Infra privacy policy
Personal-data categories, purposes, legal bases, recipients, international transfers, retention, and individual rights for Infra.
Last revised: October 23, 2026
This Privacy Policy ("Notice") describes how Solarius B.V. ("Solarius") processes personal information about account users, business contacts, service visitors, support correspondents, and people whose information is processed through the service. Contact dpo@solarius.me for privacy matters and legal@solarius.me for the provider's registered-address and contractual details. For purposes of this Notice, personal information includes information relating to an identified or identifiable individual under applicable data-protection law. This Notice provides transparency about processing; it does not constitute blanket consent or vary an accepted data-processing agreement.
Who decides how information is used
Solarius acts as controller for its business relationship, account administration, billing, communications, and the proportionate security records needed for its own service operations. Solarius acts as processor, or as an authorized subprocessor, for personal information in customer data processed on the customer's instructions. The Data Processing Addendum defines that relationship. A customer's configuration does not make Solarius the controller of every employee or end-user record it holds.
The customer controls its purposes, users, collection settings, integrations, publication, and retention within the service scope. An organization administrator can see membership and activity allowed by their role. Contact the relevant customer for requests concerning its dataset; Solarius helps the customer meet its obligations and does not give an unrelated requester access to its records.
What Solarius collects and where it comes from
Solarius processes these data categories from the specified sources:
| Category | Examples and source | Main use |
|---|---|---|
| Account and identity | Name, work email, organization, role, authentication and recovery records; supplied by you, your administrator, or your chosen identity provider | Sign-in, membership, authorization, recovery, and account protection |
| Business and billing | Payer name and address, tax identifiers, purchased quantities, invoices, transaction references and payment outcomes; supplied by business contacts and payment providers | Contract administration, payment collection, accounting, and fraud prevention |
| Service interaction | IP address, browser or client details, request time and ID, security events, and administrative activity; generated through use | Service delivery, reliability, security, abuse investigation, and audit |
| Support and correspondence | Contact information, messages, attachments, incident context, and correspondence history; supplied by the requester | Investigating and answering the case and maintaining an accountable record |
| Product customer data | resource and project identifiers, host inventory, images and workload data, addresses, deployment configuration, secrets, metrics, journals, audit events, remote-session recordings, snapshots, and backups; supplied by customers, their users, configured collectors, targets, and integrations | Contracted Infra operations under customer instructions |
| Preferences and communications | Notification choices, consent or objection records, subscription preferences, and delivery outcomes | Respecting choices and sending requested or required communications |
Payment providers collect payment credentials through their own payment flows. Solarius uses payment references and outcomes for billing; do not send full card details, payment authentication codes, or unrelated identity documents in a support ticket. Information obtained from an enabled directory, security feed, or other integration remains limited to the integration's stated purpose and permissions.
Infra data and deployment boundaries
Infrastructure metadata can identify people through user IDs, IP addresses, labels, hostnames, access events, and recorded sessions. Hosted workload disks, object contents, snapshots, and backups are customer data processed to provide the selected services. Solarius does not inspect workload content for advertising or unrelated commercial profiling.
Remote-session recording applies only to configured recording workflows; it is not implied by every SSH or RDP connection. Customers must notify participants and restrict recording access. Secrets and customer-managed keys require separate access and recovery controls. Do not put live secrets in labels, support messages, or public images.
A self-hosted control plane stores its configured data on the customer's infrastructure. A Connector exchanges the information needed to operate selected hosted resources. Local disk contents are not uploaded merely because a Connector is enabled; a configured hosted workload, copy, backup, or support submission can transfer content. Compute location does not by itself determine the location of billing, management metadata, logs, backups, or support records. Review data residency.
Purposes and legal bases for Solarius's controller activities
Where Solarius acts as controller, it shall process personal information only on a lawful basis applicable to the specified purpose. Article 6(1)(b) GDPR applies to processing necessary to perform a contract with the individual or take requested steps before contracting. For a business customer's employees and representatives, account administration, service reliability, support, and proportionate fraud and abuse prevention generally rely on Article 6(1)(f) GDPR: Solarius's legitimate interests in operating a secure contracted service and administering that relationship. Reliance on legitimate interests requires assessment against the individual's rights and reasonable expectations and does not authorize unrelated collection.
Processing necessary to meet applicable accounting, tax-retention, or binding legal-process obligations relies on the relevant legal obligation, including Article 6(1)(c) GDPR when applicable. Optional communications, tracking, and other activities requiring consent shall begin only after valid consent has been obtained under applicable law. Solarius shall retain evidence of the choice and permit withdrawal without affecting the lawfulness of processing before withdrawal. Customer's instructions do not substitute for Solarius's controller legal basis or Customer's own lawful basis for collection.
Solarius does not sell personal information, share it for cross-context behavioral advertising, or use sensitive personal information to infer unrelated personal characteristics. Solarius does not use customer content to train general-purpose AI models. Solarius can use statistics that no longer identify people or customers to understand capacity and reliability; pseudonymous identifiers remain protected personal data and are not treated as anonymous merely because names were removed.
