Privacy Policy | HostiGuard

HOSTI GUARD LLC ("we", "us") respects your privacy. This Privacy Policy explains what personal data we collect when you visit hostiguard.com, create an account or use our Services, why we collect it, who we share it with, how long we keep it and what rights you have. It applies to our website, client area, control panels, support channels and every Service we provide. Where we act on behalf of a registrar, registry or other partner, their own privacy notices also apply.

By using our website or Services you acknowledge that you have read this Policy. If you provide us with personal data about other people (for example a domain registrant or a sub-user), you confirm that you are allowed to do so and that you have informed them of this Policy.

1. Information we collect

Information you give us. When you register, place an order, open a ticket or contact us we collect the data you provide, such as:

identity and contact details — name, company name, postal address, country, e-mail address and telephone number;
account details — username, password (stored in hashed form), language, currency, security settings and API keys;
domain registrant, administrative and technical contact details required by ICANN and registries;
billing information — invoices, payment history and the payment method used. Card numbers are processed directly by our payment providers; we receive only a token, the card type and the last four digits;
the content of your support tickets, e-mails, live chats and reviews, and documents you send us for identity, organisation or SSL validation;
preferences such as newsletter subscriptions, auto-renewal choices and notification settings.

Information collected automatically. When you use our website, client area or Services we record technical data such as your IP address, device and browser type, operating system, language, referring page, the pages you visit and the actions you take, time stamps, and error logs. Our servers also keep access, e-mail and security logs relating to the Services you host with us.

Information from third parties. We may receive data from payment providers (payment status, fraud scores), from registrars and registries (domain status, transfer confirmations), from Certificate Authorities (validation results), from fraud-prevention services, and from public sources such as WHOIS records.

Content you host. The files, databases, e-mails and other content you store on our infrastructure belong to you. We process them only to provide, back up, secure and support the Services, and we do not use them for any other purpose except where the law or an abuse investigation requires.

2. HostiGuard Drive (cloud storage and desktop app)

This section explains what the HostiGuard Drive service, the web interface at drive.hostiguard.com and the HostiGuard Drive desktop application ("the App") collect and how we use it. The rest of this Policy also applies.

What the App sends to HostiGuard.

Account data: your e-mail address and a sign-in token used to keep you signed in.
Device data: the device name, operating system platform, App version and interface language. We use it to show your linked devices in your account and to let you sign a device out remotely.
Your files: the names, folder paths, sizes, modification dates and contents of the files you place in your HostiGuard Drive folder or upload, and earlier versions of those files. We store them only to provide the service to you.
Status checks: when it starts and about every 15 minutes, the App contacts hostiguard.com to confirm that its version is still supported and to refresh your storage usage. This request includes the App version and platform.

What the App does not do.

It does not show advertising and does not use your files for advertising.
It does not collect your location, contacts or browsing history.
It does not send crash reports or usage analytics.
We do not sell your files or your personal information.

What is stored on your device.

Settings, an activity list and a local index of synced files are kept in your Windows user profile (AppData\Local\HostiGuard Drive).
Your sign-in token is stored encrypted on your device.
Signing out of the App removes the token from the device. Uninstalling the App removes the App; files in your HostiGuard Drive folder stay on your computer unless you delete them.

Where your files are stored and how they are protected.

Files are stored on servers operated by or for HostiGuard located in the Netherlands and Canada.
Files are transferred between the App and our servers over encrypted HTTPS connections.
HostiGuard staff do not open your files except when needed to provide support you request, to investigate abuse reported to us, or to comply with the law.

Shared links.

If you create a public link to a file or folder, anyone who has the link can open it and, if you allow downloads, download it. You can turn a link off at any time.
We may disable a shared link that is reported to us and found to break our Terms of Service.

How long we keep files.

Deleted files stay in the Trash for 7 days. After that you can no longer restore them, and they are permanently deleted.
Earlier versions of a file are kept up to the 5 most recent versions; older versions are deleted automatically.
When a Cloud Storage subscription ends, your files are kept for 7 days so you can download them. After that you can no longer access them, and they are permanently deleted.

Your choices.

You can delete files, empty the Trash, turn off shared links, sign a device out and close your Cloud Storage subscription from your HostiGuard account.
To ask for a copy or the deletion of your data, contact us at [email protected].

