Privacy and cookies

Hangar is operated from Brazil and is the controller of the data described here. There is no separate data protection officer yet: privacy questions and requests go to [email protected], which reaches the people who run the service.

Account data. Name, email, organization, authentication data and, for paid plans, billing details. We need it to run your account and to charge for it.

Service data. Logs, usage metering and security events produced while you use the platform. We need it to operate, secure and bill the service.

Website and product usage. Pages viewed, referrer, campaign parameters, device and browser information, approximate location and the steps taken in sign-up and in the dashboard. This is the only collection that depends on your consent on the public site, and it is described below.

We do not read the content of your projects, environment variables, databases or volumes for analytics.

• Running your account, deploying your applications and billing you: performance of a contract (GDPR art. 6(1)(b), LGPD art. 7, V).
• Securing the platform and preventing abuse: legitimate interest (GDPR art. 6(1)(f), LGPD art. 7, IX).
• Measuring the public website and the campaigns that bring people to it: your consent (GDPR art. 6(1)(a), LGPD art. 7, I), asked by the banner.
• Understanding how signed-in users use the dashboard, to fix what is confusing or broken: legitimate interest (GDPR art. 6(1)(f), LGPD art. 7, IX). You can object to it by writing to us.
• Meeting legal and tax obligations: compliance with the law (GDPR art. 6(1)(c), LGPD art. 7, II).

Strictly necessary. Signing in needs a session cookie, set when you sign in. It does not require consent. We also keep your cookie choice in your browser's local storage.

Analytics. With your consent, we use PostHog. It stores an identifier in a cookie or in local storage and receives the pages you view, your referrer, campaign parameters and device information. We also keep the campaign or site that brought you here in a cookie of our own for 90 days, and attach it to your account if you sign up. Until you accept, nothing is stored and nothing is sent. If you decline, the site works the same.

Advertising. We do not use advertising pixels today. If we add any, they will load only after you accept and will be listed here.

We use providers that process data on our behalf: infrastructure hosting, email delivery, payment processing and product analytics (PostHog). They may only use the data to provide their service to us. We do not sell personal data or share it for cross-context advertising.

Some of these providers run outside Brazil, including in the United States, so data can be transferred internationally. Where the law requires it, we rely on safeguards such as the EU Standard Contractual Clauses and the UK addendum (GDPR chapter V) and the mechanisms of LGPD art. 33, together with our providers' own commitments.

We may also share data when a court or authority requires it.

Account data is kept while your account exists and afterwards only for as long as the law requires, for example for tax records, or to defend ourselves in a dispute. Analytics and service data are kept only as long as they are useful for the purposes above, then deleted or anonymised.

We use encryption in transit, access controls and isolation between customers. No system is perfectly secure; if an incident puts your data at risk, we will tell you and the ANPD as the law requires.

You can change your mind at any time. Open cookie preferences. You can also clear this site's local storage and cookies in your browser.

Wherever you live, you can ask us to confirm that we process your data, give you access to it, correct it, delete it, export it, tell you who it was shared with, and revoke consent. You can also object to processing based on legitimate interest or ask us to restrict it. Write to [email protected] and we will answer within 15 days, and in any case within the time your local law sets. We will not treat you differently for using these rights.

EU, UK and Brazil. These rights come from GDPR arts. 15 to 22 and LGPD art. 18. If you are not satisfied with our answer, you can complain to your local data protection authority, or to the ANPD in Brazil.

California and other US states. You can know, access, correct and delete your personal information and opt out of its sale or sharing. We do not sell it or share it for cross-context behavioral advertising.

Hangar is a service for developers and businesses and is not directed at children under 18, or under 16 where local law sets that age. We do not knowingly collect their data.

When this page changes in a way that matters, we update the date at the top and, if consent is involved, ask again.