Last updated: 12 October 2026
Related: Terms of Service · Cookie Policy
This Privacy Policy explains how Aleksandra Stoycheva, with registered address at ul. Nayden Gerov 60, Gabrovo, Bulgaria, operating the ProHostiva service ("ProHostiva", "we", "us", or "our"), collects, uses, stores, and protects personal data.
For privacy-related questions, you can contact us at legal@prohostiva.com.
Where ProHostiva determines the purposes and means of processing personal data, ProHostiva acts as the data controller.
Depending on the processing activity, ProHostiva may instead act as a data processor on behalf of a customer. Those processing activities are covered by the Data Processing Agreement below.
We may collect information necessary to create and maintain your ProHostiva account, such as your name, email address, account credentials, billing information, and other information you provide when using the service.
We may process technical information required to operate and secure the service, including IP addresses, device and browser information, authentication information, server logs, error logs, and information about interactions with the ProHostiva platform.
Payments and subscription billing may be processed through third-party payment providers such as Stripe. We do not store full payment card numbers on ProHostiva infrastructure when payment processing is handled by the payment provider.
If you connect a GitHub account or repository to ProHostiva, we may process information necessary to authenticate the integration and deploy or manage the repositories you have authorized.
If you contact us, we may retain the information contained in your communication and the contact information necessary to respond. This includes quote requests sent with the form on our services pages and Framer check reports: your name, email address, the website you mention and your message are emailed to our support inbox, where we keep them as correspondence. We don't store them anywhere else.
Customers may upload or deploy websites, applications, files, databases, and other content through ProHostiva. Such content may contain personal data controlled by the customer. The processing of such personal data on behalf of the customer is governed by the Data Processing Agreement below.
Anyone can check a project with the free readiness check, without an account, by uploading a ZIP file or entering the address of a public GitHub repository. We keep the repository address or the file name, and the results of the check. A working copy of the project exists only while the check runs and is then deleted. An uploaded ZIP file is kept for up to 72 hours so that it can become your website after you sign up, and is then deleted. The check itself is kept for 30 days. If you continue to sign up, your browser remembers which check you came from (see the Cookie Policy).
Anyone can check a published Framer website with the free Framer check, without an account, by entering its address. We read the site's public pages the way a browser does and keep the address and the results of the check for 30 days. The check stores no IP address or account details.
We may process personal data to:
Depending on the circumstances, we process personal data on the basis of:
We may use trusted third-party providers to operate parts of the ProHostiva service. Depending on the specific processing activity, these providers may include:
The role of each provider depends on the processing activity. Not every provider is automatically a processor of customer-hosted application data.
We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the service, complying with legal obligations, resolving disputes, enforcing agreements, and maintaining security.
Customer-hosted data may be retained after termination for a limited period as described in the Terms of Service and the Data Processing Agreement.
Specific periods:
We make a backup of the platform every night, for disaster recovery. Backups are kept for up to about six months (one for each of the last seven days, four weeks and six months) and then deleted automatically. Personal data you delete, or that we delete, can therefore remain in older backups until those are deleted, at the latest about six months later. We don't use backups for any other purpose. If we ever have to restore from a backup, we delete again any personal data that had been deleted after that backup was made.
We implement appropriate technical and organisational measures designed to protect personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure.
The specific security measures applicable to personal data processed on behalf of customers are described in Annex 2 of the Data Processing Agreement.
Where the GDPR applies, individuals may have rights including the right to:
These rights are subject to applicable legal limitations.
You can delete your account yourself at any time, in Account settings → Profile → Delete account. Your websites go offline and your subscription stops renewing straight away; 7 days later your account, websites and their data are deleted permanently. You can change your mind by logging in before then. We keep only what the law requires us to keep, such as invoices and payment records, and a record that the account was deleted. Copies in backups are removed when those backups expire (see section 7).
If you believe that your personal data has been processed unlawfully, you may contact us first at legal@prohostiva.com.
