Privacy Policy

This policy describes what HostingBaba (hostingbaba.net) collects, why, who else handles it, and how long we keep it. It is written to match what the site actually does. HostingBaba is only for people aged 18 or over. Privacy questions: support@hostingbaba.net.

1. What we collect, and why

• Your email address — to run your account and send order, server and support messages.
• Your password — stored only as a one-way hash. If you sign in with Google, we have no password for you.
• What you order — plan, term, location, operating system, server name, any SSH public key and any notes.
• Your server's login details — kept so your dashboard can show them. Change the password after your first login.
• Payment records — the coin, network, amount and our payment provider's transaction reference. We never receive card or bank details.
• IP addresses — the address an order was placed from; addresses used to sign in, kept for 15 minutes to stop password guessing; the address behind each action on your server, kept in its history; and web server logs, kept for 14 days.
• Visit statistics — when a page loads in your browser we record the page, the site you came from, your browser, device type, screen width, language and time zone, with a visitor code made from your IP address and browser using a secret that changes every day. The IP address itself is not stored, no cookie is set, and the statistics are kept for 90 days. If you are signed in, your visits are linked to your account.
• Your balance — every top-up, refund credit and payment from balance, so your balance can always be explained.
• Your agreement — when you order, a record of which versions of our policies you agreed to, when, and the IP address you agreed from.
• Support messages you send us, and our replies.

We use this to provide the service you ordered, to keep it secure and prevent fraud, and to meet our legal obligations. We do not sell your data or use it for advertising.

This policy covers data about you as our customer. Data you store on your own server is yours to manage: we do not look at it, except where we must to deal with abuse, a security incident or a legal requirement.

2. Sign in with Google

If you choose it, Google tells us your email address and that Google has verified it. Nothing else.

3. Who we share it with

Only the services needed to run HostingBaba:

• Fasthosts (United Kingdom), which hosts our website and database.
• Our hosting partner (Germany, and the server location you choose), which runs your server.
• OxaPay, which processes cryptocurrency payments.
• Brevo (European Union), which delivers the emails we send.
• Our email hosting provider, which receives the emails you send us.
• Google (United States), only if you choose to sign in with Google.

Payments made on a blockchain are public and permanent; we cannot delete them.

4. Where your data is processed

Our website and database are in the United Kingdom. Your data may also be processed in the European Union, and in the United States if you sign in with Google.

5. How long we keep it

• Sign-in attempts: 15 minutes.
• Password reset links: one hour, stored only in a form that cannot be turned back into a working link.
• Web server logs: 14 days.
• Your account, orders and payment records: while your account is open, and afterwards for as long as we need them for accounting and to handle disputes.

6. Your rights

You can ask for a copy of your data, ask us to correct it, or ask us to delete your account, and you can object to or restrict some processing where the law gives you that right. Email us from your account address; we may ask you to confirm it is you. Deleting an account does not remove records we must keep by law, ends access to any running servers, and forfeits any unused balance credit. You can complain to your data protection authority.

7. Security

The site is served only over HTTPS. Account passwords and reset links are stored hashed. Sign-in is rate limited, and changing or resetting your password signs out every other session.

8. Cookies

We set one cookie, hbsid, which keeps you signed in and protects forms against forgery. It is deleted when you close your browser. We use no analytics, advertising or tracking cookies, and load no third-party scripts. If you sign in with Google, Google sets its own cookies on its own pages.

9. Changes

If we change this policy we update the date at the top. If a change affects how we use data you have already given us, we email you first.