Legal
Privacy Policy
Last updated
This policy explains what personal data ranx.cloud collects, why, who we share it with, and the choices you have. We've tried to keep it short and specific to how the service actually works.
1. Who we are
ranx.cloud is operated by Ali Uygur (sole proprietor), Gürselpaşa Mahallesi, 75727 Sokak, C Blok No: 12 Daire: 14, Seyhan / Adana, Türkiye ("we", "us"). We are the controller of the personal data described in this policy. You can reach us about anything privacy-related at contact@ranx.cloud.
2. What we collect
Your account
- Your email address and, if you give one, your name.
- Your password, stored only as a one-way hash by our authentication library (Better Auth). We can't read it.
- Sessions: when you sign in we store a session token, its expiry, and the IP address and browser user agent the session was created from.
Your instances
- For each instance: the app, its subdomain (
<slug>.ranx.cloud), its plan size, its status, and the dashboard username and password you set. The dashboard password is encrypted at rest (AES-GCM). - Some older instances were created when we still asked for an LLM provider and API key at setup. For those, the provider name and the key are stored encrypted in our database. New instances don't send us your key.
Billing
- Lemon Squeezy, our merchant of record, runs checkout and collects your payment details. We never see your card number. We pass your email to checkout so you don't have to type it again.
- Lemon Squeezy tells us about each subscription: its status, trial end, renewal or end dates, and links to your customer portal. We store those against the instance they pay for.
What you put into your instance
Everything you add inside an app (workflows, chats, files, memory, credentials, and the LLM provider API keys you enter in the app's own dashboard) is stored on that instance's own persistent disk, not in our database. We don't access it except where needed to operate the service (for example, to fix a fault you ask us about) or where the law requires us to. If that content includes other people's personal data, you decide what goes in and why, and we process it on your behalf to run your instance. A data processing agreement is available on request at contact@ranx.cloud.
Website analytics and ads measurement
We use Google Analytics 4 and Google Ads conversion measurement to understand how people find and use the site and whether our ads work. See Cookies for what this sets in your browser and how consent works. When a free trial starts or a payment goes through, our server also reports that event to Google Analytics (via its Measurement Protocol), together with the analytics and ad-click identifiers stored for your browser, if any, so the conversion can be counted.
Emails
We don't currently send automated emails ourselves: there are no verification, newsletter or marketing emails. Lemon Squeezy sends receipts and subscription emails as the merchant of record. If you write to us, we keep the conversation so we can help you.
3. Why we use it, and our legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Create and secure your account, sign you in | Account and session data | Performance of our contract with you |
| Deploy, run, stop and delete your instances | Instance data, content on the instance's disk | Performance of our contract |
| Run your 30-day trial and subscription | Email, subscription data from Lemon Squeezy | Performance of our contract |
| Keep the platform secure, prevent fraud and abuse, enforce our Terms | Session IP and user agent, instance data | Our legitimate interest in a safe, working service |
| Measure site usage and ad conversions | Analytics cookies, click IDs, conversion events | Your consent in the EEA, UK and Switzerland; our legitimate interest elsewhere, where permitted |
| Answer your messages | What you send us | Our legitimate interest in supporting you |
| Comply with the law and respond to lawful requests | Whatever the request covers | Legal obligation |
We don't sell your personal data, and we don't use it for automated decisions with legal effect on you.
4. Who we share it with
We use the providers below to run the service. They process data on our instructions, except Lemon Squeezy, which acts as merchant of record and is responsible for the payment data it collects.
| Provider | What it does for us | Where |
|---|---|---|
| Google Cloud (Google Kubernetes Engine) | Runs every instance: its container, isolated namespace and persistent disk | us-east1 region, USA |
| Cloudflare | Hosts the website and API (Workers), our database (D1), DNS, the tunnel in front of instances, and forwarding of mail sent to our address | USA and Cloudflare's global network |
| Lemon Squeezy | Checkout, payments, subscriptions, invoices, sales tax and VAT (merchant of record) | USA |
| Google Analytics and Google Ads | Site analytics and ad conversion measurement | USA and Google's global network |
| Google (Gmail) | Hosts the inbox our contact address forwards to | USA |
The apps you run talk to the LLM provider whose key you entered (for example OpenRouter, Anthropic or OpenAI). That relationship is between you and that provider, under their terms and privacy policy.