You also have the right to lodge a complaint with the competent supervisory authority. In Bulgaria, this is the Commission for Personal Data Protection (CPDP).
Where personal data is transferred outside the European Economic Area, we will use appropriate safeguards where required by applicable data protection law.
ProHostiva is not intended for children who are unable to enter into contracts under applicable law. We do not knowingly collect personal data from children for independent use of the service.
ProHostiva may integrate with third-party services. Those services may have their own privacy policies and terms. We recommend reviewing the applicable policies of third-party providers when using an integration.
Customers remain responsible for personal data contained in websites, applications, databases, files, and other content they upload or deploy through ProHostiva.
Where ProHostiva processes such personal data solely on behalf of the customer, the customer is generally the controller and ProHostiva acts as processor, subject to the circumstances of the particular processing.
We may update this Privacy Policy from time to time. The updated version will be published on this page together with the applicable "Last updated" date.
This Data Processing Agreement ("DPA") forms part of the agreement between the customer ("Customer", "you", or "Controller") and Aleksandra Stoycheva, with registered address at ul. Nayden Gerov 60, Gabrovo, Bulgaria ("ProHostiva", "Processor"), where ProHostiva processes personal data on behalf of the Customer.
For personal data processed by ProHostiva on behalf of the Customer, the Customer acts as the controller and ProHostiva acts as the processor, unless applicable law requires a different allocation of roles.
The subject matter of this DPA is the processing of personal data necessary to provide the ProHostiva hosting and related services.
This DPA applies for the duration of the relevant services and for any additional period during which ProHostiva is required or permitted to retain the relevant personal data.
Processing may include hosting, storage, transmission, deployment, backup where implemented, technical support, security monitoring, troubleshooting, and other processing necessary to provide the contracted services.
Depending on the Customer's use of the service, data subjects may include the Customer's employees, customers, users, website visitors, contractors, suppliers, or other individuals whose data is included in Customer content.
The types of personal data processed depend on the content and applications hosted by the Customer and may include names, contact information, account information, identifiers, technical data, communications, usage data, and any other categories of personal data submitted by or on behalf of the Customer.
ProHostiva will process Customer personal data only on documented instructions from the Customer, unless processing is required by applicable law.
The Customer is responsible for ensuring that its instructions and processing activities comply with applicable data protection law.
Persons authorized to process Customer personal data will be subject to appropriate confidentiality obligations.
ProHostiva will implement appropriate technical and organisational measures taking into account the nature of the processing, the risks involved, and the state of the art.
The applicable technical and organisational measures are described in Annex 2.
The Customer generally authorizes ProHostiva to engage appropriate sub-processors where necessary to provide the services, subject to applicable GDPR requirements.
ProHostiva will maintain appropriate information regarding relevant sub-processors and will impose data protection obligations on sub-processors as required by applicable law. The current providers are listed in section 5 of the Privacy Policy above.
Taking into account the nature of processing, ProHostiva will provide reasonable assistance to the Customer in responding to requests from data subjects where required under Article 28 of the GDPR.
ProHostiva will notify the Customer of a personal data breach affecting Customer personal data without undue delay after becoming aware of the breach, where required by applicable law.
ProHostiva will provide reasonable assistance to the Customer with obligations under Articles 32 to 36 of the GDPR, taking into account the nature of processing and information available to ProHostiva.
Where processing involves transfers of personal data outside the European Economic Area, ProHostiva will implement appropriate safeguards as required by applicable data protection law.
Following termination of the relevant service, ProHostiva will delete or return Customer personal data in accordance with the Terms of Service, unless applicable law requires continued storage.
Unless otherwise agreed or legally required, service data may be retained for a limited period after termination before permanent deletion.
Copies in backups (see Annex 2) are deleted as those backups are deleted, at the latest about six months after the data was deleted from the service.
