Privacy Policy

1. Information we collect

Your account, contact and billing details — and, for domains, your registrant details — are needed to make and carry out our contract with you; without them we can't provide the Services, and domain registries require registrant details by their rules. Everything else is optional or collected automatically as you use the Services.

• Account and contact details — name, email, phone, company, address, account settings, and team members you invite.
• Billing details — billing name and address, invoices, payment history and account credit. Card payments are handled on our payment processor's secure page; we keep only limited details such as card brand, last four digits and expiry, never full card numbers.
• Domain registrant details — the contact details registries require for each domain, and your WHOIS privacy choice.
• Service details — the servers, domains, DNS records, certificates, mailboxes, storage, settings and configuration you create, and records of what was done in your account and by whom.
• Technical and security data — IP addresses, browser and device information, sign-ins, two-factor events, security alerts and audit logs.
• Data from the servers we run for you — health and resource metrics, security events (including addresses that attacked your server) and backup records, collected by agents on those servers to provide the services you chose. Backups are encrypted.
• Licence check-ins — for software we license, the licence key, an instance identifier, the software version and the server's address, sent when the software confirms its subscription.
• Support and communications — tickets, live-chat messages, emails, call notes and your communication preferences.
• Sign-in with another service — if you choose social sign-in, the name, email and account identifier that service shares with us.
• Newsletter and enquiries — your email for updates you ask for, and details you send through contact or lead forms.
• Job applications — your CV, contact details and anything else you send when you apply for a role.
• Information from others — the owner of an account who invites you to their team; the sign-in service you choose; our payment processor (payment status and fraud signals); domain registries and our registrar (domain status); and people who report abuse or send legal notices about Services on your account.

2. How we use information and our legal bases

• To provide, set up, maintain and support the Services and your account — performance of our contract with you.
• To bill you, collect payments, prevent fraud and enforce our terms — contract, and our legitimate interests in being paid and preventing abuse.
• To secure the platform — authentication, abuse and attack detection, rate limits, investigating incidents — legitimate interests and, where it applies, legal obligation.
• To send service messages (orders, invoices, renewals, security, outages) — contract and legitimate interests. To send news or offers — consent or legitimate interests, and you can opt out at any time.
• To improve the Services and understand how they are used, using limited, aggregated information — legitimate interests.
• To comply with law, keep tax and accounting records, and respond to lawful requests — legal obligation.
• To consider job applications — steps before a contract, and legitimate interests.

3. Automated decisions & AI

We use automated scoring to help our team prioritise sales and support conversations and to spot accounts that may need help. These scores do not decide your access to the Services, your price, or anything with a legal or similarly significant effect on you; you can object to this processing by contacting us. Fraud and abuse checks may delay or decline an order for manual review by a person.

When you use AI features, your prompts and the outputs are processed by AI service providers acting for us, to generate the result. We do not use your Customer Content to train AI models.

4. Who we share information with

We do not sell your personal information and we do not share it for cross-context behavioural advertising.

We share it only as needed to run the Services, with service providers bound by contract to protect it and use it only on our instructions. They fall into these categories: data-centre and infrastructure providers; domain registrars and registries; certificate authorities; email hosting and email-delivery providers; DNS, network-security and content-delivery providers; storage and backup providers; payment processing; AI processing; and tools we use for support and internal operations. The current list of our sub-processors is available to customers on request.

Domain registrations: registries and registrars receive the contact details required to register your domain and may be required to keep them and disclose them in limited cases (see the Domain Registration Agreement). Public WHOIS shows your details only where you have turned privacy off or where an extension does not allow privacy.

If we receive a copyright or abuse complaint about Services on your account, we may share it with you, including the complainant's contact details; if you send us such a complaint, we may share it with the customer concerned.

We may also disclose information to comply with law, a court order or a valid legal request; to enforce our agreements; to protect the rights, safety and security of our customers, the public or us; or as part of a merger, acquisition or sale of assets, under this Policy.

5. Where information is processed

Servers, hosting and other Services you buy run in the region you choose when you order; the locations available — in Europe, North America, Asia and Australia — are shown at that point. Account, billing and support information is processed in the United States and in other countries where we and our service providers operate. When we transfer personal information out of the EEA, UK or Switzerland, we use safeguards recognised by law, such as the Standard Contractual Clauses.

6. How long we keep information

We keep account information while your account is open and for as long as needed afterwards to settle accounts, resolve disputes and meet legal duties — invoices and tax records are generally kept for 7 years as tax law requires. When a Service ends, its data is deleted as described in our Terms; copies in our own database backups are cycled out within 30 days. Security logs are kept only as long as needed to protect the platform. Newsletter data is kept until you unsubscribe. Job applications are kept while we consider them and for future openings only if you agree, and are deleted on request.

7. How we protect information

We use layered safeguards: encryption in transit (HTTPS/TLS) everywhere, encryption at rest for sensitive fields, salted password hashing, two-factor authentication, server-side session control, rate limits and brute-force lockout, least-privilege staff access, and audit logging. No system is perfectly secure, but we work continuously to protect your data.

8. If something goes wrong

If a security incident affects your personal information, we will tell you without undue delay, explain what happened and what we are doing, and notify regulators where the law requires — within 72 hours where the GDPR applies.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to restrict or object to our use of it (including direct marketing and the scoring described in Section 3), and to withdraw consent at any time. Many of these you can do yourself in your portal (for example, exporting your data or closing your account); otherwise contact us. We answer within one month (or 45 days where a US state law sets that period), may extend this where the law allows, and may need to verify your identity. If we decline a request, you can appeal by replying to our decision; we answer appeals within 60 days at the latest (sooner where your state's law requires), and if you are still unhappy you can contact your state attorney general. You may also complain to your data-protection authority.

10. California & other US state privacy rights

In the last 12 months we collected the categories of information listed in Section 1 (identifiers, commercial and billing information, internet activity, approximate location from IP address, professional information, and job-application information) for the purposes in Section 2, kept them for the periods in Section 6, and disclosed them for business purposes to the categories of recipients in Section 4. We do not sell or share personal information, we do not use it for targeted advertising or for profiling with legal or similarly significant effects, and we have no actual knowledge of selling or sharing information about anyone under 16.

The only sensitive personal information we handle is your account login (your password is stored only as a salted hash) and, through our payment processor, your payment card details; we use it only to provide and secure the Services, never to infer characteristics about you.

Depending on your state, you may ask to know, access, correct, delete or receive a copy of your personal information, and use an authorised agent; we will not treat you differently for doing so. Appeals work as described in Section 9. We honour Global Privacy Control signals as an opt-out, although we do not sell or share personal information.

11. Cookies

We use only the cookies and similar storage needed to run the site and remember your preferences — see the Cookie Policy. We do not use advertising or cross-site tracking cookies.

12. Children

The Services are not directed to children under 16, and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it.

13. Changes & contact

We may update this Policy; we will post the new version with its date and tell you about material changes. Questions and requests: [email protected], or PixelForge Cloud LLC, Hiram, Georgia, United States.