We may also disclose data if the law requires it, to protect the rights and safety of our users or the platform, or to a successor if the service is sold or merged (we'd tell you first).
5. International transfers
Our infrastructure is in the United States. That means your account data and the content of your instances are stored and processed in the USA, including if you're in the EU, UK or Switzerland. For these transfers we rely on the safeguards our providers offer: the European Commission's Standard Contractual Clauses (and the UK and Swiss equivalents) in their data processing terms and, where a provider is certified, the EU-US Data Privacy Framework and its UK and Swiss extensions. You can ask us for more detail at contact@ranx.cloud.
6. How long we keep it
- Account data is kept while your account exists and deleted when the account is deleted.
- Sessions expire on their own; signing out or changing your password ends them sooner.
- Instances: when you delete an instance, we cancel its subscription and delete its namespace, container and persistent disk, including everything on it. This can't be undone, so keep your own copy of anything you need. Its record in our database is removed once the deletion is complete.
- Subscription records we hold are deleted with your account. Lemon Squeezy keeps its own transaction records for as long as tax and accounting law requires.
- Analytics data is kept in Google Analytics for 2 months at event level and 14 months for user-level data, the retention set in our Google Analytics property.
- Deleted database records can remain in our database provider's short-term recovery history for a limited period of up to 30 days before they're gone for good.
You can delete instances yourself from the dashboard. Account deletion isn't self-serve yet: email contact@ranx.cloud from your account's address and we'll delete your account, your instances and the data we hold about you.
7. Your rights
Depending on where you live (and always if you're in the EEA, UK or Switzerland), you have the right to:
- access the personal data we hold about you and get a copy of it;
- correct it if it's wrong;
- have it deleted;
- restrict or object to how we use it, including use based on our legitimate interests;
- receive it in a portable format;
- withdraw consent at any time (this doesn't affect what we did before you withdrew it);
- complain to a data protection supervisory authority, in particular in the country where you live or work. In the UK that is the Information Commissioner's Office (ICO).
To use any of these rights, email contact@ranx.cloud. We'll reply within one month, and may need to confirm it's really you first. We'd appreciate the chance to sort out a concern before you go to a regulator, but you don't have to.
8. Cookies
If you visit from the EEA, the UK or Switzerland, we ask before setting any analytics or advertising cookies. Until you accept, Google tags run in Consent Mode v2 with storage denied: they set no analytics or ads cookies, and Google receives only cookieless signals. You can change your choice at any time with "Cookie settings" in the site footer. Elsewhere, analytics and ads measurement may be on by default.
| Cookie | Purpose | Type | Expires |
|---|---|---|---|
| Session cookie set by Better Auth (e.g. better-auth.session_token) | Keeps you signed in | Strictly necessary | When the session expires (7 days) |
| ranx_consent | Remembers your cookie choice | Strictly necessary | 180 days |
_ga, _ga_<ID> | Google Analytics: distinguishes visitors and sessions | Analytics (consent) | Up to 2 years |
ranx_click, storing gclid, gbraid or wbraid | Remembers which Google ad brought you here, so a later trial or purchase can be attributed to it | Advertising (consent) | 90 days |
Strictly necessary cookies don't need consent, because the site can't work without them. Google's own use of the data is described in How Google uses information from sites that use its services. The apps on your instances (on *.ranx.cloud subdomains) may set their own cookies, such as login cookies for their dashboards; those are part of the app you run.
9. Security
Each instance runs in its own container and isolated namespace with its own disk. Traffic to the site and to instances is served over HTTPS. Passwords are hashed, and dashboard passwords and any stored API keys are encrypted at rest. No system is perfectly secure, so please use a strong, unique password and keep your instance's dashboard password private. If we become aware of a breach affecting your data, we'll notify you and the authorities as the law requires.
10. Children
ranx.cloud is not meant for anyone under 16, and we don't knowingly collect their data. If you believe a child has given us personal data, contact us and we'll delete it.
11. Changes to this policy
We'll update this page when the service or the law changes, and change the "Last updated" date above. If a change materially affects how we use your data, we'll tell you in advance, by email or in the dashboard.
12. Contact
Ali Uygur (sole proprietor), Gürselpaşa Mahallesi, 75727 Sokak, C Blok No: 12 Daire: 14, Seyhan / Adana, Türkiye. Email: contact@ranx.cloud. See also our Terms of Service.