Privacy Policy

This Privacy Policy explains what personal data Zeros Host collects, how we use it, the lawful basis for processing, and what rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

The data controller is Zeros Host, a sole trader business based in the United Kingdom. For any data protection queries, contact us at [email protected].

2. Data We Collect

We collect the following personal data:

• Account data: Name, email address, and hashed password when you register
• Technical data: IP address, session tokens, and browser/device information. IP address and user agent are also recorded with contact form submissions
• Server data: Game server configuration, resource usage, and logs generated while you use the service (trial or paid)
• Billing data: For paid plans, your billing address and the last four digits of your card. We do not store full card numbers. Payment processing is handled by Stripe
• Contact data: Any information you provide when contacting support

3. Lawful Basis for Processing

We process your data under the following lawful bases:

• Contract performance (Art 6(1)(b)): Processing your account, server, and billing data is necessary to provide the hosting service you have requested
• Legitimate interest (Art 6(1)(f)): We process IP addresses, session tokens, and activity logs for security monitoring, fraud prevention, and abuse detection
• Consent (Art 6(1)(a)): We only set non-essential cookies (such as analytics) with your explicit consent. You can withdraw consent at any time

4. How We Use Your Data

We use collected data to:

• Provide and operate the hosting services you have requested
• Authenticate your identity and manage sessions
• Process payments and manage your subscription
• Respond to support requests
• Send service notifications (downtime alerts, policy changes, billing receipts)
• Monitor for abuse and enforce our Terms of Service

We do not use your data for advertising. We do not sell your data to third parties.

5. Cookies

By default, we use only essential cookies required for the service to function (such as authentication session cookies). Analytics or marketing cookies are only set with your explicit consent. You can manage your cookie preferences at any time through your browser settings.

6. Data Retention

• Account data: Retained for as long as your account is active. If you delete your account, your data is erased within 30 days
• Trial server data: Deleted 7 days after your trial expires
• Paid server data: Deleted within 30 days of subscription cancellation or termination
• Session tokens: Expire according to the configured session lifetime
• Billing records: Retained for 7 years to comply with UK tax obligations
• Security and activity logs: Retained for up to 12 months

7. Third-Party Processors

We share personal data with the following third-party processors, solely for the purposes described:

• Hetzner Online GmbH - hosting infrastructure; servers located in Germany (EU)
• Stripe, Inc. - payment processing; your billing details are transmitted to Stripe and governed by their privacy policy. We do not store your card number
• Resend - transactional email delivery (receipts, notifications, password resets); your email address is shared with Resend to deliver these messages
• Google - OAuth authentication, if you choose to sign in with Google

We do not share your data with any other third parties except as required by law.

8. International Transfers

Our servers are hosted by Hetzner in Germany. The UK government has recognised EEA countries, including Germany, as providing an adequate level of data protection for UK GDPR purposes, so no additional safeguards are required for this transfer.

Stripe and Resend are US-based companies. Transfers to the US are made under Standard Contractual Clauses (SCCs) approved for use under UK GDPR, as provided in our data processing agreements with each provider.

9. Your Rights

Under UK GDPR, you have the following rights:

• Right of access (Art 15): Request a copy of the personal data we hold about you
• Right to rectification (Art 16): Request correction of inaccurate or incomplete data
• Right to erasure (Art 17): Request deletion of your account and associated data. You can delete your account via Account settings, or contact us. Note that billing records required for tax purposes cannot be erased earlier than the retention period in section 6
• Right to restrict processing (Art 18): Request that we limit how we use your data in certain circumstances
• Right to data portability (Art 20): Request an export of your personal data in a machine-readable format
• Right to object (Art 21): Object to processing based on legitimate interest
• Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at [email protected]. We will respond within one month.

10. Right to Complain

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. Contact the ICO at ico.org.uk or by phone on 0303 123 1113.

11. Children's Data

Our service is not directed at children under 16 years of age. We do not knowingly collect personal data from anyone under 16. If you believe we have collected data from a child under 16, please contact us and we will delete it promptly.

12. Security

We use industry-standard practices including encryption in transit (TLS), bcrypt password hashing, access controls, and regular security reviews. If you believe your account has been compromised, contact us immediately at [email protected].

13. Data Breach Notification

In the event of a personal data breach, we will notify the ICO within 72 hours of becoming aware of it where feasible. Where the breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay.

14. Changes to This Policy

We may update this policy. Changes will be posted here with an updated date. Material changes will be communicated by email at least 14 days before they take effect.

15. Contact

For privacy queries or to exercise your data rights, contact us at [email protected].