Privacy Policy

Template. Drafted to match how the platform actually handles data, with bracketed placeholders. Have counsel review and complete before launch. Last updated: 25 Aug 2026 · draft, not yet in effect.

1. Who we are

Paaji Hosting Ltd, [Registered Address], is the data controller for personal data processed to provide HostingPanel. Contact: [contact email].

2. What we collect

Account

Name, email, phone, company name, billing address, and tax identifiers (such as GSTIN) where you provide them for invoicing.

Billing

Orders, invoices, statements, payment receipts and credit history — the commercial record of your account.

Technical

Server and access logs (IP addresses, timestamps, requests), service metadata needed to operate and secure the platform, and audit records of sensitive actions (for example, credential reveals are logged with who and when).

Support

Tickets and messages you send us, so we can answer and keep context.

3. What we deliberately don’t hold

Card numbers never touch our systems — payments run through our processors (Stripe, PayPal, and a crypto processor), and saved payment methods are stored as processor tokens, encrypted at rest. We run no third-party advertising trackers, and we do not sell personal data. Ever.

4. Why we process it

To provide and bill the services (contract); to secure the platform, prevent abuse and keep audit trails (legitimate interest); to meet tax and accounting obligations (legal duty); and to send the newsletter if you opted in (consent — every issue includes an unsubscribe).

5. Cookies and local storage

One essential session cookie keeps you signed in. Local storage remembers interface preferences such as theme. There are no advertising or cross-site tracking cookies, so there is no cookie banner theatre.

6. Who we share with

Payment processors (to take payment), registrar and registry partners (to register and manage domains — see below), infrastructure providers hosting our regions, and authorities where the law genuinely requires it. Each processor handles data under its own agreement with us.

Domains and WHOIS

Registering a domain requires passing registrant contact data to the registrar and registry under ICANN policy. Where the TLD supports it, our WHOIS privacy service keeps your details out of the public record by default.

7. Retention

Billing records are kept as long as tax law requires ([7] years). Technical logs are kept [90] days unless needed for an open investigation. Everything else is deleted or anonymised within [30] days of account closure, except data on services you terminated earlier, which is deleted on the termination schedule stated per product.

8. Security

Passwords are hashed with a modern memory-hard algorithm; stored provider and server credentials are encrypted at rest with AES-256-GCM; transport is TLS throughout; two-factor authentication is available on every account; and access to sensitive operations is logged.

9. Your rights

You can access and correct account data in the panel, export your billing history, and close your account. For access, correction, export or deletion requests beyond that, open a support ticket — we answer within [30] days. You may also complain to your local data protection authority.

10. International transfers

Data may be processed in the regions we operate ([list]). Where a transfer needs a legal mechanism, we use recognised safeguards such as standard contractual clauses.

11. Children

The services are not directed at children under 16, and we do not knowingly collect their data.

12. Changes

Material changes to this policy are announced by email and in the panel at least [30] days before they take effect.