Last updated: November 2, 2026
Scope
This policy describes how HiPanel (“we”) collects, uses, stores and protects data when you use the hipanel.cloud website, the HiPanel control panel, API and AI assistant (together, the “service”).
Data we collect
- Account: your name, email, avatar and identifier from the sign-in provider you choose.
- Infrastructure you connect: server IP addresses and SSH ports, the SSH key pairs HiPanel generates, root passwords if you provide them, provider tokens or OAuth credentials, server and site configuration, database and user names, environment variables, backup settings and S3 connections.
- Operational data: task history and logs, CPU, memory and disk metrics sent by the agent, and the time and IP address when you sign in or call the API.
- AI assistant: your questions, the tool results needed to answer them, and the number of tokens used.
- Browser: your session, language and display preferences are kept in your browser's local storage. We don't use advertising cookies or third-party trackers.
Data we don't collect
Site files, database contents and backup contents stay on your servers and in your S3 bucket. HiPanel only reads them when you ask for an action that needs them, such as viewing a site's logs, and does not copy them into HiPanel's systems. Backups go straight from your server to your S3 and are encrypted before they leave the machine.
How we use data
- To perform the actions you request on the servers, sites and providers you connected.
- To protect accounts and systems: permission checks, rate limits, abuse detection and task logs.
- To help you when something goes wrong and to send service notices.
- To improve the product using aggregate, non-identifying statistics.
We don't sell your data and don't use it for advertising.
AI assistant
When you use the AI assistant, your question and the related tool data are sent to the AI model provider (currently Anthropic) to generate the answer. Passwords and secret keys are never sent to the model. HiPanel does not use your data to train models; the model provider processes data under its commercial API terms. If you don't use the assistant, no data is sent to the model provider.
Data security
SSH keys, passwords, provider tokens, environment variables and backup repository passwords are encrypted at rest with AES-256-GCM; API tokens are only stored as hashes. Connections to HiPanel use HTTPS, and connections to servers use SSH with a separate key per server. Details on the Security.
Storage and retention
- Data is kept for as long as your account is active.
- When you delete a server or site, its access keys and configuration are removed from HiPanel. Task history is kept for audit purposes and as required by law.
- When you delete your account, your data is deleted or anonymized within a reasonable time, except where the law requires us to keep it.
Your rights
Under Vietnamese personal data protection law, you have the right to be informed, to access, correct and delete your data, to withdraw consent, to request restricted processing and to complain. You can view, edit and delete most of your data yourself in the panel; for anything else, contact us.
Age
The service is intended for people aged 18 and over and for organizations. We don't knowingly collect data from children.
Changes to this policy
When this policy changes, we update this page and the date at the top. Significant changes are announced by email or in the panel before they take effect.
Contact
For any questions about personal data, write to support@hipanel.cloud.