How Grapthway collects, uses, hosts, and protects your data when you deploy VPS instances, run containers and apps, and use our AI features.
Who we are and what this policy covers.
Grapthway is a cloud platform that lets you deploy and manage VPS instances, run containers and applications, register domains, hold a wallet, and use AI agent and chat features. This Privacy Policy explains what personal data we process, why, how we host it, who we share it with, and the choices and rights you have. It applies to cloud.grapthway.com and all Grapthway services.
Grapthway is the data controller for the account and platform data described here. You remain responsible for the content you place inside your own VPS instances and containers.
By creating an account or using our services you agree to this policy. If you do not agree, please do not use the platform. Where the law requires consent (for example certain cookies), we ask for it separately.
The categories of personal data we process.
When you register we collect your name, email address, and phone number, plus optional details such as address and preferences (theme, language). We also store authentication data (hashed password and session tokens). We never store your password in plain text.
Grapthway settles payments on a blockchain wallet. We process your wallet address, token balances, transaction references, deposits, and billing history so we can price, charge, meter, and refund your usage. Blockchain transactions are recorded on a public ledger by design and are not controlled by Grapthway.
To provision and operate your services we store configuration and metadata for your VPS instances, containers, domains, deployments, and repositories — names, sizes (CPU/RAM/disk), regions, SSH ports, status, and job logs. Files, code, databases, and other content you place inside your VPS instances belong to you; we store them so your workload runs, but we do not inspect them except as needed to operate the service or as required by law.
When you use AI agent or chat, we process the prompts, messages, files, and project context you send, together with usage metrics (model, tokens, cost). Prompts you submit to AI features are forwarded to the AI model provider that serves your chosen model in order to generate a response (see Sharing below).
Like any online service we automatically collect technical data: IP address, device and browser information, timestamps, and activity/access logs. We use these for security, abuse prevention, debugging, and to keep the platform reliable.
The purposes and legal bases for processing.
We use your data to:
We process data to perform our contract with you (running the service you signed up for), for our legitimate interests (security, fraud prevention, product improvement), to comply with legal obligations, and, where required, based on your consent (which you can withdraw at any time).
Grapthway does not sell your personal data, and we do not use the private contents of your VPS instances for advertising.
Where and how your workloads are hosted.
Your VPS instances and containers run on physical servers we lease from third-party data-center providers in the regions you choose (for example Indonesia and Singapore). Grapthway operates the platform, provisioning, isolation, and orchestration on top of that leased capacity; the underlying data-center facilities, hardware, power, and network are operated by those providers under their own security and privacy commitments.
Each VPS instance runs as a kernel-isolated, per-tenant container with its own filesystem, firewall rules, and resource limits, so one tenant's workload is separated from another's. You control what runs inside your instance and who can access it (for example via SSH and the ports you open).
By selecting a region for a VPS instance you determine where that workload's data is stored and processed. Platform account and billing data may be processed in the region where our core services and databases operate.
Who we share data with, and why.
We share the minimum data necessary with providers that help us run the platform:
These providers may only use the data to perform services for us.
We may disclose data if required by law, court order, or a valid government request, or where necessary to protect the rights, property, or safety of Grapthway, our users, or the public — for example to investigate abuse or fraud.
If Grapthway is involved in a merger, acquisition, or asset sale, your data may be transferred as part of that transaction. We will notify you of any change in control or use of your personal data.
Cross-border processing of your data.
Grapthway and its providers may process your data in countries other than your own — including the region you choose for a VPS instance and the locations where our platform services and AI providers operate. By choosing a region and using the service, you understand your data may be processed in those locations, with safeguards appropriate to the data involved.
How long we keep data and when it is removed.
We keep your account and workload data for as long as your account and subscriptions are active. When a subscription ends, the VPS enters a grace period; after it, the VPS and its data are permanently removed. Ephemeral AI chat sandboxes are auto-erased after a period of inactivity. Some records — such as financial and transaction history — are retained longer where the law requires.
You can delete individual VPS instances, containers, and chat sessions at any time, and you may request deletion of your account. On account deletion we remove your personal data except where we must retain limited records to comply with legal, tax, or security obligations.
How we protect your data.
We protect data with:
No system is perfectly secure. We work to protect your data but cannot guarantee absolute security.
You are responsible for what runs inside your VPS instances, for the credentials you set (SSH, app secrets), and for keeping your account login safe. Choose strong passwords, protect your keys, and only expose the ports you need.
The controls you have over your data.
Subject to applicable law, you may:
To exercise these rights, contact us at support@grapthway.com. We may verify your identity before acting on a request.
Age limits on our service.
Grapthway is not intended for children. You must be of legal age to enter a contract in your country (and at least 18) to hold an account. We do not knowingly collect personal data from children; if you believe a child has given us data, contact us and we will remove it.
Updates to this policy and how to reach us.
We may update this Privacy Policy as our services and the law evolve. We will change the "Last updated" date above and, for material changes, provide additional notice. Continued use of the service after an update means you accept the revised policy.
Questions or data requests? Email us at support@grapthway.com and we will respond as soon as we reasonably can.