Privacy Policy
Effective 18 October 2026
The short version
- We collect what we need to run your account and bill you: your email address, your public keys, your plan and your usage.
- Your account data and your VM disks are on servers we rent from Hetzner in Falkenstein, Germany. We do not encrypt the disks.
- A short list of sub-processors runs the servers, payments, email and DNS. We do not sell personal data and we do not use advertising or analytics trackers.
- For data inside your VMs you are the controller and we are your processor (see the DPA).
1. Who is responsible
The controller for the processing described here is [legal name], [registered address], hi@turm.dev. Write to that address for anything about your personal data.
2. Controller or processor
This policy covers personal data we decide about: your account, billing, support and the operation of the service. Files, databases, prompts and websites on your VMs are your content. For personal data in it, you are the controller and we process it only on your instructions, under the Data Processing Agreement. If you are someone whose data a customer stores on Turm, please contact that customer first.
3. What we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email address, account status, plan, sign-up date | Create and run your account, send login links and service notices | Contract, Art. 6(1)(b) |
| SSH public keys and their labels | Sign you in. We never receive your private keys | Contract, Art. 6(1)(b) |
| Login sessions, stored only as a hash | Keep you signed in to the dashboard | Contract, Art. 6(1)(b) |
| VM names and settings, assigned IP addresses, VM SSH host keys, email addresses you share a VM with | Run, reach and share your VMs | Contract, Art. 6(1)(b) |
| Usage: running time, CPU, disk, network traffic and model gateway token counts | Apply plan limits and see how much capacity is in use | Contract, Art. 6(1)(b) |
| Stripe customer ID and subscription status; name, billing address and VAT ID entered at Stripe checkout | Take payments, calculate tax, issue invoices | Contract, Art. 6(1)(b); legal obligation for tax records, Art. 6(1)(c) |
| IP addresses of requests (held in memory for rate limiting; they can also appear in operational logs on our servers) | Rate limiting, keeping the service secure, finding and fixing faults | Legitimate interest in a secure, working service, Art. 6(1)(f) |
| DNS lookups and resource use of VMs (not their content) | Detect abuse such as crypto-mining and protect other customers | Legitimate interest, Art. 6(1)(f) |
| Messages you send us | Answer you and keep a record of support requests | Contract, Art. 6(1)(b), or legitimate interest, Art. 6(1)(f) |
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Automated abuse signals can slow down a VM's CPU; suspending an account for abuse is decided by a person.
4. Where your data is stored
The control plane, its database and all VM disks are on servers we rent from Hetzner Online GmbH in Falkenstein, Germany. VM disk replicas are kept on the same servers.
5. Who receives data
We share personal data only with the sub-processors listed there, each for its stated purpose and under a data processing agreement, and with authorities where the law obliges us. If you connect an integration such as GitHub, data goes to that service at your instruction and under your own agreement with it.
6. Transfers outside the EU
Stripe and Cloudflare are part of groups based in the United States, so some account data may be processed there. The transfer is covered by that company's own data processing terms, named on the sub-processor list.
7. How long we keep data
- Account data stays while the account exists. There is no button that deletes an account. When you ask us to close it, we delete the VMs and the account data, except records tax law requires us to keep.
- VM disks stay until you delete the VM. Deleting a VM deletes its disk, its replica and its console log.
- The link that confirms a new email address expires after 24 hours. A later login link expires after 30 minutes. Dashboard sessions expire after 7 days.
- Billing and tax records: as long as tax and commercial law requires, usually up to 10 years.
- Operational logs: on our servers only, overwritten as the system journal reaches its size limit.
- Database dumps: one per weekday, on the same server, so a dump is overwritten after 7 days.
8. Security
We protect data with the measures described in the trust center, including encrypted connections, isolated virtual machines, hashed session tokens and restricted administrative access.
9. Your rights
You have the right to access your personal data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on legitimate interest (Art. 15 to 21 GDPR). Where processing relies on consent, you may withdraw it at any time. Write to hi@turm.dev. We answer within one month. You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work.
10. Cookies
We set only cookies that are needed for the service to work, and no tracking or advertising cookies. Details are in the cookie notice.
11. Children
The service is not meant for anyone under 18, and we do not knowingly collect data from children.
12. Changes
We will update this policy when our processing changes and change the date at the top. If a change matters for you, we will email you before it applies.