GDPR Compliance

ClashCloud is fully committed to compliance with the General Data Protection Regulation (GDPR) and the Dutch implementation of the GDPR (UAVG).

1. Data Controller

ClashCloud acts as the data controller for the personal data you provide to us via clashcloud.dev. Our infrastructure is hosted within the EU (Hetzner, Germany/Netherlands).

2. Legal Basis for Processing

We process your data based on:

• Contractual Necessity: To provide you with the account and services you requested.
• Legitimate Interests: To ensure the security and stability of our systems (e.g., server logs, DDoS protection).
• Consent: For optional features, such as analytics cookies. You can withdraw this consent at any time.

3. Your Data Subject Rights

As an EU resident, you have the right to:

• Access: Request a copy of the data we hold about you.
• Rectification: Correct inaccurate data.
• Erasure: Request deletion of your data ("Right to be Forgotten").
• Restriction & Objection: Limit or object to how we process your data.
• Portability: Transfer your data to another service.

To exercise any of these rights, please email [email protected]. We will respond within 30 days.

4. Data Breach Notification

In the unlikely event of a data breach, we will notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and affected users within 72 hours, as required by law.

5. International Data Transfers

All our primary data storage (Hetzner) is located within the European Union. When using third-party services outside the EU (e.g., Resend in the US for emails), we ensure that appropriate safeguards (such as Standard Contractual Clauses) are in place.