Privacy Policy

Effective: 17 November 2026

This policy explains what Sahabti collects when you use the platform at sahabti.com and its subdomains, why we collect it, how long we keep it, and what you can ask us to do with it.

Sahabti, operated by Mohammad Shhadeh, a sole trader based in Amman, Jordan, is the controller for the data described here. Where you use Sahabti to process personal data belonging to your users, you are the controller and we are your processor — that relationship is governed by the Data Processing Agreement.

1. What we collect

Account data. Your name, email address, a hashed password (we never store the password itself), your interface and email language preference, and whether your email is verified. If you sign in with GitHub or Google we receive your provider account id, email address and display name from them — never your password with that provider.

Session and security data. A session token, the IP address and browser user-agent of each sign-in, and the time of each session. This is what powers the active-sessions list in your account settings and lets you revoke a device you no longer recognise. We also count authentication attempts per IP address in order to rate-limit sign-in, sign-up, password reset and one-time-code requests.

Workspace and resource data. Workspace names and slugs, membership and roles, invitations, and the configuration of what you create: instance names, plans, engine types, network settings, snapshot metadata, domains you add, quota requests, and an audit log of who did what in the workspace.

Credentials you create. API tokens and SSH keys are stored as hashes or public keys — a token value is shown to you once, at creation, and cannot be recovered from us afterwards.

Integration data. If you connect GitHub, we store the installation id and the repositories you select, and we receive webhook events for them.

Payment data. If you buy a plan or use pay as you go, we keep a customer reference from our payment provider, the brand, last four digits and expiry of the card that pays, the billing address you enter on the Billing page, and the status and amount of each payment, invoice and refund. We never see or store full card numbers or security codes; see Payments below.

App logs you choose to keep. If a workspace turns on log retention, what its apps write to their logs is stored for the period the workspace chose. Logs can hold personal data your app writes. We process them for you, only to store them, show them back to you and delete them; we do not read, index or analyse them, and we do not use them to train anything.

Support correspondence. Whatever you send us by email.

Content on your instances. Databases, files and workloads you run stay on the instances you create. We do not read them, index them, or use them to train anything. Staff access is limited to what Who can see your data describes below.

Website analytics. Only if you accept analytics cookies on our website, Google Analytics records pseudonymous visit data: a shortened IP address, your device and browser type, and the pages you view. We use it, on the basis of your consent, to see in aggregate how the website is used. It never runs in the console, and you can withdraw at any time from Cookie settings in the site footer. The Cookie Policy has the details.

Visit statistics without cookies. We also count visits to our website on our own servers, to learn which pages are useful, and nothing is placed on or read from your device to do it. When you open a page, our server uses your IP address and browser type only to make a one-way visitor code that changes every day and to note coarse details (country, device type, browser, language, the site that linked you), then discards the address. The daily code is deleted the next day and only totals are kept, for up to 25 months. We never use this to identify or profile you or share it with anyone, and we do not count you at all when your browser sends a Do Not Track or Global Privacy Control signal.

We do not use advertising trackers, and we do not sell personal data.

2. Why we use it

Our legal bases are: performing our contract with you (running the Service), our legitimate interest in keeping the platform secure and abuse-free and in understanding which pages of our website are useful, your consent where we ask for it, and compliance with legal obligations.

3. Cookies

We set strictly necessary cookies so you stay signed in and the site remembers your language and your cookie choice. On our website only, and only if you accept them, we also use analytics cookies from Google Analytics; the console sets no analytics cookies. We use no advertising cookies. You can change your choice at any time from Cookie settings in the site footer. The Cookie Policy lists each cookie and how long it is kept.

4. Subprocessors

This list covers providers that can access customer personal data. Internal tooling that never touches it — our operator network access, monitoring and build systems — is not a subprocessor and is not listed.

The names and locations of our current subprocessors are available to customers on request at [email protected], under the Data Processing Agreement, and we notify customers of changes as the DPA describes.

