Privacy Policy
Last updated 15 October 2026
This Privacy Policy explains how serverserv collects and uses personal data about visitors to serverserv.com, our customers and their contacts, and people who contact us. It covers this website, our client area at portal.serverserv.com and our support channels. It is written to meet the EU and UK General Data Protection Regulation (GDPR) and US state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA). It does not cover the data our customers store on their own servers, websites and mailboxes, which is explained in section 3.
1. Who is responsible for your data
The controller of your personal data is serverserv (trading as serverserv), Toronto, Ontario, Canada, Canada. For privacy questions or requests, email [email protected].
- Our representative in the European Union: Not appointed.
- Our representative in the United Kingdom: Not appointed.
2. What we collect
- Account and contact details: name, email, phone, postal address, company name and tax ID.
- Billing and payment data: invoices, payment history and the payment method you used. Payments are processed by Stripe (cards, Apple Pay and Google Pay) and PayPal. We do not see or store full card numbers; we may receive the card type, last four digits and expiry date, or a payment token.
- Order and service data: the services you buy, their settings, IP addresses assigned to you, and usage figures such as bandwidth.
- Domain registrant data: the contact details you give for a domain, which must be passed to the registrar and registry (see section 7).
- Support data: tickets, emails and live chat messages, and anything you share in them.
- Technical data: IP address, browser, device type, pages requested, login times and security logs from our website, client area and servers.
- Analytics data: only if you press Accept in the cookie prompt, Google Analytics records how this website is used. See the Cookie Policy.
Most of this data comes from you. Some comes from payment providers (for example, whether a payment succeeded), from fraud screening, and from people who report abuse involving a service you run.
3. Data you store on our services
Websites, databases, files, email and applications you run on our hosting, VPS, Windows RDP, OpenClaw, n8n and email services can contain personal data about other people. For that data, you are the controller and we act only as your processor. We process it only to provide the service and as you instruct, under our Data Processing Addendum. If you are an end user of one of our customers, please contact that customer about your data.
4. Why we use your data and our legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Create your account, set up and run your services, register domains, send service and billing emails | Performance of our contract with you |
| Take payments, keep invoices and accounting records, meet tax law | Contract and legal obligation |
| Answer support requests and live chat | Contract, or our legitimate interest in helping visitors |
| Prevent fraud and abuse, secure our network, keep security logs | Our legitimate interests in protecting our business, clients and the internet |
| Handle abuse, copyright and legal requests | Legal obligation and our legitimate interests |
| Website analytics | Your consent, which you can withdraw at any time |
| News and offers by email | Your consent, or where the law allows, our legitimate interest in telling existing customers about similar services. Every message has an unsubscribe link. |
| Establish or defend legal claims | Our legitimate interests |
Where we rely on legitimate interests, we have weighed them against your rights. You can object (see section 10). If you do not give us the data needed for a contract, we cannot provide the service.
5. Fraud checks and automated decisions
We check new orders for signs of fraud, for example by comparing the country of your IP address with your billing address. Fraud screening service: None. An order that is flagged is reviewed by a person before it is cancelled. We do not make decisions with legal or similarly significant effects about you by automated means alone.
6. Who we share data with
We do not sell your personal data and we do not share it for targeted advertising. We share it only with:
- Service providers who process it for us: payment providers, data centres, email delivery, live chat and analytics. They are listed on our sub-processors page.
- Domain registrars and registries, when you register, renew or transfer a domain.
- Authorities, courts and rights holders, when the law requires it or to protect rights and safety, as explained in our Law Enforcement Guidelines.
- Professional advisers such as accountants, auditors and lawyers, under confidentiality.
- A buyer of our business, if serverserv is sold or merged. We will tell you before your data is transferred.
