Legal

Mataki Labs LLC (“Sandbar,” “we,” “us,” or “our”), a Wyoming limited liability company, operates the sandbar.cloud website, the Sandbar hosting platform, and related services (collectively, the “Services”). This Privacy Policy explains how we collect, use, disclose, and protect information when you use our Services.

By using our Services, you agree to the collection and use of information as described in this policy.

Information We Collect

Information You Provide

When you create an account, subscribe to a plan, or contact us, we may collect:

  • Account information: Name, email address, password (hashed), and company or organization name
  • Billing information: Payment method details are collected and processed by our payment processor (Stripe). We do not store full credit card numbers on our servers.
  • Communications: Any information you include when you contact us via email, support tickets, or other channels, including your name, email address, and message content
  • Deployed content: Static files you upload and deploy through the Services, including HTML, CSS, JavaScript, images, fonts, and other assets. These files are stored solely for the purpose of hosting and serving your sites.
  • Site configuration: Domain settings, deploy metadata, workspace configuration, and other content you create through the Services

Information Collected Automatically

When you use our Services, we automatically collect:

  • Usage data: Deploy counts, site counts, storage consumption, bandwidth usage, and feature usage metrics
  • Server logs: IP address, browser type and version, operating system, referring URL, pages visited, timestamps, and request/response metadata
  • Performance data: Page load times, API response latencies, CDN cache hit rates, and error logs used to maintain service reliability
  • Device information: Device type, screen resolution, and timezone

How We Use Information

We use the information we collect to:

  • Provide and maintain the Services: Host and serve your static sites, manage deploys, configure domains, manage your account, and handle billing
  • Content safety: Scan deployed content for prohibited material, including child sexual abuse material (CSAM), malware, and phishing content, to maintain the safety and integrity of the platform
  • Improve the Services: Analyze usage patterns to identify bugs, optimize performance, and develop new features
  • Ensure security: Detect and prevent fraud, abuse, and unauthorized access to accounts or infrastructure
  • Communicate with you: Send transactional emails (account verification, billing receipts, deploy notifications), respond to support requests, and provide product updates you have opted into
  • Comply with legal obligations: Respond to lawful requests from government authorities and comply with applicable laws

We do not sell your personal information to third parties.

Important: We do not access, read, or analyze the content of your deployed files for any purpose other than content safety scanning, serving the files via CDN, and providing the Services. We do not use your deployed content for training, advertising, or any purpose unrelated to the Services.

Information Sharing and Disclosure

We share information only in the following circumstances:

Service Providers

We use third-party service providers to help operate our Services, including:

  • Stripe for payment processing
  • Cloud infrastructure providers for hosting and data storage
  • Monitoring and logging services for operational visibility

These providers access information only as necessary to perform their services and are bound by contractual obligations to protect your information.

Content Serving

When you deploy content to Sandbar, that content is served publicly via CDN to visitors of your sites. You control what content you deploy, and you are responsible for ensuring that your deployed content does not include personal data that you are not authorized to make publicly available.

We may disclose information if required to do so by law or in response to valid legal process, including subpoenas, court orders, or government requests. We will notify you of such requests when legally permitted to do so.

Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on our website before your information becomes subject to a different privacy policy.

Data Retention

  • Deployed files are retained for as long as the corresponding site and deploy exist. Upon site deletion, deploy files are retained for 30 days to allow for recovery, after which they are permanently deleted.
  • Deploy metadata (timestamps, file manifests, deploy labels) is retained for the duration of the site’s existence plus 30 days following site deletion.
  • Account data is retained for as long as your account is active. Upon account deletion, we will remove your personal information within 30 days, except where retention is required by law.
  • Billing records are retained for 7 years as required by applicable tax and accounting regulations.
  • Server logs are retained for 90 days for security and debugging purposes.

Data Security

We implement security measures designed to protect your data and the integrity of the hosting platform:

  • Encryption in transit: All communications use TLS 1.3. Older TLS versions are not supported. All sites served via Sandbar CDN use automatic SSL/TLS.
  • Access isolation: Each workspace’s sites, deploys, and configuration are logically isolated. One workspace cannot access another workspace’s data.
  • Content-addressed storage: Deploy files are stored using content-addressed deduplication, ensuring integrity verification of all stored content.
  • Content safety scanning: Deployed content is scanned for prohibited material at deploy time to protect the platform and its users.
  • Access controls: Employee access to production systems is restricted, logged, and requires multi-party approval.
  • CDN security: Content is served via Google Cloud CDN with DDoS protection and edge caching.

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal information we hold about you
  • Correct inaccurate or incomplete information
  • Delete your personal information and deployed content (subject to legal retention requirements)
  • Export your data in a portable format, including deploy files and site configuration
  • Withdraw consent for optional data processing activities

To exercise any of these rights, contact us at privacy@sandbar.cloud. We will respond to your request within 30 days. If we need additional time to fulfill your request, we will notify you of the delay and the reason for it.

Data Residency

By default, all data is stored in the United States. Enterprise customers may request custom data residency configurations to meet specific regulatory requirements.

Cookies and Tracking

The Sandbar console uses strictly necessary cookies to maintain your authenticated session. We do not use third-party advertising trackers, social media pixels, or cross-site tracking cookies. Analytics, if any, are privacy-respecting and do not track individual users across sites.

Children’s Privacy

Our Services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

International Data Transfers

Mataki Labs LLC is based in the State of Wyoming, United States. If you access our Services from outside the United States, your information may be transferred to and processed in the United States. By using our Services, you consent to such transfer and processing.

For customers who require specific transfer mechanisms (such as Standard Contractual Clauses), please contact us to discuss available options.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the “Last updated” date. For significant changes, we will provide additional notice via email to the address associated with your account.

Governing Law

This Privacy Policy is governed by the laws of the State of Wyoming, United States, without regard to its conflict of law provisions.

Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

Mataki Labs LLC State of Wyoming Email: privacy@sandbar.cloud