Privacy Policy

This policy explains what information VPS.org LLC collects when you use vps.org, the control panel at admin.vps.org and our support desk, what we use it for, who we share it with and how long we keep it.

1. Information you give us

• Account details: email address, name, and if you add them, phone number, company, billing address and SSH public keys. Passwords are stored only as hashes. If you turn on two-factor authentication we store its secret.
• Payment details: cards are handled by Stripe and PayPal payments by PayPal. We keep the card brand, last four digits, expiry date and the payment provider's reference, not the full card number.
• Orders and billing: the servers, add-ons, domains and subscriptions you order, invoices, payments, refunds and account credit.
• Domain registrations: the registrant contact details you enter, which we pass to our registrar to register the domain.
• Messages: support tickets, contact form messages and emails you send us, and the email address you give when you sign up for the newsletter.
• AI Site Builder and WhatsApp builder: the prompts, messages and site content you create, and for the WhatsApp builder your phone number.

2. Information collected automatically

• IP address and browser user agent, recorded when you sign up, open a checkout page, make API requests, search for a domain, click links on vps.org that we count, rate a page or sign up for the newsletter. We also use IP addresses to detect fraud and card testing, and we look up an approximate country from an IP address with a locally stored database.
• Server data: the IP addresses assigned to your servers, resource usage and network traffic volumes. We use these for billing, capacity planning and detecting abuse such as outbound attacks. We do not browse the files on your server. Some control panel features and health checks run commands on your server through the QEMU guest agent, for example resetting the root password or showing fail2ban bans.
• Standard web server logs of requests to our websites.

3. Cookies

• sessionid: keeps you signed in and remembers a language you choose.
• csrftoken: protects forms against cross-site request forgery.
• vps_ref: set only when you arrive through a referral link, so the referring affiliate is credited. It lasts 90 days.
• Clicky: our website analytics service sets cookies to count visits and page views.

You can block or delete cookies in your browser. Without the session and csrftoken cookies you cannot sign in or submit forms.

4. How we use information

• To provide the services: create and run servers, register domains, and answer support requests.
• To bill you and collect payment.
• To prevent fraud, card testing and abuse of our network, and to enforce our terms.
• To send account, billing, security and onboarding emails, and the newsletter if you signed up for it.
• To understand how the website is used and improve it.

We do not sell or rent your personal information.

5. Service providers we share information with

We share information only as needed for these providers to do their part:

• Stripe: card payments.
• PayPal: PayPal payments.
• Dynadot: domain registration and management, including registrant contact details.
• Anthropic: processes AI Site Builder prompts and site content to generate responses.
• Twilio: delivers WhatsApp builder messages, including your phone number.
• Google and GitHub: only if you choose to sign in with them. We receive your name and email address.
• Clicky: website analytics on vps.org.
• DigitalOcean: hosts our support desk at support.vps.org and stores off-site copies of our database backups.

We may also disclose information when the law requires it, or to protect our rights, our customers or the public from fraud or abuse.

6. Where information is stored

Our servers and your virtual servers are in New Jersey, United States. The providers listed above may process information in other countries.

7. How long we keep information

• Account, order and billing records: while your account exists, and after it is closed, because closing an account deactivates it rather than deleting it.
• Server disks: deleted when the server is destroyed. Backups are deleted automatically after 7 days (daily backups) or 28 days (weekly backups).
• Logs and analytics records that contain IP addresses, such as click, checkout visit and API request records: we do not currently delete these on a fixed schedule. You can ask us to delete the ones linked to you.
• Expired sign-in sessions: removed daily.
• Support tickets, messages and newsletter signups: kept until you ask us to delete them or they are no longer needed.

8. Security

Our websites use HTTPS, passwords are stored as hashes, full card numbers never reach our servers, two-factor authentication is available for your account, and access to customer data is limited to the people who run the service. No system is perfectly secure, and we cannot guarantee the security of information.

9. Your choices and requests

You can update most account details in the control panel, and you can ask to be removed from the newsletter at any time. To ask for a copy of your information, a correction, or deletion, email us from the address on your account. We may need to keep some records, such as invoices and payments, where the law requires it or to settle disputes.

10. Children

The services are not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has given us information, contact us and we will delete it.

11. Changes to this policy

We may update this policy. When we do, we change the date at the top of this page.

12. Contact

Questions and privacy requests: