Privacy policy

The controller is the person or entity operating the relevant Hostiko service. Its name, address and contact details are available on the Contacts page for your region; your contract or invoice also identifies your service supplier. Send privacy enquiries to that email address or contact support through your customer dashboard.

Applicable data protection law, including the GDPR where it applies, governs processing. This policy provides information about processing and does not constitute consent to it.

• Account and contact data: email address, language, account identifier, and the name, phone number, address, country, company and tax details you supply. If you choose Google, GitHub or Discord sign-in, we receive the data that provider shares within the access you authorise.
• Service and payment data: orders, servers, plans, invoices, amounts, currencies, payment status and transaction identifiers. Payment providers process information entered on their pages under their own policies.
• Support data: your messages, attachments and information needed to resolve an enquiry.
• Technical data: IP address, approximate country, page URLs, referrer, browser, device and error information. Looking Glass also processes the target IP address or domain, selected node, test parameters and results.
• Attribution data: visitor identifier, landing pages, referrals, UTM tags and advertising click identifiers. Website code can also read Google Analytics and Meta identifiers from cookies already available in the browser.
• Device characteristics used to associate visits: language, time zone, screen dimensions, platform, processor count, memory information exposed by the browser and touch support. These can distinguish a visitor when combined with identifiers and are not necessarily anonymous.

Data comes from you, your browser, the sign-in and payment providers you choose, and service delivery systems. The data collected depends on the functions you use.

• Account creation, sign-in, orders, service delivery, billing and related support: performance of a contract or steps requested before entering into one.
• Accounting, tax records and mandatory disclosures: compliance with legal obligations.
• Security, abuse prevention, troubleshooting and legal claims: legitimate interests in protecting the service and legal rights, balanced against your rights.
• Saving preferences: providing requested functions; separate consent where applicable law requires it.
• Attribution and advertising measurement: associating visits with referral sources and orders. Optional tracking requires prior consent where required by law; legitimate interests cannot replace mandatory consent for access to device information.

Service messages concern account operation, payments and security. Promotional messages need a lawful basis and can be stopped through the method in the message or by contacting support. Visiting the site or enabling cookies is not consent to advertising.

Without data needed for the contract or required by law, we cannot provide the relevant account, service or billing documents.

• Preferences: theme, country, currency and customer type. The theme cookie lasts up to one year and is renewed when the theme is selected again.
• Attribution and account linking: a visitor identifier, referral and campaign data are stored locally; redirects can pass the identifier, return URL and regional preferences to the account portal.
• Temporary session records support redirects and prevent duplicate submissions. They normally end with the tab session, but may be restored by the browser.

Local storage has no built-in expiry and remains until you, the browser or the application clear it. Browser settings let you delete or restrict cookies and site data, which may reset preferences or affect sign-in. This does not delete server-side records or provide a permanent tracking opt-out: records may be created again on a later visit.

Data may be accessible to authorised staff and contractors, infrastructure and data-centre providers, authentication, email, support and error-monitoring services, and payment providers and banks. Advisers and public authorities receive data where there is a lawful basis. Access is limited to the relevant tasks and is subject to appropriate technical and organisational safeguards.

Service providers may act on our instructions or as independent controllers, such as banks and external sign-in services. Their policies apply to their own processing. Contact us for information about recipients of your data.

Account, payment and support data may be processed in a different country from your rented server, depending on the operator and providers involved.

Where the GDPR applies, transfers outside the European Economic Area require a valid transfer mechanism, such as an adequacy decision or appropriate safeguards, including standard contractual clauses and any necessary supplementary measures. Contact us for the countries, safeguards applicable to your data and how to obtain a copy.

• Account and service data is used throughout the service relationship. Afterwards, retention is limited by outstanding payments, applicable record-keeping duties and limitation periods for legal claims.
• Invoices and tax documents are subject to the statutory retention periods applicable to the supplier; account closure does not remove those duties.
• For support correspondence, logs and visit data, relevant factors are resolution of the enquiry or incident, the attribution purpose and any specific legal claim. Fixed retention periods for these categories have not yet been established.

Data must be deleted or irreversibly anonymised when its lawful retention grounds end. Where consent is the basis, withdrawal ends that processing unless another lawful ground requires retention. Browser storage periods are described above.

• Request information and access to your data, and correction of inaccurate data.
• Request erasure, restriction or data portability where the statutory conditions are met.
• Object to processing based on legitimate interests. You may object to direct marketing at any time.
• Withdraw consent at any time without affecting the lawfulness of prior processing. Where applicable, exercise the safeguards concerning solely automated decisions with legal or similarly significant effects, including human intervention and contesting the decision.

Send your request to the contact address above or through support, identifying the account or visit concerned and the right you wish to exercise. If there are reasonable doubts about your identity, we may request only the additional information needed to verify it.

Under the GDPR, we respond without undue delay and within one month of receipt. For complex or numerous requests this may be extended by up to two further months, with reasons given within the first month. Requests are generally free of charge; exceptions and restrictions apply only as permitted by law.

You may complain to a competent data protection authority, including in the EEA country where you habitually live, work or where the alleged infringement occurred, and seek a judicial remedy.

When you host other people’s personal data, you are responsible for your purposes and legal basis. Where Hostiko processes that data on your instructions, the applicable contract and required data processing agreement govern that processing. This policy does not replace that agreement.

The revision date appears above. Material changes affecting your rights are communicated as required by law. Publishing a new version does not itself provide consent to new processing purposes.