7. Domain registration data
To register a domain we must send the registrant, administrative and technical contact details to our registrar, NameSilo, and to the registry that runs the extension. ICANN rules may require the registrar to give this data to a data escrow agent. Under the ICANN Registration Data Policy, personal contact details are usually hidden in public lookups (RDAP, which replaced WHOIS), but the domain name, registrar and dates are public. Registrars may disclose hidden data to people with a lawful reason, such as law enforcement or rights holders. Some country-code extensions publish more data under their own rules.
8. International transfers
We are based in Canada. Our servers and backups are located in: North America. Some providers, including payment and analytics providers, process data in other countries, including the United States. When personal data from the EU, EEA, UK or Switzerland is transferred to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the provider's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions. You can ask us for a copy of these safeguards.
9. How long we keep data
| Data | How long |
|---|---|
| Account and contact details | While your account is open, then 2 years after it closes |
| Invoices and payment records | 7 years, or longer if tax law requires |
| Support tickets and chat messages | While your account is open, then 2 years after it closes |
| Security and access logs | 90 days, longer if needed to investigate an incident |
| Data on a terminated service | Deleted when the service is terminated: for unpaid services, 30 days after the due date on VPS and server plans and 90 days on web hosting |
| Analytics data | As set in Google Analytics, see the Cookie Policy |
| Marketing consent and unsubscribe records | Until you withdraw consent, then as long as needed to respect your choice |
10. Your rights
Depending on where you live, you have the right to:
- get a copy of your personal data (access) and receive it in a portable format;
- correct data that is wrong or incomplete;
- have your data deleted, unless we must keep it, for example for tax law;
- restrict how we use your data, or object to uses based on legitimate interests, including direct marketing;
- withdraw consent at any time, without affecting what we did before;
- complain to a data protection authority, such as the authority where you live or work. In the UK this is the Information Commissioner's Office.
You can see and update most of your details in the client area. For anything else, email [email protected] or open a ticket. We may need to verify your identity. We answer within one month, or tell you within that month if we need more time as the law allows.
11. US state privacy rights
If you live in California or another US state with a consumer privacy law, this section applies to you as well.
- Categories we collect: identifiers (name, email, IP address), customer records (address, phone, billing data), commercial information (services bought), internet activity (website and log data), approximate location from your IP address, and the content of your support messages. The sources and purposes are in sections 2 and 4.
- Disclosures: we disclose these categories to the service providers and registrars in section 6 for business purposes only.
- No sale or sharing: we do not sell personal information or share it for cross-context behavioural advertising, and we have not done so in the last 12 months. We do not knowingly sell or share data of anyone under 16.
- Sensitive information: we do not use sensitive personal information to infer characteristics about you.
- Your rights: to know what we collect and disclose, to access, delete and correct it, to opt out of sale or sharing, and to limit the use of sensitive information. We will not treat you differently for using these rights.
- How to ask: email [email protected]. We will verify your request by matching it with your account details. An authorised agent can ask for you with your signed permission.
- Global Privacy Control: because we do not sell or share personal information, there is nothing to opt out of; we treat a GPC signal as a valid opt-out request for your browser.
12. Security
We use encrypted connections, access controls, limited staff access and regular updates to protect personal data. You can turn on two-factor authentication for your client area account. No system is perfectly secure; if a breach affects your data and the law requires it, we will tell you and the relevant authority.
13. Children
Our services are not directed at children. You must be 18 or older, or have a parent's or guardian's consent, to order. We do not knowingly collect personal data from children under 16. If you think a child has given us data, email [email protected] and we will delete it.
14. Cookies
This website stores your theme, currency and cookie choice in your browser. Analytics cookies are set only after you press Accept. Live chat and the client area use their own cookies. Details and how to change your choice are in the Cookie Policy.
15. Changes to this policy
We may update this policy. The current version is always on this page with its date. We will tell customers about important changes by email or in the client area.
16. Contact
For privacy questions or requests, email [email protected] or write to serverserv, Toronto, Ontario, Canada.
Questions about this policy? Contact us or open a ticket in the client area.