Microsoft Store.

If you install the App from the Microsoft Store, Microsoft processes the download and installation under its own privacy statement.

3. How we use your information

We use personal data to:

create and manage your account, verify your identity and process your orders, payments, renewals and transfers;
register, renew and manage domain names and submit the required registrant data to registrars and registries;
provision, operate, monitor, secure and back up hosting, servers, e-mail and other Services;
issue SSL certificates and complete the validation requested by Certificate Authorities;
provide customer and technical support and answer your requests;
send service messages such as invoices, renewal and expiry reminders, security alerts, maintenance notices and changes to our terms;
send marketing e-mails about our products and offers where you have agreed to receive them — you can unsubscribe at any time from the link in each message or from your client area;
detect, prevent and investigate fraud, abuse, spam, security incidents and violations of our Terms of Service;
comply with legal obligations, court orders, tax and accounting rules, and the policies of ICANN, registries and payment networks;
analyse the use of our website and Services in order to improve them.

Where data-protection law requires a legal basis, we rely on the performance of our contract with you, our legitimate interests (security, fraud prevention, improving our Services), your consent (marketing, non-essential cookies) and compliance with our legal obligations.

We do not sell or rent personal data. We share it only with the following categories of recipients, and only to the extent necessary:

Registrars, registries and ICANN — registrant contact data is transmitted to the sponsoring registrar and the registry of each domain name, and may be published in WHOIS/RDAP or made available to third parties with a legitimate interest, subject to the registry's rules. Where free WHOIS privacy is available, our or the registrar's proxy details are published instead.
Certificate Authorities — for validation and issuance of SSL certificates.
Payment providers and banks — to take payments, issue refunds, handle chargebacks and prevent fraud. Depending on the method you choose, this may be Stripe, Paddle, Airwallex, PayPal, Network International or Mercury. They receive the data needed for the transaction (such as name, e-mail, billing address, amount and order reference) and act as independent controllers under their own privacy policies.
Infrastructure and software providers — data-centre operators, network providers, control-panel and licence vendors, e-mail delivery and backup providers, which process data under contracts that require them to protect it.
Third-party product suppliers — when you buy a marketplace or third-party product, the data needed to activate it.
Google (advertising measurement) — the ad click identifier, the order reference and amount of a purchase that came from a Google ad, and, only when enhanced conversions are turned on, your e-mail address in hashed (SHA-256) form. See section 5.
Professional advisers and authorities — auditors, lawyers, courts, law-enforcement or regulatory bodies where the law requires it or where necessary to protect our rights, our customers or the public.
A successor — in the event of a merger, acquisition or sale of assets, subject to this Policy.

Some payments are sold through Paddle as merchant of record. For those orders Paddle is the seller on your statement and processes your billing data as a controller for tax and invoicing purposes.

5. Cookies and similar technologies

Our website and client area use cookies and similar technologies (local storage, pixels). A cookie is a small text file stored by your browser. We use:

Strictly necessary cookies — to keep you signed in, remember your language, currency and shopping cart, protect forms against cross-site request forgery, and balance load. The website cannot function without them.
Preference cookies — to remember choices such as the dismissed policy notice or regional settings.
Analytics cookies — to understand how visitors use our pages (page views, referrers, approximate location). Where we use third-party analytics, IP addresses are truncated or anonymised where the tool allows it.
Affiliate cookies — to attribute a purchase to the partner who referred you, for a limited period.
Advertising measurement cookies — we use Google Ads conversion tracking to measure how our ads perform. When you arrive from a Google ad, Google may set cookies, and we store the ad click identifier and campaign name with your order so we can count purchases that came from ads (for up to 90 days after the click). When we turn on Google's enhanced conversions, your e-mail address is sent to Google only in hashed (SHA-256) form. We do not share your name, payment details or the contents of your Services with Google. You can control ad personalisation at https://myadcenter.google.com.
Meta Pixel — we use the Meta Pixel from Meta Platforms (Facebook and Instagram) to measure and improve our ads on those services. When you visit our website, Meta may set cookies and receive technical information such as the pages you view, your browser, device and IP address, and may link it with your Facebook or Instagram account under Meta's own privacy policy. We do not send your name, payment details or the contents of your Services to Meta. You can manage your ad preferences at https://www.facebook.com/adpreferences.

