Legal

Privacy Policy

What we collect, who else processes it, where it lives, how long we keep it — and the one section most sandbox providers leave out, which is what we do with the contents of your machines.

In force from 2 November 2026

Who is responsible for your data

The data controller is RAY AMJAD LTD, trading as Impello, a company registered in England and Wales under number 14506459.

You can reach us about anything in this policy at legal@impello.ai. Our postal address is available on request.

What we collect

When you hold an account

Your name, your email address, a hashed password, your email verification status, your team membership, and the version of our terms you accepted with the date, the time and the IP address the acceptance came from. That address is the evidence behind the acceptance and nothing else; it is not used to locate you and it is deleted with your account.

Each time you sign in, we also record the IP address the request came from (for an IPv6 address, only its first half, which identifies the network) and your browser’s user agent string against that sign-in session. They show which address and browser each sign-in came from, so that we can investigate a sign-in from an unexpected network or device, such as one made with a stolen password. They are not used to locate you, and they are deleted when you sign out, with your account, or 30 days after the session expires, whichever comes first.

Where your account came from

When you open an account we keep where you first found us, as our marketing site recorded it (see Cookies and analytics below): the campaign tags on the link you followed, the website that linked to us, the first page you landed on and when. We also keep how you signed up (email, Google or GitHub) and the country your sign-up came from, worked out from its IP address at the time; the IP address itself is not kept for this. We use this to understand which channels bring customers, and the country to help spot fraudulent sign-ups. It is deleted with your account.

When you sign in, sign up or reset a password

To slow down anyone guessing passwords or opening accounts in bulk, we keep a short record of attempts on our sign-in, sign-up and password-reset forms: which form it was, the email address that was typed, and a keyed hash of the IP address the request came from. We record every failed sign-in, every sign-up attempt and every password-reset request, whether or not an account exists for the address typed, so this applies even if you never open an account. We also record every request for an emailed sign-in link, whether or not it succeeds and whether or not an account exists for the address typed. A failed attempt to choose a new password through a reset link records only the hashed address. The hash is made with a secret key that we hold, so it cannot be turned back into an IP address by anyone who obtains the record, and we use it only to count attempts from one source. The same hashed address, with no email address, is recorded each time your browser sends us an error report or feedback is sent to us, to limit how often one source can send them. This record of attempts is deleted after 1 day.

When you sign in with Google or GitHub

If you sign up, sign in or connect your account with Google or GitHub, that provider sends us the verified email address, the name and the profile picture link on your account with them, and the identifier it uses for you. We keep only that identifier, and the name and picture link on your account. The provider also sends us sign-in tokens; we discard them and do not keep them. We use this only to sign you in. The identifier is deleted when you disconnect the provider on the Account page, and all of it is deleted, at the latest, with your account.

When you connect an app to the Impello MCP server

If you connect an AI assistant or another app to the Impello MCP server, you sign in, choose one of your teams and approve the access the app asks for. We record that approval: which app, which team, what access, and when. The app then gets access tokens, which last 1 hour, and a refresh token, which lasts 30 days and is replaced each time it is used; we keep only a hashed copy of each. We use this only to let that app act on that team for you. It is deleted when you disconnect the app on the Keys page, and otherwise, at the latest, with your account. If you leave the team, the app loses access to it at once, but you can no longer reach that team’s Keys page, so the record is kept until your account is deleted.

When you pay

Your billing identity and transaction history. Card details are collected and held by our payment provider and never reach our systems. When you start a free trial we keep a fingerprint of the card from our payment provider, which identifies the card without its number, so that each card gets one trial. It cannot be used to charge the card.

When you start a trial, or a first payment fails, we also keep that card’s fingerprint, its type (credit, debit or prepaid), the country that issued it and the billing country you entered, and our payment provider’s fraud risk rating of the charge. We use them only to help a person at Impello spot fraudulent payments, for example one card used across several accounts; nothing is refused automatically because of them.

When you use sandboxes

Lifecycle events for each sandbox — when it was created, paused, resumed and stopped, and the CPU, memory and disk allocated to it. This is how usage is metered and how invoices are evidenced.

When a team owner invites you

A team owner can enter your email address to invite you to their team. We keep that address, the role you are invited to and who sent the invite, and we email you a link to accept it. An invite expires 7 days after it is sent. When you accept it, the invite is deleted and your address is kept as part of your account. An invite that is never accepted is deleted 30 days after it expires or is revoked.

The contents of your sandboxes

We do not access what is inside your sandboxes, and we do not train models on it.

Your code, your data, your files and your templates are yours. We access them only where it is necessary to operate the service, to answer a support request you have made, to investigate a suspected breach of our acceptable use policy, or to comply with a binding legal demand.

Two things about how sandbox content is stored are worth stating plainly, because they are easy to miss:

When you pause a sandbox, its memory and disk are written to storage so it can be resumed. That content is at rest until the sandbox is deleted.
Templates you build are copied to encrypted off-site backup storage in the EU, so that a hardware failure does not lose them.

The operational metrics we do collect — sandbox counts, CPU seconds, memory allocated, error rates — describe how much compute ran, never what ran on it.

Why we process it, and on what basis

To provide the service — running sandboxes, authenticating you, metering usage and issuing invoices. Basis: performance of a contract.
To keep the platform safe — rate limiting, abuse detection, and investigating suspected breaches. Basis: our legitimate interest in protecting our infrastructure and our other customers.
To understand how customers find and start using Impello — where an account came from, and whether it went on to start a trial, pay, create an API key or start a sandbox. Basis: our legitimate interest in knowing which of our efforts work.
To meet legal obligations — tax records, accounting, and responding to lawful requests. Basis: legal obligation.