ProHostiva will make available information reasonably necessary to demonstrate compliance with applicable Article 28 obligations and will allow for audits where required by the GDPR, subject to reasonable conditions and confidentiality requirements.
The Customer is responsible for:
ProHostiva will not use Customer personal data for independent purposes unrelated to providing the contracted services, except where processing is required by applicable law or otherwise permitted under the applicable legal relationship.
If ProHostiva is required by law to process or disclose Customer personal data, ProHostiva will, where legally permitted, inform the Customer and provide reasonable assistance.
If there is a conflict between this DPA and the Terms of Service regarding the processing of personal data, this DPA will prevail to the extent of that conflict.
ProHostiva may update this DPA where necessary to reflect changes in applicable law, services, security measures, or processing arrangements, subject to applicable legal requirements.
This DPA remains effective for as long as ProHostiva processes Customer personal data on behalf of the Customer.
This DPA is governed by the law applicable under the Terms of Service, subject to mandatory data protection laws that apply to the parties.
For questions relating to this DPA, contact: legal@prohostiva.com.
Processing of personal data necessary to provide hosting, deployment, storage, infrastructure, technical support, security, and related services.
The duration of the processing corresponds to the duration of the applicable services, plus any legally required or permitted retention period.
Hosting, storage, transmission, deployment, maintenance, troubleshooting, security, backup where implemented, and other activities necessary to provide the contracted services.
Visitor statistics. To show the Customer how their websites are used, ProHostiva reads each request's IP address, browser identification (user agent), page address and referring page from its web server's request logs. No IP address or user agent is stored: unique visitors are counted with a keyed, one-way hash of the day, IP address and user agent, which is deleted after two days, so a visitor can't be identified or followed from one day to the next. Only totals are kept: requests, page views, visitors, referring sites and pages visited. No cookies or tracking scripts are added to the Customer's websites.
Uptime checks. ProHostiva regularly requests each website's home page to check that it is online. These requests are identified as ProHostiva's own and are not counted as visitors.
Depending on the Customer's use of the service, this may include employees, customers, website visitors, contractors, suppliers, users, and other individuals whose personal data is processed by Customer applications.
The Customer determines the specific types of personal data contained in Customer content. These may include names, contact details, identifiers, account information, technical information, communications, usage information, and other personal data.
ProHostiva does not intentionally determine which special categories of personal data Customers process. Customers are responsible for assessing whether their processing involves special categories of personal data and for implementing appropriate safeguards.
ProHostiva applies appropriate technical and organisational measures designed to protect personal data. The exact measures may evolve over time as the service and infrastructure develop.
Access to systems and personal data is restricted to authorized persons and services based on applicable access requirements.
Passwords are stored only as salted one-way hashes. ProHostiva staff sign in to the administration tools with two-factor authentication, in sessions that expire automatically.
Hosting infrastructure is configured with appropriate network, operating-system, container, and access controls appropriate to the service. Each website runs in its own container, on its own private network that only the web server can reach, with limits on memory, processor use and processes, and without access to the host system.
Websites and the ProHostiva dashboards are served over HTTPS. Secrets are encrypted at rest: website environment variables, GitHub access tokens and two-factor authentication secrets.
Appropriate system logging and monitoring may be used to detect operational issues, security events, and unauthorized access.
The platform is backed up every night to a separate storage volume within ProHostiva's hosting infrastructure, accessible only to the platform and authorised ProHostiva personnel. Each backup's integrity is checked with checksums, and restores are tested periodically. Backups are kept for up to about six months (seven daily, four weekly and six monthly) and then deleted automatically.
ProHostiva maintains procedures for identifying, investigating, and responding to security incidents and personal data breaches.
Personal data is deleted or anonymized when no longer required, subject to applicable legal, contractual, security, accounting, or dispute-related retention requirements.
Persons authorized to access Customer personal data are subject to appropriate confidentiality obligations.
Security measures may be reviewed and updated as necessary to address changes in technology, threats, infrastructure, and applicable requirements.