Privacy notice
Effective date: September 24, 2026. Infrastructure disclosure updated October 26, 2026.
1. Responsibility and contact
Amerged B.V., KVK 42154221, Venray, Limburg, NL, operates ohmyho.st. We are the controller for personal data used to operate our website, manage accounts, answer enquiries, administer billing and protect the service. Use our contact form for all privacy questions and requests to exercise your rights.
When a customer uses ohmyho.st to process personal data in an application, the customer determines its purposes and lawful basis. We process that customer data on documented instructions under our Data Processing Agreement. If your question concerns an application hosted by a customer, contact that application's operator; we assist our customer with requests concerning data processed for them.
2. What we process and why
| Activity | Data | Purpose and legal basis |
|---|---|---|
| Optional website and docs analytics | Page paths, referrer, browser/device and approximate location information, pseudonymous visitor/session identifiers, engagement, outbound clicks and downloads | Understand use of our public content with Google Analytics; only after consent, Article 6(1)(a) GDPR; withdraw through the footer cookie settings |
| Website delivery and security | Network address, request time, requested resource, browser/protocol information and necessary security events | Deliver pages, prevent abuse and diagnose faults; our legitimate interests in a secure, available service, Article 6(1)(f) GDPR |
| Earlier interest registrations (closed) | Email address, submission time and the consent version accepted at the time | Registration closed when public signup opened: we collect no new registrations and only keep existing records until they expire; consent, Article 6(1)(a) |
| Referral and signup source | The entry link’s r value, aggregate campaign observations, and the source associated with a verified signup | Remember the selected entry and administer configured referral eligibility; Article 6(1)(b) for requested benefits, and Article 6(1)(f) for proportionate acquisition analysis |
| Roadmap votes | Selected topic and positive, negative or removed choice, hashed random browser identifier, request identifier and submission time | Save and restore your requested vote and prevent duplicate retries; legitimate interests, Article 6(1)(f); this is not proof of a unique person |
| Contact and privacy requests | Name, email, optional company, message, request identifier and timestamps | Answer your request; Article 6(1)(b) for contract-related enquiries, Article 6(1)(f) for other correspondence, and Article 6(1)(c) for statutory requests |
| Accounts and access | Name, email and verification status, account/organisation identifiers, login and membership information, authorisations, token metadata and security records | Provide and secure the account; Article 6(1)(b), or Article 6(1)(f) when you represent a business customer |
| Hosting operations | Authorised repository/commit metadata, project configuration, deployment events, diagnostics and measured consumption | Deliver, support and account for requested services; contract performance or our legitimate interests in administering a business customer relationship |
| Billing | Billing address and optional business tax ID, customer/invoice/payment references, credits, subscriptions, refunds, recharge settings and recorded payment consent | When billing is enabled for your account, calculate applicable tax, administer authorised purchases and fulfil accounting obligations; Articles 6(1)(b) and 6(1)(c) |
We receive these data from you and your authorised agents, your requests to the service, and the identity, repository, infrastructure or payment provider involved in your selected workflow. Project and user identifiers in a prompt do not themselves authorise access.
Providing contact details is necessary for us to respond. Company is optional for individuals. Do not include passwords, access tokens or unnecessary sensitive information in a message. We do not use the contact form to create a hosting account or enrol you in a marketing newsletter.
3. Customer applications and agents
Customers control the personal data their applications collect, including their own authentication, application content and uploaded files. The DPA describes our processing of that data. Customers must provide their own notices and obtain any permissions required for their applications.
You choose the agent or harness used with the CLI, API or MCP. Data you provide to that agent, and data you authorise it to retrieve, is also handled under your arrangements with its provider. A hosting login is separate from an application's end-user login. We do not use customer application content to train a general-purpose AI model.
4. Recipients
We limit access to authorised personnel and service providers whose access is needed for their role. Cloudflare provides website/edge delivery, security, application builds, execution, SQL export jobs and R2 storage including database backups; Contabo GmbH hosts active managed PGCF PostgreSQL infrastructure for customer applications. Neon continues to host our platform control databases for account, project, deployment and usage records, and retains pre-migration application databases until separately deleted. Resend (Plus Five Five, Inc.) sends and receives transactional mail for projects that configure a mail domain, and sends our account notices by email, such as credit-balance warnings to an organisation's Owners. We no longer use AWS directly; Neon and Resend run parts of their services on AWS. WorkOS provides our account authentication and authorisation services. GitHub supplies repository access authorised by the customer and, when selected, account sign-in. Google provides Google sign-in when selected and Google Analytics for website and docs visits only after analytics consent. Login providers share identity, profile and email information with WorkOS to authenticate your account. Mintlify hosts our public documentation and its search functionality; documentation visits, searches and messages submitted to its assistant are processed for that purpose, so do not submit credentials or private customer records there. When payments are enabled, Stripe handles payments, subscriptions, invoices and tax calculation; payment credentials entered in Stripe’s checkout are handled by Stripe, not stored as full card details in the hosting account.
