Privacy policy
Which personal data Stagely collects, why, where it goes and how long it stays, which cookies the console sets, and how to use your privacy rights.
Effective date: 12 October 2026
Yaroslav Kravtsov, Latvia (“Stagely”, “we”) is the controller of the personal data that this policy describes. Email support@stagely.dev with any question about it. We have no data protection officer.
This policy covers the site at https://stagely.dev, the console, the API and the MCP endpoint at https://app.stagely.dev, and email with us.
It does not cover:
- Data in your own cloud accounts, such as your stagelets, secret values, images and source code. Stagely does not receive it. The security model shows what stays in your cloud.
- Personal data that a customer puts into Stagely, such as in config values or deploy logs. For that data, we act for the customer under the Data processing agreement.
What we collect and why
| Data | Where it comes from | Why we use it | Legal basis | How long we keep it |
|---|---|---|---|---|
| Your GitHub user ID, login, name, public email address and avatar URL | GitHub, when you sign in with GitHub | To sign you in, to show who is a member, and to contact you | Contract | Until you ask us to delete it |
| The time you signed up and last signed in | The console | Security and support | Legitimate interest | Until you ask us to delete it |
| Your membership and role in each Stagely account | The owner or an admin of that account | To control what you can see and do | Contract | Until you leave the account |
| The email address of a person whom a member invites | The member who invites | To deliver the invitation | Legitimate interest | The invitation expires after 7 days |
| Sessions and sign-in grants, stored only as hashes of their tokens | The console, the CLI and MCP clients | To keep you signed in | Contract | A console session lasts 7 days. A CLI or agent grant lasts 1 hour. |
| Your Stripe customer ID, plan and subscription state | Stripe | Billing | Contract and legal obligation | As long as the account exists, and then as tax law requires |
| Log lines with your GitHub login and user ID when you sign in | The control plane | Security and fixing faults | Legitimate interest | For the retention period of our Better Stack log source |
| Your emails to us | You | To answer you | Legitimate interest | As long as we need to answer and follow up |
To use the console, you must sign in with GitHub. Without your GitHub user ID and login, we cannot give you an account.
Link, LLC and Stripe collect your payment card and billing address when you subscribe. They do this as independent controllers under their own privacy policies. We never see full card numbers.
We do not make decisions about you by automated means alone, and we do not sell your personal data.
Cookies
https://stagely.dev sets no cookies and uses no analytics.
https://app.stagely.dev sets two cookies, and both are strictly necessary:
| Cookie | Set by | Purpose | Lifetime |
|---|---|---|---|
__Host-stagely_session |
Stagely | Keeps you signed in to the console | Until you close the browser |
__cf_bm |
Cloudflare, in front of our hosting provider | Tells people from bots | 30 minutes |
Who receives your data
We use these service providers. They process personal data only on our instructions. The subprocessor list names each one, with its purpose and location.
- DigitalOcean hosts the control plane and its database.
- Better Stack stores the control plane’s logs.
- Cloudflare serves
https://stagely.devand runs its DNS. - Stripe and Link, LLC handle payments, invoices and taxes.
- Proton stores our email.
GitHub receives what you share with it when you sign in. It is an independent controller.
Transfers outside Europe
Our servers are in the United States. When we transfer personal data from the EU, the EEA or the UK, we use the EU–US Data Privacy Framework and its UK extension where the recipient is certified. Otherwise we use the European Commission’s standard contractual clauses, with the UK addendum for UK data.
Your rights
You can ask us to give you a copy of your personal data, to correct it, to delete it, to limit how we use it, or to send it to you in a machine-readable format. You can also object to our use of it based on legitimate interest. Email support@stagely.dev. We answer within one month.
The console has no button that deletes your account. To delete it, email us.
If you think we use your data unlawfully, you can complain to the data protection authority where you live or work.
California
The table above lists the categories of personal data that we collect, and the list above names who receives it. We do not track you across other sites, and no other party tracks you across sites through ours. So a browser’s Do Not Track signal changes nothing here. To review or correct your data, email us.
Children
Stagely is for businesses. It is not for anyone under 16.
Changes
We publish each new version of this policy on this page, with a new effective date. Before a material change applies, we email the owners of Stagely accounts.