we reach that data from outside the EU. Cloudflare is a company in the United States, and the parent companies of Amazon Web Services and Google are there too. Each receives data under the EU–US Data Privacy Framework or the standard contractual clauses in its data processing terms.

What we process for your organisation, as its processor, and the sub-processors we use for it are in the data processing agreement.

Your account data stays while your account exists. To delete your account or an organisation you own, write to support@hetscale.com from your account's address; we delete it within 30 days. An organisation goes with all its data, its audit log included, once its subscription is cancelled. Your account goes with the organisations you own alone, their subscriptions cancelled first; one you own with other members passes to one of its admins first, or is deleted on its own request. The servers, snapshots and placement groups Hetscale created in your Hetzner projects stay there with their labels, and our answer says how to delete them.

Each organisation has an audit log of the changes made in it, with the names of the members who made them and the addresses that were invited. It is kept for a year as the organisation's security record, and it is deleted with the organisation. A member who leaves an organisation, or deletes their account while the organisation remains, stays named in its audit log until those entries are a year old.

Every backup is kept for at most 30 days, so deleted data leaves the backups within 30 days of its deletion. An address that bounced or reported our mail as spam stays on our mail suppression list, with the reason alone, so that we never mail it again.

We may keep statistics that identify no one, such as how many servers were created in a month.

You can ask to see, correct, export or delete your personal data, or object to or restrict how we use it. Write to support@hetscale.com; we answer within 30 days. These rights come from the EU's General Data Protection Regulation where it applies to you, and from Türkiye's Personal Data Protection Law (KVKK).

You can also complain to a data protection authority: in Türkiye the Kişisel Verileri Koruma Kurumu, in the EU the authority of your country.

Last updated 2026-10-28