Privacy Notice

This notice explains what personal data I handle when you use Knijn Space or visit this site, why, and what your rights are. It’s written for people hosting with me and for visitors.

Who is responsible#

I’m Emma, running Knijn Space (referred to as “Knijn Hosting” in the Terms of Service) as a hobby project from the Netherlands. It isn’t a registered business.

Contact for anything privacy-related: emma@knijn.one.

What I collect, why, and on what basis#

Data	Why	Legal basis (GDPR)
Email address, plus an optional secondary contact such as a Discord handle	To talk to you about your hosting: support, billing, changes to the terms	Performing the hosting agreement (Art. 6(1)(b))
Payment records for paid plans (your name, which period you paid for, the amount and date). Payments are in cash, in person, so no bank or card details are involved	To keep a record of what you’ve paid for, give you receipts, and keep my own records	Agreement (6(1)(b)) and legal obligation (6(1)(c))
The content and data you host	To provide the hosting. I don’t use it for anything else	Agreement (6(1)(b))
Server logs of hosted sites: IP address, time, requested path.	Security, abuse prevention, troubleshooting	Legitimate interest (6(1)(f))
Visits to knijn.space: Cloudflare processes visitor IP addresses to serve and protect the site. A Umami instance, hosted by me, is used for analytics	Delivering and securing the website	Legitimate interest (6(1)(f))
Emails and messages you send me	To answer them and keep a record of support and agreements	Agreement (6(1)(b)) and legitimate interest (6(1)(f))

I don’t sell personal data, and I don’t make decisions about you by automated means.

Who else handles your data#

These providers process data for me, as listed in the Terms of Service:

Cloudflare: DNS, proxying and Cloudflare Pages
Vultr: the servers behind non-static services
GitHub: storing the repositories of static sites (private repositories are possible)
Gmail: contacting you

Some of these providers are based in or process data in countries outside the European Economic Area. Where that happens, transfers rely on safeguards such as Standard Contractual Clauses, and the EU-US Data Privacy Framework where the provider is certified.

How long I keep data#

Your hosted data: deleted within 7 days after your hosting is terminated, unless the law requires me to keep it.
Contact details: for as long as you host with me, and at most 7 days after your hosting is terminated, unless the law requires me to keep it.
Payment records and receipts: deleted after 7 years after your hosting is terminated, due to tax regulation.
Server logs: 31 days.
Backups: I don’t make backups of your data (see the Terms of Service), so nothing is kept that way.

Your rights#

You can ask me to:

show you the personal data I hold about you,
correct it,
delete it,
restrict how I use it,
give you a copy in a usable format, or
stop using it where I rely on legitimate interest.

Email me and I’ll answer within one month. It’s free. I may need to confirm it’s really you first.

If you think I’m handling your data wrongly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

If you host a site that has visitors#

If your hosted site collects personal data from its own visitors (a contact form, accounts, analytics), you are responsible for that data, and I act as your processor. I can sign a data processing agreement on request. Paid plans get one with the quote.

Age#

You must be at least 16 to host with me, as stated in the Terms of Service. Under 16 requires a parent or guardian’s consent.

Security#

I take reasonable measures to protect the systems I run. for example key-only SSH access, TLS everywhere, access limited to me and customer data encrypted at rest and in transit. No system is perfectly secure. If a breach affects your data, I’ll tell you without undue delay by email.

To report a security problem, see security.txt.

Changes to this notice#

For material changes, I’ll email customers.