Who else processes your data

We use the following processors. Each is bound by contract to process data only on our instructions and to keep it confidential.

Processor	What it does	Where
Our infrastructure providers	Dedicated servers running sandboxes and holding sandbox lifecycle events and metrics, and object storage holding encrypted backups of customer templates	Germany and Finland
Upstash	Managed Redis for rate limiting and caching	European Union
Stripe	Payment processing, invoicing and merchant of record	European Union and United States
Twilio SendGrid	Transactional email — sign-in, verification and billing notices	United States
Axiom	Operational logs and traces from the platform	United States
Cloudflare	Application hosting and compute for this website and the dashboard, their request logs, and DNS hosting for our domains	Global
PostHog	Product analytics on the marketing site, sign-up and billing milestones for each team, and error tracking on the marketing site and the dashboard	United States
Slack	Internal notice of each new account (name, email address and where it came from) and of its checkouts (with any fraud signals), and internal operational alerts	United States

We do not sell personal data, and we do not share it with third parties for their own marketing.

Where your data is processed

Sandboxes run on dedicated servers in Germany and Finland. The fleet database, the usage-event store, the cache and the backup storage holding your templates are all in the European Union. Your code and your data do not leave the EU in the course of running.

Some of the processors listed above operate from, or replicate to, the United States — payments, transactional email, analytics, internal notices about new accounts and application hosting. Those services handle account, billing, contact and usage information. They do not handle the contents of your sandboxes. Where data reaches a country without a UK or EU adequacy decision, the transfer is made under standard contractual clauses and the UK international data transfer addendum.

We may add processing regions in future. This page will say so when we do.

How long we keep it

What	How long
Paused sandbox contents (memory and disk)	Deleted within 30 days of the sandbox being deleted or your account closing
Sandbox templates, including backups	Deleted within 30 days of the template being deleted or your account closing
Sandbox lifecycle events (start, pause, resume, stop, and resource usage)	24 months, because this is the evidence behind every invoice
Operational logs and traces	No longer than 90 days
The record of which Terms version an account accepted, including the IP address it came from	Kept while the account exists, and deleted with it
Sign-in sessions, including their IP address and user agent	Until you sign out, and otherwise 30 days after the session expires
The record of attempts on the sign-in, sign-up and password-reset forms and of sign-in link requests, and of error reports and feedback sent to us: the email address typed (where there is one) and a keyed hash of the IP address	Deleted after 1 day
A connected sign-in provider (Google or GitHub), including its identifier for you	Until you disconnect it, and otherwise until the account is deleted
An app connected to the Impello MCP server: your approval, the team you chose, its tokens, and the encrypted key we hold for it	Until you disconnect the app, and otherwise (including after you leave the team) until the account is deleted
A team invite, including the email address it was sent to	Until accepted, or 30 days after it expires or is revoked
Enquiries sent through the contact form that used to be on our home page (closed on 1 October 2026)	Up to 24 months from the day they were sent
The fingerprint of a card used for a free trial, and the team that used it	Kept for ever, including after your account closes, so that each card gets one trial
Where an account came from: campaign tags, referring website, landing page, sign-up method and country	Kept while the account exists, and deleted with it
The first-touch cookie on your browser, recording where your first visit came from	90 days from your first visit
Sign-up and billing milestones in our analytics tool, keyed by team (never by name or email address)	No longer than 7 years
The cards a team checked out with: fingerprint, type, issuing and billing country	6 years after your account closes, with the billing records
Account, invoice and tax records	6 years after your account closes, as UK tax law requires

Your rights

Under the UK GDPR and the EU GDPR you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to how we process it, to receive it in a portable form, and to withdraw consent where consent is the basis we rely on.

Email legal@impello.ai and we will respond within one month. If you are not satisfied you may complain to the UK Information Commissioner’s Office at ico.org.uk, or to your local supervisory authority in the EU.

Security

Sandboxes are isolated virtual machines, each running under a hardware-virtualised hypervisor rather than shared kernel namespaces. Traffic to the fleet is encrypted in transit and terminates at our own load balancer. Passwords are hashed, API keys are stored so that they cannot be read back, and the session cookie the dashboard uses is HTTP-only. The one exception is the key that stands in for an app you connect to the Impello MCP server: it is held encrypted, never shown to you or the app, and deleted when you disconnect the app.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant supervisory authority as the law requires.

Cookies and analytics

Our dashboard sets cookies that are strictly necessary to keep you signed in. Our marketing site uses a product analytics tool to understand which pages are read and which are not; it is served through our own domain so that it is not blocked, and it records page views, referrers and coarse device information.

When the dashboard or the marketing site hits an error, the same tool records the error, the page it happened on and coarse device and browser information, so that we can fix it. Email addresses, keys and the query part of web addresses are removed before the record leaves your browser or our servers, and it is not linked to your account. On the dashboard this sets no cookie and stores nothing in your browser.

On your first visit, the marketing site also sets one first-party cookie, readable by every impello.ai site, recording where that visit came from: the campaign tags on the link, the website that linked to us, the page you landed on, when, and the analytics tool’s random identifier for your browser. It lasts 90 days. If you open an account while it is there, the dashboard stores it with your account as described under “Where your account came from”, and the analytics tool links your visits to the site with your team.

Our servers also tell the same tool when a team signs up, starts a checkout, is granted or refused a trial, has a first payment fail, creates its first API key or starts its first sandbox. These records carry your team’s identifier, where the account came from and the country it signed up from, never your name or email address.

We do not run advertising cookies, and we do not share analytics data with advertising networks. Your browser can refuse cookies, though the dashboard will not be able to keep you signed in if it does.