The provider register distinguishes workload subprocessors from providers used for our own account and business administration. Customer-selected authentication, agent and integration providers are governed by the customer's own arrangements. We do not sell personal data, and we do not use advertising pixels or cross-site marketing trackers on ohmyho.st or app.ohmyho.st. Documentation at docs.ohmyho.st is hosted by Mintlify; its own cookies and service telemetry are governed by its applicable privacy terms.
We disclose data where required by applicable law or a binding request, and assess the validity, scope and available means of challenge before disclosure where permitted. We may disclose relevant records to professional advisers bound by confidentiality when necessary for a legal claim or obligation.
5. International processing
Amerged B.V. is established in the Netherlands. New projects choose a US or EU region for their PGCF application database, new files and builds, with US as the default. Existing application databases moved with their owner's authorization use PGCF on Contabo infrastructure in the US. Cloudflare R2 stores files and backups, and existing objects retain their recorded physical locations through a database migration. Our active Neon control databases retain their existing EU placement. Retained application databases and records remain at their original Neon locations until separately deleted. Transactional mail is processed and stored in the US by Resend. Edge delivery, support and operational processing can have other locations; the service is not EU-only storage. See the subprocessor list for the services used.
Restricted transfers require an applicable adequacy decision or another valid Chapter V safeguard, including the European Commission's Standard Contractual Clauses where needed. An adequacy mechanism, such as the EU–US Data Privacy Framework, is relied on only when the recipient's current certification and the particular transfer are covered. Our transfer annex explains the applicable roles and safeguards. You can request information about the safeguards through the contact form.
6. Retention
Google Analytics user-level and event-level data retention is two months; standard aggregated reports have separate retention. The analytics choice and cookies last up to 180 days. We do not send account IDs, emails, API keys or URL query strings through our page-view measurement, and do not enable Google Signals or advertising personalization.
Roadmap vote changes and request identifiers are deleted twelve months after each submission; repeating a request does not extend its retention. Removed choices are retained for that period only to prevent an earlier retry from restoring them. The browser cookie lasts up to twelve months after use. Earlier feature-interest records are retained only until their own twelve-month expiry and are not assigned an invented browser identity.
Aggregate referral counts expire after thirty days without a new observation. At successful signup, the selected entry source is also associated with the authenticated user for acquisition analysis and eligibility for configured referral credits; later sign-ins do not overwrite that attribution. This account attribution is retained with the account and necessary grant records. Interest records from the closed registration are deleted twelve months after their submission, or earlier on withdrawal; registration closed when public signup opened, so no new record is collected and none can extend that period. Contact-form records are retained for no longer than twelve months from submission as contact-request records and may be deleted earlier when no longer needed. Records separately required to fulfil a statutory obligation or establish, exercise or defend a claim are limited to that purpose and the applicable period.
New API keys have no scheduled expiry: they remain usable until revoked, while access always depends on current membership and permissions. This is separate from the seven-day browser-session lifetime. Key identifiers, masked values, creation/last-use information and revocation/security records are retained as needed to administer access; the full issued token is shown once and is not retrievable from the portal.
Account and operational records are retained while needed to provide and secure the account, reconcile usage and resolve outstanding matters. Billing records are retained for the applicable statutory accounting period. Retention of customer application data follows documented customer instructions and the DPA. On-demand encrypted SQL export archives have a seven-day retention period; issued download links are valid for 24 hours. A downloaded customer copy is under the customer's control. Mail received for a customer project is reachable through ohmyho.st for 72 hours after receipt, for webhook delivery, retries and recovery. Resend keeps email and log data, including our account notices, under its own terms, which it currently publishes as 30 days for the Scale plan we use. Deletion from active resources and expiry of restricted backup copies are distinct steps; backup copies expire under the retention lifecycle of the provider holding them.
7. Cookies and similar technologies
Our cookie notice lists technical cookies for access, security, referrals and requested functions, plus optional Google Analytics on the public website and docs. Analytics is off until you allow it and can be withdrawn through the cookie icon in the footer of either host. The account portal and development environments do not load this integration. Website and portal fonts are served from ohmyho.st. Mintlify delivers the docs and may process its own service telemetry under its privacy notice. Independently visited identity/payment services and customer applications have their own notices.
8. Your rights
Subject to the applicable conditions, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time without affecting processing lawfully carried out before withdrawal. You may complain to the Autoriteit Persoonsgegevens or another competent supervisory authority.
Use the contact form to identify your request. We may request proportionate information to verify identity or authority; do not submit an identity-document copy unless we specifically explain why it is needed. We respond within the applicable statutory period, ordinarily one month, and explain any permitted extension. We do not make decisions producing legal or similarly significant effects about individuals solely by automated means through the website or contact form.
Where an applicable US state privacy law grants rights, you may also use the contact form to request access, correction, deletion, a portable copy, or an appeal of a denied request, and may use an authorised representative as that law permits. We verify requests proportionately, explain denials and follow the applicable response period. We do not discriminate for exercising protected privacy rights. We do not sell personal information, share it for cross-context behavioural advertising, or process it for targeted advertising; a browser opt-out signal does not prevent ordinary login, security or requested service processing.
9. Changes
We publish the current version and effective date here and communicate material changes through an appropriate service channel where required. Contact us · Cookie notice · DPA