Privacy policy

1. Who is responsible

Double Arches Ltd is the controller for personal data used to operate this public website and manage Statiq accounts. Company number: 17490713. Registered office and business contact address: Suite Ra01 195-197 Wood Street, London, United Kingdom, E17 3NU.

Privacy enquiries and rights requests: statiq@doublearches.com. Site owners are responsible for the personal data they choose to publish or collect through their own sites.

2. Visiting this website

This static website has no forms, accounts, analytics, external fonts, advertising, or marketing cookies. It does not set browser cookies or use local storage.

Delivering a page still involves processing network information. Our delivery network processes visitor IP addresses, requested URLs, timestamps, response and traffic details, and HTTP headers, which may include browser information and a referrer. Delivery, security, and logging systems process this information. We may use request logs for operations, security, and usage accounting; this is not behavioural advertising.

We rely on legitimate interests in delivering a functioning, secure website and investigating misuse. Following a link to another provider takes you to a service with its own privacy practices.

3. Using the hosting service

The hosting service processes the following data when an authorised account uses it:

Identity and access: name, verified email address, a salted password hash, short-lived email verification and recovery records, and session records. Login uses email and password; repository access is configured separately using read-only deploy keys.
Deployment data: repository and branch names, deploy keys and webhook credentials, domain names, commit metadata, source retrieved for builds, published files, and build output logs. Avoid including personal data or secrets in source or logs unnecessarily.
Usage and billing: build duration, storage snapshots, bytes served, HTTP request counts, invoices, prepaid credit and extra-usage preferences, and payment customer, subscription and transaction identifiers and statuses. Our payment reseller collects payment details; Statiq does not store full card numbers.
Communications and security: messages you send us, notification delivery information, and operational records needed to investigate faults or abuse.

Processing needed to provide your requested account, deployments, and billing relies on performance of a contract, or steps requested before a contract. Operational security and abuse prevention rely on legitimate interests. Recordkeeping and responding to lawful requests may rely on legal obligations. We do not use these records for advertising profiles.

The console uses strictly necessary authentication cookies: a session cookie lasts up to 30 days. Cookie expiry limits browser authentication; it is not a promise that all related database records are deleted at that time.

4. Service partners and data sharing

Builds and site-file storage are located in Europe. We use service partners for infrastructure, file delivery, identity and repository access, transactional email, and payments.

Infrastructure and delivery: hosting, storage, database backups, build logs, routing, and delivery of website files. Delivery partners also process request information to operate and secure the network.
Identity and repositories: your chosen Git service processes repository access under its own terms. Git-provider identities are not used for Statiq login.
Transactional email: recipient addresses and notification content are processed to deliver service messages.
Payments: our payment reseller and Merchant of Record processes purchase, tax, fraud-prevention, and payment data as an independent controller. Its privacy information is provided when making a purchase.

European builds and storage do not mean all personal-data processing takes place in Europe. Global delivery and service-partner operations may involve processing outside Europe.

Information may also be disclosed where necessary to comply with law, protect rights or security, or use professional advisers subject to appropriate confidentiality.

5. How long data is kept

Account, deployment, and billing records are stored to operate the service. Build logs are stored in object storage and the database is backed up. Contact us to request access to, export of, or deletion of your personal data.

A deletion request may be subject to lawful retention requirements, including records needed for tax obligations or disputes. We explain any delay or restriction when handling your request.

6. Your rights and complaints

Depending on the applicable law and processing basis, you may request access to or correction of your personal data, erasure, restriction of processing, portability, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it. These rights can have legal exceptions.

Use the privacy contact above; we may need information to verify your identity. You can complain to the UK Information Commissioner’s Office or, where applicable, your local data-protection authority. Contacting us first does not remove your right to complain.