Privacy policy

This policy explains what CheapServ ("we", "us") collects about you, why, for how long, and what you can do about it. It is short because we collect very little: no name, no phone number, no identity document, no payment card. It applies to cheapserv.com, the dashboard, the API and the servers we provide.

1. In short

• An account is an e-mail address and a password. That is all we ask for.
• We record the IP address used at sign-up and at each login, and keep it for 90 days.
• Payments are in cryptocurrency. We keep top-up records and transaction IDs for accounting; we never see or store card or bank details.
• There are no advertising trackers and no analytics scripts on the site. The only cookie is your session cookie, plus an optional 30-day referral cookie if you arrive through an affiliate link.
• We do not sell, rent or share your data with anyone for their own purposes.
• You can export or delete your account data through a support ticket.

2. What we collect

Account

E-mail address and a password hash. We never store the password itself.

Security

IP address at sign-up and at each login, with the time. API keys are stored as hashes; the key itself is shown to you once.

Orders and billing

The servers you order (plan, location, hostname, image), top-ups, the cryptocurrency and network used, the transaction ID and amount received, and your prepaid balance.

Support

The tickets you open and the messages exchanged, including any files you attach.

Technical logs

Web and API request logs (IP address, URL, time, response code) and server-side error logs.

Affiliate program

If you join, your referral code and the sign-ups attributed to it. If you arrive through a referral link, a cookie holding the code for 30 days.

We do not collect your name, postal address, phone number, date of birth, identity documents or any payment card data. We do not read the contents of your servers.

3. Why we use it

1. To provide the service: creating and renewing servers, generating deposit addresses, crediting payments, sending renewal reminders 7 and 2 days before a renewal, and answering tickets.
2. To keep accounts safe: login IP addresses and request logs help us detect account takeover, brute-force attempts and API abuse, and let you check your last sign-in in the dashboard.
3. To handle abuse and legal obligations: matching an abuse report or a legal request to the account that was using an IP address at a given time.
4. To run the affiliate program: attributing sign-ups and computing commissions.

We do not use your data for advertising, profiling or automated decisions about you. E-mails from us are limited to deposit and balance notices, renewal reminders, security alerts, ticket replies and the announcements described in the Terms of service.

4. Cookies and third parties

• Session cookie. Set when you sign in, deleted when you sign out or close the browser. Required for the dashboard to work.
• Referral cookie. Set only if you open a link containing an affiliate code. It holds that code for 30 days so the referrer is credited if you sign up.
• Cloudflare. cheapserv.com is delivered through Cloudflare, which provides the CDN and DDoS protection for the website and processes request data on our behalf. On the sign-up and sign-in pages, Cloudflare Turnstile checks that the request comes from a human; it does this without a challenge in most cases and without tracking you across other sites.

There are no analytics, advertising or social-media scripts on the site, and no third-party fonts or embeds: everything is served from our own domain.

5. How long we keep data

6. Who we share data with

Nobody, for their own purposes. Cloudflare processes website traffic on our behalf as described above. We disclose account data to authorities only when we receive a request that is valid and binding in CheapServ's country of establishment, we limit the disclosure to what the request covers, and we tell you about it unless we are legally prevented from doing so. Because we hold no identity documents, what we can disclose is limited to the data listed in section 2.

7. How we protect it

• Passwords are stored as salted hashes using a modern algorithm; API keys are stored as hashes.
• All traffic to the website, the dashboard and the API is encrypted in transit.
• Sign-in attempts are rate-limited, and the sign-up and sign-in pages are protected against automated abuse.
• Access to production systems is restricted to the staff who operate them, over authenticated and logged connections.
• If we discover a breach affecting your data, we notify you by e-mail without undue delay and post a notice on /status.

8. Your rights

You can see and change your e-mail address and password in the dashboard at any time. Through a ticket you can ask us to:

• Export the data we hold about your account, delivered as a machine-readable file;
• Correct anything inaccurate;
• Delete your account. We delete the account and its servers within 30 days of the request. Top-up and balance records are kept for the period accounting rules require, with the e-mail address replaced by an anonymous identifier;
• Object to a use of your data you consider unjustified.

We answer within 30 days. Depending on where you live, you may also have the right to complain to a data protection authority.

9. Changes to this policy

We update this policy when our processing changes. The effective date at the top of the page is updated with every revision, and material changes are announced on /status and by e-mail at least 14 days before they apply. We will never widen what we collect without telling you first.

10. Contact

Privacy questions and requests under section 8: /support or [email protected].

Something missing or wrong on this page? Open a ticket and tell us.