Privacy Policy — SKYHOSTVPS

This policy explains how SKYHOSTVPS ("we", "us") collects, uses, shares and protects personal data when you use SKYHOSTVPS and our services, and the rights you have over it. For the personal data it describes, we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act").

In short: we collect what we need to run your account and services, bill you, keep our network safe and meet our legal duties. We do not sell your data, and this website uses no advertising or analytics trackers. Your servers are bought from our infrastructure partners in our own name, so your personal details are not handed to the data centres that run them.

Who this policy covers

It covers visitors to this website, customers with an account, and people who sign in to a user panel that one of our sellers has set up.

If you use a user panel, the seller who gave you access decides what it is for and is responsible to you for it. We process your sign-in details and the actions you take in the panel in order to run it, and we show that activity to the seller.

It does not cover the data you store or process on your own servers. For that data you are responsible, including under the DPDP Act if it identifies other people; we only host it.

What we collect

Kind of data	What it includes
Account details	Your name, email address, phone number, postal address, and optionally a company name and tax ID. Your password is stored only as a one-way hash, which we cannot read.
Verification	One-time codes we email you, stored only as hashes and valid for a short time. Documents or details we ask for to verify your identity, address or intended use, where the law requires it.
Payments	Amounts, the payment method, gateway order and payment references, and the outcome. For a UPI or bank transfer you make to our account yourself, the UTR number and the screenshot you upload. Card, UPI and net-banking credentials are entered with the payment gateway; we never receive them.
Orders and services	What you buy and how it is configured (zone, operating system, size, term), the IP addresses allotted to you, server names, the period of each service, renewals, coupon codes used, your wallet history and your invoices.
Support	Your tickets, our replies, and any files you attach.
Technical and security	The IP address and time of your sign-ins, the IP addresses and browser details in our server logs, and a record of security-relevant actions such as sign-ins, password changes, orders and payments.
Network data	Traffic volumes and flow records (such as source and destination addresses and ports) that our network and partners keep to measure bandwidth and to detect and stop attacks. We do not inspect the content of your traffic or your servers, except as our Terms & Conditions allow.

How we use it

to create your account, confirm your email address and keep the account secure;
to take payments, credit your wallet, issue invoices and keep accounting and tax records;
to provision, deliver, renew and support your services;
to send you service messages: sign-in codes, payment and order notices, replies to your tickets, and security alerts;
to prevent, detect and investigate fraud, abuse and security incidents, for example by limiting repeated sign-in attempts, checking payment proofs, handling abuse reports and enforcing the limits of an offer;
to meet our legal obligations, including CERT-In directions, tax laws and lawful orders of courts and authorities;
to understand and improve our services, using aggregated information that does not identify you.

We process your data with the consent you give when you create an account and, where the DPDP Act allows it without consent, for legitimate uses such as data you provide voluntarily for a purpose, compliance with the law, and emergencies. Some data is necessary: without it we cannot provide the service. We do not sell personal data, do not use it for advertising, and do not send you marketing messages unless you have agreed to them; you can stop them at any time.

Payment processors and banks (currently Razorpay and Paytm), to take your payment and confirm that it is genuine. They handle your payment details under their own privacy policies.
Infrastructure partners: the data-centre and network operators whose infrastructure runs your server. We buy capacity from them under our own account, so they receive the technical details of a server (its size, image and IP address) rather than your personal details, unless an abuse investigation, a security incident or the law requires us to identify you to them.
Providers who help us run the business, such as the email service that delivers sign-in codes and receipts, and the hosting of this website; and the messaging service our team uses for order alerts, which receives your name, email address and the details of the order. They may use the data only to provide their service to us.
Sellers: if you use a user panel, the seller who created it can see your activity in it.
Authorities: government agencies, CERT-In, law enforcement agencies, courts and tax authorities, when the law requires it, or where it is needed to protect someone's safety or our legal rights.
Professional advisers, such as accountants, auditors and lawyers, who are bound to keep it confidential.
A new owner, if our business or the services are sold or merged, who must then treat your data as this policy describes.

Where it is processed

We store and process personal data in India where we can. Some of our service providers, such as email and messaging services, may process data outside India. We transfer personal data only to countries that the Central Government has not restricted under the DPDP Act, and we expect every provider to protect it.

How long we keep it

Account and service records (your validated name, address, contact numbers and email address, the IP addresses allotted to you, the periods of hire, and the details of your registration): while your account is open and, as the CERT-In directions require, for five years after it closes.
Payment, invoice and tax records: for as long as tax and accounting laws require, currently up to eight years.
Logs and security records: for at least 180 days, as CERT-In requires, and no longer than we need them.
Support tickets: while your account is open, and afterwards for as long as a dispute might need them.
The contents of your servers: deleted when the server is terminated or expires. We cannot recover them afterwards.

When a period ends, we delete the data or anonymise it so that it no longer identifies you.

How we protect it

Connections to this website and the console are encrypted.
Passwords are stored only as one-way hashes, and sign-in is temporarily blocked after repeated wrong passwords.
Passwords for services we deliver to you are stored encrypted, and are never sent by email.
The session cookie cannot be read by scripts, forms are protected against cross-site request forgery, and sessions end after 2 hours without activity.
Only staff who need personal data for their work can reach it.

No system is perfectly secure. If a breach of personal data affects you, we will tell you, and notify the Data Protection Board of India and CERT-In, as the law requires.

Your rights

Under the DPDP Act, you may:

ask for a summary of the personal data we hold about you, how we process it, and who we have shared it with;
have data that is inaccurate or incomplete corrected, completed or updated;
have data erased once it is no longer needed for the purpose it was collected for, except what the law requires us to keep (see How long we keep it);
withdraw your consent, although we cannot then keep providing services that depend on it;
nominate someone to exercise these rights for you if you die or become unable to;
have a complaint dealt with by our grievance officer and, if you are not satisfied with the outcome, complain to the Data Protection Board of India.

To use any of these rights, write to our grievance officer or open a support ticket; the details are on our Contact page. We may need to confirm your identity first. We acknowledge every request within 24 hours and answer it within 15 days.

Cookies and local storage

One essential cookie. ajvps_session keeps you signed in and protects forms against cross-site request forgery. It cannot be read by scripts, is deleted when you close your browser, and the session behind it ends when you sign out or after 2 hours without activity.
Local storage. Your browser remembers your light or dark theme, whether the side menu is collapsed, and how you like your server list laid out. These stay on your device.
Fonts and icons are loaded from Google Fonts and cdnjs, whose servers receive your IP address and browser details as part of the request. When you pay through a gateway, its checkout may set cookies of its own.

We use no advertising or analytics cookies. You can block or delete cookies in your browser's settings, but you will not be able to sign in without the session cookie.

Children

Our services are for people aged 18 and over. We do not knowingly collect personal data from anyone under 18, and if we learn that we have, we delete it.

Changes to this policy

When we change this policy, we update the date at the top of this page. If a change significantly affects how we use your data, we will tell you by email or in the console before it takes effect.

Contact

Questions about this policy, or about your data, go to our grievance officer at support@skyhostvps.com. Their full details, and our other contact details, are on our Contact page.