Compute, storage and databases run on hardware we operate ourselves; they are not handed to a third-party cloud, except the encrypted copies the object storage provider above holds. We will name the data-centre facility, the region and where those copies are stored on request at [email protected].

5. Payments

Payments for plans and usage are processed by Paddle (Paddle.com Market Limited and its affiliates), our Merchant of Record: you buy from Paddle, and Paddle collects your card or other payment details, your tax ID and anything else it needs to charge you, directly in its own secure checkout and billing portal. Paddle uses that data as an independent controller under its own privacy notice; it is not our subprocessor.

We never see or store full card numbers or security codes. Paddle shares with us only what we need to run your billing: a customer reference, the card's brand, last four digits and expiry, and the status and amount of each payment, invoice and refund. We use it to show your Billing page, apply your plan, warn you before a card expires and tell you when a payment fails. The billing address you enter on the Billing page is passed to Paddle for tax and invoices.

We keep these billing records for as long as your account exists. When you delete your account, we delete your card details, billing address and billing notices, and keep only what tax and accounting rules require: invoices and charges with their amounts and dates, with your name and account removed, for the statutory period (see section 7). An account that still owes a payment, or has a plan that is still running, can be deleted once the balance is settled and the plan cancelled.

6. Who can see your data

Platform staff reach production only through a private network path — there is no publicly exposed operator interface — and access is limited to the people who operate the platform. We access a customer instance only to resolve a support request you raised, to respond to an abuse report, or to restore service during an incident. Actions taken from the operator console are written to an internal audit trail, and a support sign-in to your account is recorded there. You can request a record of staff access to your account at [email protected].

7. How long we keep it

We keep personal data no longer than we need it for the purpose it was collected for.

8. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to processing, or export it in a portable form. Email [email protected] from your account address. We aim to respond within 30 days; if a request is complex we will tell you and explain why we need longer.

Much of this you can do yourself: account settings let you change your details, revoke sessions and tokens, and delete your account, and an app's settings let you download or delete the logs it keeps.

If you are in Jordan you may complain to the Personal Data Protection Council at the Ministry of Digital Economy and Entrepreneurship. If you are in the EEA or UK, you may complain to your local supervisory authority.

9. International transfers

Customer workloads and their data stay on our own infrastructure, apart from the encrypted backups and kept app logs the object storage provider in section 4 holds in the region we name on request; they are encrypted before they leave our systems and the keys stay with us. The other exception is PromptOps: when a workspace turns it on, the text of its PromptOps conversations and the workspace information PromptOps reads to answer them are processed by the AI model providers listed in section 4, which may process them outside your country. Nothing is sent while PromptOps is off. If you accept analytics cookies on our website, Google may process the analytics data in the United States, under the EU-US Data Privacy Framework. Some of the subprocessors listed above operate globally, so limited account and request metadata may be processed outside your country. Jordan's Personal Data Protection Law permits such transfers where the data keeps a level of protection no lower than the law requires; we rely on the mechanism the receiving provider offers — Standard Contractual Clauses, or an adequacy decision.

10. Security

How we protect this data — encryption in transit, tenant network isolation, access control, and how to report a vulnerability — is described on the Security page.

If a personal data breach affects you, we will notify you without undue delay, and we will notify the relevant regulator where the law requires it.

11. Children

We do not knowingly collect personal data from children under 13. If you are under 18, a parent or legal guardian must agree to your use of the Service and is responsible for the account.

If you run something on Sahabti whose users include children — a game server, for example — you are the controller for those players' data, and obtaining any consent the law requires is your responsibility, not ours.

If you believe a child has given us personal data without that consent, write to [email protected] and we will delete it.

12. Changes

We will announce material changes by email to your verified address and in the console at least 30 days before they take effect. The effective date at the top of this page always reflects the current version.

13. Contact

Privacy questions and rights requests: [email protected].