Skip to main content
Hostwares

Privacy Policy

Last updated: September 2026

1. Introduction

This Privacy Policy explains how Hostwares LLC (“Hostwares,” “we,” “us,” or “our”), a limited liability company organized in the State of Wyoming, USA, collects, uses, shares, and protects your personal information when you use our platform at hostwares.com.

By using our Service, you consent to the data practices described in this policy.

2. Data Controller Information

The data controller responsible for your personal data is:

3. Data We Collect

Account Data: Email address, full name, and password (stored as a bcrypt hash - we never store plain-text passwords).

Payment Data: Payment transactions are processed by PayPal and Stripe. We do not store credit card numbers, CVVs, or full bank account details. We retain transaction IDs, amounts, and payment status for invoicing purposes.

KYC Verification Data: We collect government-issued ID documents (passport, national ID, or driver's license) and selfie photos for identity verification when required. This data includes document images, full legal name, date of birth, address, and country of residence.

Usage Data: Pages visited, features used, deployment metadata (site names, domains, resource usage, status), and interaction timestamps.

AI Conversation Data: Messages exchanged with our AI assistant are stored for 30 days to maintain conversation context and improve service delivery.

Server Logs: IP addresses, browser user agent, request URLs, and timestamps. Retained for 7 days.

Cookies & similar technologies: We use strictly-necessary cookies (session, security, and your cookie choice). On our public marketing pages, and only if you consent via the cookie banner, we also use optional analytics & advertising technologies (Meta Pixel, X Pixel, Trustpilot, and a first-party visit beacon). See our Cookie Policy.

4. Legal Basis for Processing

We process your data under the following legal bases (per GDPR Article 6):

  • Contract Performance: Processing necessary to provide the Service you signed up for (account management, hosting, billing)
  • Legitimate Interest: Security monitoring, fraud prevention, service improvement, and analytics
  • Consent: Marketing communications, AI assistant usage, and optional data sharing
  • Legal Obligation: Tax records, fraud prevention, and compliance with law enforcement requests

5. How We Use Data

  • Provide, operate, and maintain the Service
  • Process payments and manage billing
  • Improve the platform and develop new features
  • Ensure security and prevent abuse
  • Provide customer support
  • Send transactional notifications (invoices, security alerts, service updates)
  • Comply with legal obligations

6. Data Sharing

We share data only with the following categories of service providers, solely as needed to operate the Service:

  • Payment Processors (PayPal, Stripe): Email, name, and transaction data for payment processing
  • Infrastructure Provider (Hetzner): Server hosting in EU/Germany - deployment data for provisioning
  • AI Provider (Anthropic): Conversation messages for AI assistant functionality - no personally identifiable information (PII) is sent; conversations are anonymized
  • Domain Registrar (Namecheap): Contact information required for domain registration per ICANN rules

We do NOT sell, rent, or trade your personal data to third parties for marketing or any other purpose.

7. Data Security

  • All data in transit is encrypted via TLS 1.2+
  • Data at rest is encrypted on our servers
  • User credentials (database passwords, API keys) are encrypted with AES-256
  • User-deployed application data is isolated per account
  • KYC documents are stored on our secure servers and accessible only to authorized administrators
  • Access to production systems is restricted and audited
  • Regular security assessments and vulnerability monitoring

8. Data Retention

  • Account data: Retained while account is active + 30 days after deletion
  • KYC documents: Duration of account + 1 year after closure
  • AI chat history: 30 days
  • Server logs: 7 days
  • Invoices and billing records: 7 years (required by tax law)
  • Support tickets: Duration of account + 30 days

After the retention period, data is permanently deleted or anonymized.

9. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

  • Access: Request a copy of your personal data
  • Correction: Request correction of inaccurate data
  • Deletion: Request deletion of your data (subject to legal retention requirements)
  • Portability: Receive your data in a structured, machine-readable format
  • Opt-Out: Opt out of marketing communications at any time
  • Withdraw Consent: Withdraw consent for processing based on consent
  • Restriction: Request restriction of processing in certain circumstances
  • Objection: Object to processing based on legitimate interest
  • Complain to a supervisory authority: If you are in the EU/EEA or UK, you have the right to lodge a complaint with your local data protection authority (for example, your national DPA, or the UK ICO) if you believe our processing of your personal data infringes applicable law.

To exercise these rights, contact [email protected]. We will respond within 30 days. Exercising your rights is free and will not result in any discriminatory treatment.

10. International Transfers

Our primary servers are located in the European Union (Germany) via Hetzner. Some services (payment processing, AI features) may involve data transfer to the United States.

For EU/EEA residents: transfers to the US are conducted under Standard Contractual Clauses (SCCs) or other approved transfer mechanisms to ensure adequate data protection.

11. Children's Privacy

Hostwares is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we discover that a minor has created an account, we will promptly delete it and all associated data.

12. Cookies & Tracking

We use strictly-necessary cookies required for the Service to function:

  • Session cookie: Maintains your authenticated session (expires on logout or after inactivity)
  • CSRF token: Prevents cross-site request forgery attacks
  • Consent cookie (hw_cookie_consent): Remembers your cookie choice

On our public marketing pages we also use optional analytics & advertising technologies — the Meta (Facebook) Pixel, the X (Twitter) Pixel, the Trustpilot widget, and a first-party visit beacon — which load only if you select “Accept all” in our cookie banner. You can withdraw consent at any time. Full details, providers, and how to opt out are in our Cookie Policy.

13. California Privacy (CCPA/CPRA)

If you are a California resident, you have the following rights under the CCPA as amended by the CPRA:

  • Right to Know / Access: Request the categories and specific pieces of personal information we collect, use, and disclose
  • Right to Delete: Request deletion of your personal information
  • Right to Correct: Request correction of inaccurate personal information
  • Right to Opt-Out of Sale/Sharing: Opt out of the “sharing” of personal information for cross-context behavioral advertising (see “Your Privacy Choices” below)
  • Right to Limit Use of Sensitive Personal Information
  • Non-Discrimination: We will not discriminate against you for exercising these rights

Categories of personal information collected: Identifiers (name, email), commercial information (transaction history), internet/network activity (usage data), and inferences drawn from the above.

“Sale” and “Sharing”: We do not sell your personal information for money. However, our use of the Meta and X advertising pixels (only when you consent) may qualify as “sharing” for cross-context behavioral advertising under the CPRA. You can opt out at any time (see below).

To submit a request, email [email protected] with the subject line “California Privacy Request” (an authorized agent may submit on your behalf).

Your Privacy Choices

To opt out of advertising “sharing” and analytics: open the cookie banner and choose “Reject non-essential”, or if you previously accepted, clear the hw_cookie_consent cookie / site data and reload, then choose “Reject non-essential.” This stops the Meta Pixel, X Pixel, Trustpilot, and first-party analytics from loading. We also honor the Global Privacy Control (GPC) signal where required. Because the pixels only load with prior opt-in consent, not consenting already keeps them off.

14. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you via email at least 14 days before the changes take effect. Non-material clarifications may be made without notice.

The “Last updated” date at the top reflects the most recent revision.

15. Contact

For privacy-related questions or to exercise your data rights:

Hostwares LLC · State of Wyoming, USA