Privacy Policy

1. Who we are

NodexVPS Cloud Infrastructure Ltd. is the company responsible for your personal information (the “controller”) for the purposes described in this policy. Our office is at 18 King Street East, Unit 1400, Toronto, Ontario M5C 1C4, Canada.

We follow Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply to you, the EU and UK General Data Protection Regulation (GDPR) and US state privacy laws such as the California Consumer Privacy Act (CCPA).

If you live in Quebec, we also follow Quebec’s Act respecting the protection of personal information in the private sector (Law 25).

2. What this policy covers

This policy covers our website, the customer dashboard, checkout, our support channels and the services you order from us, such as virtual servers, domains and add-ons.

It does not cover the data you or your own visitors store on, or send through, your servers and websites. For that data you are the controller, and we only process it on your instructions to run the service (see “Data on your servers”).

3. Information we collect

We collect only what we need to run your account and services:

• Account details: your email address and password (stored only as a one-way hash), and, if you add them, your name, company, phone number and country.
• Billing and payment details: your invoices, the services you buy, your account balance and the payment method used. Card, wallet and bank payments are processed by our payment partners; we never see or store your full card number. For cryptocurrency payments we record the amount and transaction ID.
• Orders and services: the plans, locations, operating systems, applications, hostnames, IP addresses and SSH public keys linked to your account, and usage figures such as network traffic that we need to operate and bill your services.
• Domain registrations: the owner contact details (name, organisation, postal address, email and phone number) that domain registries require for every domain you register or transfer.
• Support and chat: the messages, tickets and files you send us, and transcripts of conversations in our website chat.
• Security and technical data: IP address, browser and device type, pages requested, account activity (for example sign-ins, password changes, orders and payments) and error reports. We use this to keep accounts safe, stop fraud and abuse, and fix problems.
• Cookies and similar technologies: see “Cookies” below.
• Job applications: the CV and details you send to our careers address.

4. How we use your information

• To create and manage your account and sign you in.
• To set up, run, maintain and support the servers, domains and other services you order.
• To bill you, process payments, renew the services you chose to renew automatically and keep accounting records.
• To send service messages such as order confirmations, invoices, renewal and expiry reminders, security alerts and important changes. These are part of the service, so you cannot turn them off while you have an account.
• To prevent and investigate fraud, payment abuse, spam, attacks and other breaches of our Acceptable Use Policy.
• To answer your questions and support requests.
• To understand how our website is used and improve it, only if you accept analytics cookies.
• To meet our legal obligations, such as tax and accounting rules and valid requests from authorities.

We do not make decisions about you by automated means alone that have legal or similarly significant effects. To protect customers from fraud, our system may pause a payment method after several failed payments; contact support and a person will review it.

5. Legal bases (EU and UK)

If the GDPR applies to you, we rely on these legal bases:

• Contract: to give you the account and services you ask for.
• Legal obligation: to keep tax and accounting records and to answer lawful requests.
• Legitimate interests: to keep our services secure, prevent fraud and abuse, and improve them, always balanced against your rights.
• Consent: for analytics cookies and any marketing emails. You can withdraw your consent at any time.

6. Data on your servers

You control what you install and store on your servers. We do not access, view or analyse the contents of your servers, disks or memory, except when you ask us to in a support request, when it is necessary to stop an attack or serious abuse that harms our network or other people, or when the law requires it.

We automatically record technical information about your servers, such as their status, network traffic and resource use, to operate, bill and protect the service.

Please keep your own backups. When a server is deleted, or a service ends and is not renewed, its disks are erased and the data cannot be recovered.

