Privacy policy

What this policy covers

This policy covers Manager for Craft: this website, the hosted service, and the data a connected Craft site sends to it. Coysh Digital Ltd is the data controller.

Coysh Digital Ltd also publishes a policy for its own website and client work. That one covers the studio; this one covers the product, because the processing is entirely different and a single document would have described neither properly.

If you run Manager on your own infrastructure, this policy does not apply to that installation. Your servers hold your data, we receive nothing from it, and there is no usage telemetry to switch off because there is none to begin with.

What we hold about you

Data	Why	Lawful basis
Name, email address, hashed password, second-factor secrets	To give you an account and keep other people out of it	Performance of a contract
Organisation name and the people in it	To decide who can see and do what	Performance of a contract
Billing address, VAT status, subscription state, invoices	To charge you correctly and account for the tax	Contract, and legal obligation for the records
IP address and user agent, on actions recorded in the audit log	So a shared account can answer who did what, six weeks later	Legitimate interests: security and accountability
Support emails you send us	To answer them	Legitimate interests

We never receive your card details. Payment happens on Stripe's own pages and Stripe tells us only whether it worked, along with the last four digits and the card brand so the console can show you which card is on file.

What Manager holds about your sites

This is the part worth reading carefully, because it is the part that makes Manager safe to point at forty client sites.

What a connected site sends

• Craft version and edition, PHP version, database engine and version
• Every installed plugin and Composer package, with its version
• Update availability, and whether a security release is outstanding
• Licence state, calculated on your site
• Configuration findings, such as dev mode being on in production
• Disk usage per asset volume, free space, PHP limits and OPcache state
• Queue depth, failed job counts and whether migrations are pending
• Counts of failed control panel sign-ins, and how many accounts locked out
• Server render timings, sampled on your own server
• The expiry date, issuer and subject of the TLS certificate your site presents
• The domain the site serves from, and the public half of its connector key

What it never sends

• Entries, assets, categories or any other content
• User accounts, email addresses, usernames or password hashes
• Session data, cookies or visitor information
• Log files, stack traces or the contents of queued jobs
• Environment values, API keys or security keys
• Craft or plugin licence keys
• Database passwords, SSH credentials or administrator passwords
• File paths, directory listings or the output of phpinfo

None of that second list is a policy decision that could be quietly reversed. The payload schema rejects a report containing a field it does not recognise outright rather than stripping it, so a connector that started sending something new would have its whole report refused. There is nowhere in the platform's database to store a credential, and a test walks the live schema on every run and fails if a column appears that looks like one.

Two specific figures deserve their own note. Failed sign-in counts are counts: attempts, accounts affected, accounts locked out, and how many of those are administrators. No username, email address or source address exists in that schema. Response timings are aggregates sampled on your own server, never per-request records and never tied to a visitor.

Backups

A database backup is different from everything above, because a Craft database does contain personal data: your client's user accounts, password hashes, sessions, form submissions and whatever else that site holds.

Which is why backups work the way they do:

• They are off until you turn them on, per site, and turning them on takes an administrator, a recent password confirmation, the site name typed out, an acknowledgement of exactly what a database backup contains, and a recorded reason.
• They are encrypted on your own server before they leave it. The unencrypted dump is deleted from that server whether the upload succeeded or failed.
• The key is sealed to recovery keys you hold, up to eight of them, whose fingerprints you pin in a config file in your own version control. A connector refuses the whole backup, before taking the dump, if we offer it a key you have not pinned.
• We store, verify, serve and delete an artefact we cannot open.

For those sites, you are the controller and we are the processor. If you would like a written data processing agreement, ask and we will send one.

Subprocessors

Everyone outside Coysh Digital Ltd who processes data on our behalf:

Who	What for	Where
Stripe	Subscription payments, invoices and VAT calculation. Card details are entered on Stripe pages and never reach our servers.	Ireland and the United States
Amazon Web Services	Backup artefact storage and the key management service that wraps artefact keys. Cloud only; self-hosted installations use their own storage.	London, eu-west-2
Ploi	Server provisioning and deployment for the hosted service. Ploi holds server configuration, not customer data.	The Netherlands

Where a subprocessor is outside the UK, transfers rely on the UK international data transfer addendum to the EU standard contractual clauses. We will email account owners before adding a subprocessor that handles customer data.

How long we keep things

What	How long
Your account and organisation record	Until you close the account, then deleted.
Backup artefacts	Whichever of your two retention settings keeps an artefact alive for longer: 30 days and three copies by default. Pruning runs nightly and destroys the keys as well as the data.
Site reports and telemetry	90 days, then pruned automatically.
Audit events	For the life of the organisation. The log is append-only and cannot be edited or selectively deleted, by you or by us.
Invoices and payment records	Six years, as UK tax law requires.
Everything, after a lapsed subscription	Suspension stops monitoring and destroys nothing. Thirty days after suspension, stored backups are destroyed.

The audit log is the one thing that cannot be selectively deleted, by you or by us. It is append-only and the database itself rejects an update or a delete against it, which is what makes it worth having. Closing an account deletes the organisation and everything under it, the log included.

Analytics and cookies

This website sets no cookies until you use the contact form, which sets one session cookie so that the form can carry a CSRF token. There is no analytics, no tag manager, no advertising pixel and no third-party font. Everything you load from these pages comes from this server, which is why there is no cookie banner: there is nothing to consent to.

The one exception is the contact page, which loads Cloudflare Turnstile to keep the form from being used to send spam. It is the only third-party request on the site and it is on that page alone.

The console at the other end of the sign-in link sets a session cookie and a theme preference. Both are necessary for it to work and neither tracks you.

Your rights

• Get a copy of what we hold. Ask, and we will send everything associated with your account within one month.
• Correct something wrong. Most of it you can edit yourself in the control plane. Ask us for anything you cannot.
• Delete your account. Closing the account deletes your organisation record, your sites and your backups. Audit events and invoices are retained as described above, because an append-only log is not selectively deletable and invoices are a legal obligation.
• Take your data elsewhere. Backups are yours already and are sealed to keys we do not hold. Fetch them with manager:backups:fetch before you close the account.
• Object, or complain. Write to us first. If we do not resolve it, you can complain to the Information Commissioner's Office at ico.org.uk.

We respond within one month. There is no charge, and we will not ask you why.

Security

The relevant detail is on the security page and, more usefully, in the source, which is public so you can check rather than take our word for it. In summary: every request from a connected site is signed and verified, each site has its own credentials which you can revoke independently, the platform never opens a connection to a managed site, and there is no mechanism by which Manager can run a command, read a file or change a setting on one.

If a breach affects your personal data, we will tell you and the Information Commissioner's Office within 72 hours of becoming aware of it.

Children

Manager is a tool for people who maintain websites professionally. It is not directed at children and we do not knowingly hold data about them.

Changes to this policy

The date at the top is when this wording took effect. If we change anything that affects what we do with your data, we will email account owners before it applies rather than quietly updating the page.

Contact

Email [email protected], or use the contact form. Coysh Digital Ltd is registered in England and Wales.

If we have not resolved something to your satisfaction, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you came to us first.

A note for completeness: if you stop paying, monitoring and backups stop but nothing is deleted. Stored backups are destroyed 30 days after suspension, and we email you before that happens. The refund policy sets out the whole sequence.