1. Who we are
Admirian Technologies Pvt Ltd, a private limited company incorporated in India, trading as ArtifactDeploy (“ArtifactDeploy”, “we”, “us”) operates https://artifactdeploy.com and the related Service and is the controller of the personal data described here. Contact us about privacy at [email protected].
2. Data we collect
Data you give us
- Account data: your email address and password. Passwords are hashed by our authentication provider; we never see them in plain text.
- Artifacts: the content, titles and settings of files you deploy. Don’t include personal data in public Artifacts unless you intend it to be public.
- Support messages: anything you send when you email us.
- Team workspaces: workspace names, members’ roles, and the email addresses of members and invitees. Members of a workspace can see each other’s email addresses and the deployments in it.
- Visits to hosted pages: for each view we record the time, the page, where the visit came from (the referring site or app, or the
via/utm_sourcetag in the link) and the visitor's country as reported by our network provider. We don't store visitors' IP addresses for this and don't use cookies to track them. Owners see these as aggregated stats. If an owner sends a personal link (one with?to=and a name they chose), views of that link are shown to the owner under that name. - Live data sources: the addresses and extraction rules you save, the data we fetch (cached so your page can show it) and any API keys you add, which are encrypted with a key held only by our servers and never shown again. Deleting the source or the deployment deletes all of it.
- Product usage: we record which features of the dashboard and the Claude connector are used (for example “created a personal link”), linked to the account, to decide what to improve. We don't record the content of your conversations with Claude.
- Public profile and templates: if you publish a template (or set up a public profile), your display name, @handle and optional bio are public, along with the template itself and its use and like counts. Your email address is never shown. We also keep likes and reports you make on templates.
Data created when you use the Service
- API keys and connected apps: keys and OAuth access tokens are stored only as one-way SHA-256 hashes, plus their names, creation date, last-used time and deploy counts. For apps you connect by signing in, we store the app’s name and redirect address.
- Usage records: deployments, deletions and view counts for each deployment.
- Technical data: IP address, browser type and request logs processed by our hosting provider for security, abuse prevention and reliability.
Payment data
Payments are handled entirely by Paddle. We do not receive or store your card details. Paddle shares with us your subscription status, plan, a customer ID and your email address so we can activate your plan.
Form submissions on our customers' pages
Pages hosted on ArtifactDeploy can include forms. When a visitor submits one, we store what they entered, the page it came from, their browser's user-agent and a one-way, daily-changing hash of their IP address (used only to limit abuse; we don't store the IP itself). For these submissions the account that owns the page is the controller and we act as its processor: we store them only to show them to that account (dashboard, export and its Claude connection), and we never use them for anything else. Questions about a submission should go to the owner of the site where it was made.
3. How we use it, and our legal bases
- To provide the Service — creating your account, hosting your Artifacts, authenticating API requests (performance of a contract).
- To bill you — activating and managing subscriptions through Paddle (contract, legal obligation).
- To keep the Service safe — preventing abuse, fraud and attacks, and enforcing our Terms (legitimate interests).
- To communicate with you — service emails such as verification, password reset, receipts and important changes (contract, legitimate interests). We don’t send marketing email without your consent.
We do not sell your personal data, and we do not use your Artifacts to train AI models.
4. Cookies
We use only strictly necessary cookies and local storage to keep you signed in to the dashboard. We do not use advertising or cross-site tracking cookies. Paddle may set its own cookies during checkout, as described in Paddle’s privacy notice.
5. Who we share data with
We use these service providers (“processors”), bound by contracts that limit how they can use your data:
| Provider | Purpose |
|---|---|
| Supabase | Authentication and database (account, API key hashes, deployment records) |
| Cloudflare | Website hosting, CDN, file storage (R2) and serving deployments |
| Paddle | Checkout, payments, invoicing and tax — Paddle is our Merchant of Record |
| Zoho Mail | Sending account emails such as verification and password reset |
We may also disclose data if required by law, to respond to valid legal requests, or to protect the rights and safety of our users and others.
6. International transfers
Our providers may process data outside your country, including in the United States and the European Union. Where required, transfers are protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
7. How long we keep data
- Account data and Artifacts: while your account is active. Deleting a deployment removes its file immediately. You can delete your whole account at any time in Dashboard → Settings, which removes your deployments, keys and account data immediately, apart from brief backup retention.
- Form submissions: until the page owner deletes them, deletes the page, or deletes their account.
- Billing records: as long as tax and accounting laws require (typically up to 7 years), held by Paddle and us.
- Security logs: kept for a limited period, normally no more than 90 days.
8. Your rights
Depending on where you live (for example under the GDPR, UK GDPR, India’s DPDP Act or California law) you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. Email [email protected] to exercise these rights — we reply within 30 days. You also have the right to complain to your local data-protection authority.
9. Security
We use HTTPS everywhere, hash passwords and API keys, restrict access to production systems, and rely on reputable infrastructure providers. No system is perfectly secure, so please use a strong, unique password and keep API keys private.
10. Children
The Service is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
11. Changes
We will post any changes to this policy on this page with a new “last updated” date, and email account holders about significant changes.