Privacy Policy — ProxmoxVEx

Last updated: September 2026

This Privacy Policy explains how ProxmoxVEx collects, uses and protects information in connection with the ProxmoxVEx landing website, the ProxmoxVEx application and the ProxmoxVEx licensing service.

Scope

ProxmoxVEx is primarily self-hosted software. This policy covers three distinct surfaces, which are treated differently:

• This website (proxmoxvex.com) — the marketing and documentation site.
• The licensing service (licensing.proxmoxvex.com) — handles purchases, license keys and the customer portal.
• The ProxmoxVEx application — the software you or your organization deploy on your own infrastructure, including the public demo.

Where the application is self-hosted, your organization is the data controller and its own privacy notice governs data inside that deployment. ProxmoxVEx does not receive a copy of the data stored in self-hosted installations.

Information we collect

On this website

This marketing site does not use analytics cookies, advertising trackers or browser fingerprinting. It does collect privacy-respecting usage analytics: a same-origin beacon reports page views, call-to-action clicks, outbound-link domains, demo-launch clicks, site-search queries (bounded length, with result counts), Web Vitals metrics (LCP/CLS/INP) and newsletter signups with the page path, referrer, language and screen size, and the web server records which pages and downloads were requested. Events carry a pseudonymous visitor id (kept in localStorage) and per-tab session id (sessionStorage) — no cookies — and are enriched server-side with your IP address, user agent and country (from CDN headers) before being forwarded to our own licensing service for aggregate reporting. The beacon honours the browser’s Do Not Track setting, and no analytics data is shared with or sold to third parties. Standard hosting infrastructure may additionally keep short-lived technical logs for security and abuse prevention.

When you purchase a license

When you buy a subscription or plugin, we collect:

• Contact details — the email address used to deliver your license key, receipts and renewal reminders.
• License records — your license key, purchased tier, billing period, activation history and device nicknames you assign in the customer portal.
• Payment metadata — transaction references and billing status. Payment card and PayPal account details are processed directly by our payment providers and are never stored by ProxmoxVEx.

Inside the application

A ProxmoxVEx deployment stores the data needed to operate it, which may include:

• Account information — usernames, email addresses, Argon2id-hashed passwords, and identifiers from LDAP or OIDC single sign-on.
• Authentication secrets — TOTP seeds, WebAuthn/FIDO2 credentials and scoped API tokens.
• Cluster credentials — connection details and API tokens for managed Proxmox VE clusters, stored encrypted at rest.
• Audit logs — records of security-relevant actions, signed with HMAC to be tamper-evident.
• Operational data — cluster inventory, configuration, alerts and usage data required to provide multi-cluster management.

This data remains on the operator’s infrastructure for self-hosted deployments.

The public demo

The hosted demo is a shared, non-production environment. Do not enter real credentials, personal data or production cluster details into it. Demo data may be reset or wiped at any time.

How we use information

We use collected information to:

• Provide and operate multi-cluster management, authentication and audit logging.
• Process purchases, deliver license keys and validate active subscriptions.
• Respond to support requests and communicate service or license changes.
• Improve the product, documentation and website.

We do not sell personal data to third parties, and we do not use purchase or account data for advertising.

Cookies and tracking

This website sets no tracking cookies; the usage analytics described above rely on pseudonymous localStorage/sessionStorage identifiers and honour Do Not Track. The application itself uses strictly necessary cookies — such as session and CSRF tokens — required for sign-in and security. Because these are essential to operate the service, no consent banner is shown.

Third parties and sub-processors

• Payment providers — PayPal (and Stripe, where enabled) process payments under their own privacy policies.
• Email delivery — license keys, receipts and support replies are sent through our email provider.
• Operator-configured integrations — notification plugins can route alerts to services such as Slack, Microsoft Teams, Discord, PagerDuty, ntfy, email or webhooks. These destinations are chosen and configured by the operator of each deployment, and any data sent to them is governed by that operator’s policies and the third party’s own terms.

We do not share personal data with third parties except as described above, to comply with law, or to protect the security of the service.

Data retention

• License and purchase records are retained for as long as your license is active and as required for accounting and tax purposes.
• Website usage analytics are retained in aggregate and event form for product improvement; events are associated with pseudonymous identifiers, not accounts.
• Application data retention in self-hosted deployments is controlled by the operator; deleting the deployment and its backups removes the data.
• Support correspondence is kept only as long as needed to resolve and track your request.

Data security

Sensitive data such as cluster credentials is encrypted at rest using Fernet field-level encryption. Passwords are hashed with Argon2id, and audit logs are HMAC-signed to be tamper-evident. Database volume encryption, TLS termination, network restriction and host patching are the operator’s responsibility — see the Security page for hardening guidance.

International transfers

Because ProxmoxVEx is self-hosted, application data stays wherever the operator runs it. Purchase and licensing data may be processed in the jurisdictions where we and our payment providers operate; where required, transfers rely on appropriate safeguards such as standard contractual clauses.

Your rights

Depending on your jurisdiction, you may have the right to access, correct, export or delete your personal data, and to object to or restrict certain processing.

• License and purchase data — the customer portal includes self-service profile editing, GDPR data export and a deletion-request flow; you can also contact us to exercise these rights.
• Application data — contact the administrator of your ProxmoxVEx instance. For self-hosted editions, your organization remains the data controller and is responsible for fulfilling these requests.

Children’s privacy

ProxmoxVEx is infrastructure management software intended for business and professional use. It is not directed at children, and we do not knowingly collect personal data from children.

Changes to this policy

We may update this policy as the product and services evolve. Material changes will be reflected on this page with an updated date; continued use after changes constitutes acceptance of the revised policy.

Contact

Questions about this policy, or requests relating to license and purchase data, can be sent through the support page or the support form in your ProxmoxVEx instance. For data held inside a self-hosted deployment, contact the operators of that deployment directly.