7. Who we share information with

We never sell or rent your personal information, and we do not share it for advertising. We share it only when needed, with:

• Companies that work on our behalf: data centre and network partners, payment processors, email delivery, website chat, bot protection and, with your consent, website analytics. They may use your information only to perform their work for us, under contracts that require them to protect it.
• Domain registries and our registrar: which need the owner’s contact details to register a domain. Some registries publish part of this data in public WHOIS or RDAP directories, as their rules require.
• Authorities: courts, regulators and law enforcement, when the law requires it, or to protect the rights, safety and property of our customers, the public or NodexVPS. Where we are allowed to, we tell you about such requests.
• A buyer or successor: if NodexVPS is merged, sold or restructured, who must protect your information as this policy describes.

8. International transfers

We are based in Canada and work with partners in other countries. Your server runs in the location you choose, and your information may be processed in Canada, the European Union, the United Kingdom, Switzerland, Iceland, Turkey, the United States, Singapore and other countries where we or our partners operate.

When personal information leaves the EU, the UK or Switzerland, we rely on safeguards those laws recognise, such as adequacy decisions (including the one for Canada) or the European Commission’s Standard Contractual Clauses.

9. Cookies

We use a small number of cookies and similar browser storage:

• Necessary: to keep you signed in, remember your order during checkout, remember your language, light or dark theme and cookie choice, and protect our forms from bots. The website cannot work properly without them.
• Chat: our website chat stores a cookie so that a conversation continues as you move between pages.
• Analytics (only with your consent): to count visits and see how pages are used, in aggregated form. We do not use advertising cookies.

You can change your analytics choice at any time by clearing this website’s cookies and stored data in your browser; the cookie banner then appears again. You can also block cookies in your browser settings, but blocking necessary cookies may stop sign-in or checkout from working.

10. How long we keep information

• Account and service information: while your account is open.
• Invoices, payment and accounting records: at least six years, as Canadian tax law requires.
• Account activity and security records: while your account is open, and afterwards for as long as needed to investigate fraud or abuse and to establish or defend legal claims.
• Error reports: 30 days.
• Job applications: up to one year after the role is filled, unless you ask us to delete yours sooner.

When you close your account, it is deactivated at once and can no longer be used to sign in. We keep billing, tax and security records for the periods above. To ask us to delete other information sooner, see “Your rights”.

11. Security

We protect your information with encrypted connections (HTTPS), one-way hashed passwords, encryption of stored secrets, access limited to the staff who need it, activity logging and regular security updates. Card payments are handled by certified payment partners.

No system is completely secure. If a breach affects your personal information and creates a real risk of significant harm, we will notify you and the relevant authorities as the law requires.

Please help us by using a strong, unique password and keeping it secret.

12. Your rights

Depending on where you live, you can ask us to:

• give you access to, or a copy of, the personal information we hold about you;
• correct information that is wrong or incomplete;
• delete your information, unless we must keep it by law;
• send your information to you or to another company in a portable format;
• restrict how we use it, or object to processing based on our legitimate interests;
• withdraw a consent you gave us, without affecting what we did before.

If you live in California, you can also ask which categories of personal information we collected, used and disclosed in the last 12 months. We do not sell or share personal information as California law defines those terms, and we will not treat you differently for using your rights.

You can update most account details yourself in your dashboard. For anything else, email [email protected] from the address on your account. We may need to confirm your identity, and we reply within 30 days.

You can also complain to a data protection authority: in Canada, the Office of the Privacy Commissioner of Canada; in the EU or the UK, the authority where you live or work.

13. Emails we send

Service emails, such as invoices, reminders and security alerts, are part of your account (see “How we use your information”). If we send news or offers, we do so only with your consent where the law requires it, and every such email includes a link to unsubscribe.

14. Children

Our services are for businesses and adults. They are not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.

15. Changes to this policy

We may update this policy when our services or the law change. We will publish the new version on this page with a new date and, for significant changes, tell you by email or in your dashboard before they take effect.

16. Contact us

Our privacy officer is responsible for how we handle personal information. For questions or requests about privacy, email [email protected].

By post: Privacy Officer, NodexVPS Cloud Infrastructure Ltd., 18 King Street East, Unit 1400, Toronto, Ontario M5C 1C4, Canada.