Privacy Policy

Last updated: February 18, 2026

1. Who we are

Cannes ("we," "us," "our") is operated by Darkmatter. Our service allows you to deploy and manage autonomous AI marketing agents on self-hosted infrastructure. Our website is cannes.agency.

2. Information we collect

Account information

  • Email address (required for signup)
  • Password (hashed with bcrypt; we never store plaintext passwords)
  • Account creation timestamp

Agent & infrastructure data

  • Agent names, roles, and configuration
  • VPS server identifiers (Hetzner server ID, IP address, Tailscale hostname)
  • Encrypted credentials (Hetzner API tokens, gateway tokens, SSH keys) — encrypted at rest with AES-256-GCM
  • Model provider selection (which AI models you choose)

Telemetry & performance data

When your agent is running, the dashboard automatically collects operational metrics at approximately 10-second intervals:

  • CPU, RAM, and disk usage percentages
  • Agent health status (online/offline)
  • Token usage statistics (input/output tokens, estimated cost)

Billing data

  • Subscription status and period (managed by LemonSqueezy; we do not store your payment card details)

Email & domains

  • Custom domain names you configure for agent email
  • AgentMail inbox addresses assigned to your agents

3. How we use your information

  • Provide the service: Provision and manage your VPS instances and AI agents
  • Authentication: Verify your identity and maintain your session
  • Monitoring: Display real-time and historical performance metrics for your agents
  • Billing: Process subscriptions and manage account status
  • Analytics: Understand aggregate usage patterns to improve the product (via Vercel Analytics)

4. Data encryption & security

We take security seriously. Sensitive credentials are encrypted at rest using AES-256-GCM. Your master encryption key is derived client-side and never transmitted in plaintext. API keys for third-party ad platforms (Google Ads, Meta, etc.) are stored exclusively on your VPS in a file that is not accessible from within the Docker container — a host-side proxy injects them at request time.

All network communication uses HTTPS/TLS. Sessions are secured with HMAC-signed, HttpOnly cookies.

5. Cookies

We use a single, essential cookie:

  • dashboard_session — An HttpOnly, HMAC-signed session cookie that expires after 7 days. It contains only your user ID and a timestamp. We do not use advertising or tracking cookies.

6. Third-party services

We rely on the following third-party providers to operate the service:

  • Vercel — Hosts the dashboard; processes anonymous analytics and performance data
  • Neon — Managed PostgreSQL database
  • Hetzner — Cloud VPS provider where your agents run
  • Tailscale — Private networking between your dashboard and VPS
  • LemonSqueezy — Payment processing and subscription management
  • AgentMail — Email inbox service for agents
  • GitHub (GHCR) — Container image registry

Each provider processes data in accordance with their own privacy policies. We share only the minimum data required for each service to function.

7. Data retention

  • Agent heartbeats: 7 days
  • Agent interactions: 30 days
  • Agent telemetry: 90 days
  • Account data: Retained until you delete your account

Expired telemetry data is automatically purged on a rolling basis.

8. Your rights

You have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate information
  • Delete your account and associated data
  • Export your data in a portable format

To exercise any of these rights, contact us at the address below. We will respond within 30 days.

9. International data transfers

Your data may be processed in data centers located in the EU (Hetzner) and the US (Vercel, Neon). We rely on standard contractual clauses and provider compliance frameworks to ensure appropriate safeguards are in place.

10. Children's privacy

Our service is not intended for anyone under the age of 18. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this privacy policy from time to time. We will notify registered users of material changes via email. The "Last updated" date at the top reflects the most recent revision.

12. Contact

If you have questions about this privacy policy or your data, contact us at privacy@darkmatter.is.

Privacy Policy | Cannes