You can delete or block cookies in your browser settings. Blocking strictly necessary cookies will prevent you from logging in or ordering. Where the law requires it, non-essential cookies are set only after you have given your consent.

6. How we protect your information

We use technical and organisational measures appropriate to the risk, including encryption in transit (TLS), hashed passwords, firewalls and DDoS mitigation, access controls and logging, network segmentation, regular updates and backups, and staff access restricted to what is needed for their role. No system is completely secure, and you are responsible for choosing a strong password, enabling two-factor authentication where available, and keeping your own software and content secure.

Card details are never stored on our servers. When you pay by card the details are collected by our payment provider on their own secure page or form and we receive only a token, the card brand, the last four digits and the expiry date — enough to show you which card was used and to take an agreed renewal. Our payment providers are certified to PCI DSS Level 1.

7. How long we keep your information

We keep personal data for as long as your account is active and as long as needed for the purposes described above. Invoices and payment records are kept for the period required by tax and accounting law. Domain registration data is retained for the period required by ICANN and registry policies after the domain is deleted or transferred. Server, e-mail and security logs are kept for a limited period for security and troubleshooting. Content of terminated Services is deleted according to the Terms of Service. When data is no longer needed, we delete or anonymise it.

8. Your rights and choices

Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to have it deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent at any time without affecting processing carried out before withdrawal. You may also have the right to lodge a complaint with your local data-protection authority.

You can update most of your details and your marketing preferences directly in your client area. For any other request, contact us at [email protected]; we may ask you to verify your identity first. Please note that we cannot delete data that we are required by law, by ICANN or by a registry to keep, or that is needed to complete an order you have placed.

9. International transfers

Our Services are provided from data centres in several countries, and our registrars, registries, Certificate Authorities and payment providers may be located anywhere in the world. Your data may therefore be transferred to and processed in a country other than your own. Where required, we rely on appropriate safeguards such as contractual data-protection clauses with our providers.

10. Children

Our Services are intended for adults and businesses. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us at [email protected] and we will delete it.

11. Third-party websites

Our website may contain links to websites that we do not operate, and the websites you host with us are controlled by you, not by us. This Policy does not apply to them; please review the privacy notice of every website you visit.

12. AI apps and the HostiGuard Connector

This section applies when you connect your account to an AI app, such as Claude by Anthropic, through the HostiGuard Connector (hostiguard.com/claude-connector). The rest of this Policy also applies.

What is shared, and when.

Nothing is sent to an AI app unless you connect it yourself, signed in on hostiguard.com, and approve the access shown on the consent screen.
After that, the AI app receives only the information it asks for while you use it, and only from your own account — for example your account summary, invoices, services, domains and DNS records, support tickets and notifications, and, only if you allowed "Drive files", the names, folders and share links of your HostiGuard Drive files. The contents of your files are not sent.
For e-mail, only your mailbox addresses, their space and the mail-client settings are shared. The content of your e-mails is never read by the connector or sent to an AI app.
Passwords, keys, card details and two-step verification codes are never shared.

What the AI app does with it. The information becomes part of your conversation with the AI app and is processed by its provider (for Claude: Anthropic) under that provider's own terms and privacy policy, which we encourage you to read. We are not responsible for how the AI provider processes it.

What we keep. For security, support and abuse prevention we record each request made through the connector (date and time, the action, a short summary, the result, the app and the IP address) for a limited period, currently 90 days. You can see this activity in your client area under Connected apps, and our staff can see it to keep your account safe and to help you.

No AI training. HOSTI GUARD LLC does not use your data or your files to train artificial-intelligence models, and does not sell or give them to AI providers.

Your control. You can disconnect an AI app at any time in your client area under Connected apps, or in the AI app; access stops at once. We may also limit, suspend or switch off the connector for any account at any time without giving a reason.

13. Changes to this Policy

We may update this Policy from time to time. The current version is always available at hostiguard.com/privacy with its "last updated" date, and significant changes will be announced on our website or by e-mail. Your continued use of the Services after a change takes effect indicates acceptance of the updated Policy.

14. Contact

Questions or requests about this Policy or about your personal data may be sent to HOSTI GUARD LLC, 8206 LOUISIANA BLVD NE, or by e-mail to [email protected].