Privacy Policy

Information you provide directly:

• Account information. When you sign in with Google OAuth, we receive your name, email address, and profile picture.
• Communications. Support requests, feedback, or other messages you send to us.
• Payment information. Billing is handled entirely by Stripe. We never see or store your full card number. Stripe shares a summary (last 4 digits, expiration, billing email) so we can display it in your dashboard.

Information collected automatically:

• Instance data. The data you store in your Lux instances (keys, values, streams, vectors, etc.) lives on our infrastructure. We do not access or inspect it unless required for debugging at your request.
• Usage metrics. We collect operational metrics about your instances: memory usage, connection counts, command throughput, and disk usage. This powers the metrics dashboard and helps us monitor instance health.
• Log data. Error reports and performance data for maintaining the Service.

We use the information we collect to:

• Provide, operate, and maintain the Service (running your instances, routing connections, serving the dashboard)
• Process transactions and billing through Stripe
• Monitor instance health and maintain service reliability
• Send administrative communications (security alerts, maintenance notices, billing updates)
• Respond to support requests and inquiries
• Detect, investigate, and prevent fraudulent or abusive activity
• Comply with legal obligations

We may use aggregated, anonymized usage metrics to improve and benchmark the Service. We do not build advertising profiles or sell your data.

We use the following third-party service providers ("sub-processors") to operate the Service. Each processes data only to the extent necessary to deliver their function:

We do not sell, rent, or share your data with third parties for marketing or advertising purposes.

Beyond the sub-processors listed above, we may share your information only in the following circumstances:

• Legal requirements. When required by law, subpoena, court order, or other legal process.
• Safety. To protect the rights, property, or safety of Pompeii Labs, our users, or the public.
• Business transfers. In connection with a merger, acquisition, or sale of assets, in which case your data would remain subject to this Privacy Policy.
• With your consent. In any other case with your explicit consent.

Account data is kept for as long as your account is active. Upon account deletion, we remove your personal information from our systems within 30 days, except where retention is required by law.

Instance data is deleted when you terminate an instance. Snapshots are deleted along with the instance unless you have exported them.

Usage metrics are retained for 30 days, then automatically purged.

Payment records are retained as required by tax and accounting regulations.

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Rectification of inaccurate or incomplete information
• Erasure of your personal information ("right to be forgotten")
• Restriction of processing in certain circumstances
• Data portability (receive your data in a structured, machine-readable format)
• Objection to processing based on legitimate interests
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at hello@pompeiilabs.com. We will respond within 30 days.

You can also delete your account at any time from the dashboard, and export your instance data using the snapshot and CLI tools.