Who receives information
Access is limited to authorized personnel and contracted providers who need it for the relevant service, support, security, legal, or billing function and are bound by appropriate duties. The DPA governs the customer-data register, review, change notices, and objections; its transfer provisions govern restricted routes. Hosting, communications, payment, identity, and support providers have different roles; not every business supplier is a subprocessor of customer content.
Your administrators and selected recipients receive information within their assigned scope. Your enabled ticketing, storage, notification, identity, or reporting integrations receive the categories needed for the configured action. A provider you independently choose operates under your agreement with it. Public content you choose to publish is available to its audience, including external search and archive services.
Solarius discloses information when a verified, binding legal requirement applies, limited to the required scope and subject to available challenges and customer notice. Solarius can share necessary records with professional advisers bound by confidentiality or with an actual business successor under protections consistent with this notice. A corporate sale does not turn customer data into a general marketing asset.
Locations and international transfers
A selected workload or storage region does not locate every account, support, billing, backup, edge-processing, or integration system. The accepted deployment schedule and subprocessor register identify applicable processing locations and access countries. Solarius does not represent that selecting a region creates universal localization.
Restricted international transfers require a valid mechanism and any necessary supplementary measures before processing begins. Depending on the actual route, that can be a relevant adequacy decision or completed contractual safeguards. A reference to standard contractual clauses does not mean an incomplete transfer schedule is effective. Ask dpo@solarius.me for the relevant safeguards and a copy or meaningful description, subject to lawful redaction.
Retention, security, and incidents
Solarius retains information only for its documented service, security, business, or legal purpose, using the retention and deletion schedule. Product history, raw artifacts, backups, audit records, support cases, and tax records can have different lifetimes. A limited preservation obligation can delay deletion of affected records; it does not authorize new unrelated use. Copies you download or send to your own providers have their own lifecycle.
Solarius uses risk-appropriate access controls, authentication, confidentiality duties, protected transmission, supported encryption, logging, change controls, and recovery arrangements. These safeguards are proportionate to risk and do not constitute a warranty that unauthorized access, loss, or interruption is impossible. Solarius remains subject to its express security commitments and mandatory obligations. Personal-data incidents follow applicable notification law and the DPA; a product alert is not automatically a breach of Solarius systems. Report suspected compromise to help@solarius.me and vulnerabilities through security disclosure.
Your choices and rights
Depending on applicable law and Solarius's role, you can request access and a copy, correction, erasure, restriction, portability, an objection, withdrawal of consent, or an explanation and review of a significant automated decision. You can object to direct marketing at any time. Essential security, contractual, and billing notices can continue because they serve a different purpose. Solarius does not condition service or fair treatment on waiving a statutory privacy right.
Email dpo@solarius.me with the relevant account, product, relationship to the data, and requested action. You can also submit a privacy request through help@solarius.me. Solarius verifies identity and authority proportionately, requests only necessary additional information, and accepts authorized agents subject to lawful verification. Solarius does not routinely require government ID when a less intrusive method is sufficient. Solarius explains a refusal, partial response, fee, or extension when law requires; ordinary requests have no charge.
For GDPR requests, Solarius responds without undue delay and ordinarily within one month. Where legally justified, an extension of up to two additional months is explained within the first month. Other jurisdictions' applicable deadlines and appeal routes govern their requests. For customer-controlled information Solarius refers the request to the customer and assists it rather than independently changing its dataset. An organizational data export and an individual's access request are separate scopes.
Solarius does not make decisions about individuals that produce legal or similarly significant effects solely through automated processing for Solarius's own account-administration purposes. Automated defensive checks can restrict suspicious activity; affected users can contact support for human review. Customers using Infra must independently assess their own decision processes, notices, and review duties.
California and other US state rights
Where a state privacy law applies to Solarius's processing, the data categories describe information collected and disclosed for the listed business purposes during the preceding 12 months, to the extent Solarius operated the service during that period. Solarius does not sell or share it for cross-context behavioral advertising and does not knowingly sell or share information about people under 16. Sensitive information is used only for the requested service and permitted security, legal, or administrative purposes, rather than unrelated inferences.
Eligible residents can request access, correction, deletion, portability, and other applicable rights through the privacy-request channels without unlawful discrimination. Solarius honors legally required universal opt-out signals for activities to which they apply; such a signal does not disable security or requested service processing. If Solarius denies a request and an appeal right applies, reply to dpo@solarius.me with "Privacy appeal" and the request reference for review. You can also complain to the competent state authority. When Solarius acts as a service provider, requests about the business customer's data are coordinated with that business.
Browser storage, children, and changes
Cookies and browser storage describes necessary sessions, preferences, local storage, and choices for optional technologies. Browser push permission and subscriber confirmation are separate from permission to use optional tracking. The business services are intended for adults acting in a work capacity, not accounts directed to children. If Solarius learns of an account created by a child without a lawful basis, Solarius investigates and takes appropriate protective action. Customer workloads containing children's data require the customer's own lawful basis and appropriate safeguards.
You can complain to your competent supervisory authority, including the Dutch Autoriteit Persoonsgegevens. Contacting Solarius first is optional. Material changes to this notice are communicated directly or through a prominent relevant notice with their effective date. A materially incompatible new purpose requires its own lawful basis, prior transparency, consent when required, and any necessary contractual authority. Revision of this Notice alone shall not authorize that processing or diminish an accrued or mandatory right.