Data Sovereignty & Privacy

Privacy Policy & GDPR Compliance

Last Updated: November 12, 2026 • Strict European Data Protection (Regulation EU 2016/679)

1. Data Controller & EU Jurisdiction

All infrastructure, storage volumes, and edge routing engines operated by Exesta are physically located within a Tier III+ ISO-27001 certified facility in Budapest, Hungary (European Union).

Exesta operates under full compliance with the European Union General Data Protection Regulation (EU GDPR). We are an independent European entity: your customer data, container disks, and traffic records are never subject to the US CLOUD Act, FISA 702, or extraterritorial data retrieval orders.

2. What Data We Collect & Sub-Processors

We strictly enforce the GDPR principle of data minimization (Article 5(1)(c)). We collect only what is technically necessary to provision, support, and secure your services:

  • Account & Billing Data: Email address and billing identifiers processed via secure, PCI-DSS compliant European payment gateways.
  • Security Telemetry: Ephemeral reverse-proxy connection timestamps and IP headers retained in volatile memory for DDoS mitigation and TLS 1.3 handshakes (rolling 7-day retention).
  • Live Customer Support (Tawk.to): Real-time customer chat inquiries, IP headers, and ephemeral session cookies strictly used to facilitate live customer assistance.
  • Consent-Gated Analytics (GA4 & Matomo): First-party Matomo telemetry and Google Analytics 4 operating strictly under Google Consent Mode v2 (default denied until explicit cookie banner acceptance).

3. Absolute Data Ownership & Zero Lock-In

You own 100% of your data. Exesta runs unmodified official upstream OCI containers (Gitea, Tracepano, Linkstack, YOURLS).

Our Privacy Guarantee:

We never inspect, scan, analyze, monetize, or sell the databases, repositories, or assets stored inside your persistent NVMe containers. All SQLite/PostgreSQL databases remain raw files accessible only to your appliance.

4. Your Rights Under EU GDPR

As an EU data subject (and extended to all global Exesta customers), you possess statutory rights under Articles 15 through 22 of the GDPR:

  • Right of Access (Art. 15): Complete visibility over all stored profile records.
  • Data Portability (Art. 20): Instant raw tar.gz exports of your persistent volumes.
  • Right to Erasure (Art. 17): 1-click permanent deletion of containers and ZFS snapshots.
  • Right to Rectification (Art. 16): Immediate updates to billing and operational metadata.

5. Data Protection Officer & Inquiries

For any GDPR inquiries, statutory access requests, or privacy concerns, contact our systems team directly at:

contact@exesta.eu or support@exesta.eu