Privacy Policy

1. Information Collection Architecture

We collect and process personal data directly connected to the provisioning and maintenance of our hosting infrastructure. This includes standard identifiers (name, email, physical address for fraud mitigation) and payment processing tokens via our PCI-compliant payment gateway. We do not store raw credit card numbers on our servers.

For detailed information about cookies and tracking technologies used on our platform, please review our Cookie Policy.

3. AI-Assisted Network Threat Monitoring

To ensure the global reliability of our ASN, infrastructure logs (IP addresses, ingress bandwidth, error routing) may be processed by AI-assisted monitoring tools. These predictive models are deployed purely for internal site security, rapid DDoS mitigation, and anomaly detection. These monitoring deployments never inspect or parse the underlying file contents housed on your hosted volumes.

4. GDPR & Data Portability Windows

In compliance with universal 2026 mandates spanning GDPR and the EU Data Act, we codify the following absolute rights regarding your structured data profiles:

• Right of Access & Portability: You maintain continuous API or dashboard access to export a complete JSON ledger of your profile metadata and interaction history.
• Right to Rectification: You may correct inaccurate primary identifiers immediately via the billing portal.
• 30-Day "Right to be Forgotten" Limit: Authorized requests to permanently purge an account hierarchy will be securely executed, cascaded across backup arrays, and mathematically confirmed within a strict 30-day enforcement window. Note that legally required taxation ledgers may persist for 7 years on vaulted servers.

5. Encryption & Backup Discipline

Communications across our frontend API and client dashboards are encrypted via Transport Layer Security (TLS 1.3). Databases housing your personal data use Advanced Encryption Standard (AES-256) block ciphers at rest. Our core management infrastructure executes an automated daily backup cycle via Backuply, storing data on separate physical servers in distinct geographic zones.

Automated Snapshots: If you subscribe to the optional Automated Snapshot add-on, snapshot data is stored on encrypted volumes in the same datacenter region as your primary instance. Snapshots are retained according to your selected schedule (daily, weekly, or monthly) and are permanently deleted within 48 hours of add-on cancellation or account termination. Snapshot data is not shared with third parties.

6. Sub-Processor Network & Transit Providers

To distribute your traffic globally, we route data through Tier-1 transit providers including NTT, GTT, and Cogent. These carriers transport network packets between our datacenters and the public internet. Transit providers process IP addresses and packet headers as part of standard network routing but do not have access to application-level data or hosted content.

We also integrate with datacenter facility operators and edge security providers. All sub-processors are contractually bound by Data Processing Agreements (DPAs) that enforce data protection standards equivalent to our own.

Named sub-processors that may process visitor or customer data:

• Cloudflare Turnstile (US): CAPTCHA / bot detection on contact, abuse, and migration forms. Processes the visitor's IP, browser fingerprint, and a short-lived challenge token. Loads on pages that contain a form; required for form submission.
• WHMCS (UK-headquartered, our self-hosted instance): customer billing, support tickets, and account management. Processes name, email, billing address, and support-ticket content. Hosted on our own infrastructure; not a third-party SaaS.
• Google Analytics 4 (US): aggregate traffic analytics. Only loaded after the visitor grants the "analytics" consent category. Configured with Consent Mode v2 and IP anonymisation. Visitors who do not opt in are not measured.
• Tawk.to (Cyprus / US backend): live chat widget. Only loaded after the visitor grants the "marketing" consent category. Captures chat content, email address (if provided), and the visitor's IP for session continuity. Not loaded for visitors who decline.
• MailWiz (our self-hosted instance): outbound transactional email for lead-magnet downloads, newsletter subscriptions, and feedback responses. Processes the email address you submit and the message metadata.
• ipapi.co (US): geolocation lookup for the "nearest datacenter" suggestion on product pages. Your browser never talks to ipapi.co directly; the lookup is proxied through our own /api/geoip endpoint, which caches results server-side per anonymised IP prefix (/24 for IPv4, /48 for IPv6) for 24 hours. Only the anonymised prefix is used as the cache key. The full IP is forwarded upstream to ipapi.co for the city / country / lat-long lookup but is not retained on our servers. Migration to a self-hosted MaxMind GeoLite2 database is planned and will remove this upstream dependency entirely.
• Backuply: encrypted backup snapshots for hosting accounts. Snapshots stored on separate physical servers in distinct geographic zones within the same continental region as your primary instance. Deleted within 48 hours of account termination.

What we do not use: The marketing site does not load fonts, stylesheets, or application scripts from third-party CDNs that would transmit your IP address as a side effect of page rendering. In particular, fonts (Bricolage Grotesque, Figtree, JetBrains Mono) are self-hosted from our origin rather than loaded via Google Fonts. This eliminates a known GDPR concern flagged by the 2022 LG München I ruling and avoids any consent-required data flow purely to render the page.

7. Legal & Authorized Disclosures

We disclose data to law enforcement only when required by valid, legally binding subpoenas from a competent jurisdiction. Our default posture is to notify the affected user before data handoff, unless prohibited by the requesting legal authority.