Privacy policy

The controller for personal data described in this policy is the administrator of the nowhosted.com service. Contact [email protected] with privacy questions or requests. This policy covers visitors to nowhosted.com, people who run a hosting audit, account holders, and people who contact support.

When a customer hosts personal data about other people in a site or application, the customer determines the purposes of that processing. We process that hosted data on the customer's instructions to provide the service, subject to the applicable data processing agreement. Contact the operator of that site for questions about its own collection and use of your data. We assist the customer with requests concerning hosted data as required by the agreement and applicable law.

We collect data you provide when you create an account, request an audit, subscribe, or contact us. We also receive technical information when your browser communicates with the service and payment status information from our payment processor.

• Account email used for registration, confirmation, sign-in, account notices, and support.
• Password hashes used to verify sign-in credentials. Passwords are stored as hashes rather than readable account records.
• Confirmation codes and related verification records used to confirm an email address and protect account access.
• Audit URLs you submit and measurements from the public site, including timing, TLS, caching, software detection, and security header findings. A submitted URL or its contents can contain personal data.
• Billing information used for the subscription, including billing contact details, subscription records, and payment status. Our payment processor handles payment card details and payment transactions.
• Technical logs, including network addresses, browser or device information, request details, and security events needed to operate and protect the service.
• Cookies necessary for sessions and security, including maintaining sign-in state and protecting requests.
• Information included in support messages and privacy requests, such as the account email, site URL, and description you send.

Provide only information needed for the task. Avoid putting passwords, confirmation codes, payment card details, or unrelated personal information in support messages or audit URLs.

Where the GDPR or comparable law requires a legal basis, we use the bases below for the corresponding purposes. We limit processing to what the purpose requires.

• Contract performance and steps requested before a contract, to create and confirm accounts, authenticate access, deliver requested audits, operate hosting subscriptions, provide support, and manage cancellation or export requests.
• Contract performance, to administer billing through our payment processor and communicate subscription and payment information.
• Legal obligations, to retain required transaction records, respond to binding legal requests, and meet applicable accounting, privacy, and security duties.
• Legitimate interests, to protect the service and accounts, prevent abuse and fraud, investigate incidents, diagnose failures, and establish or defend legal claims. We assess these interests against the effect on individuals and apply safeguards such as access restrictions and limited retention.
• Consent, where it is required for a specific optional use. We explain that use when asking for consent, and you can withdraw it without affecting processing that was lawful before withdrawal.

Necessary session and security cookies support service delivery and protection. We do not use those cookies for advertising. If we introduce a purpose or cookie that requires consent, we obtain it before that processing begins. Optional processing does not become a condition of receiving an unrelated service.

Read about the WordPress hosting platform for the service functions these purposes support and hosting security for the hosting controls relevant to your review.

We share personal data with service providers only as needed for their role and subject to appropriate data protection obligations. The provider categories are hosting and infrastructure providers, an email delivery provider, and our payment processor. They support service operation, account and support messages, or billing. Access is limited to the data required for those tasks.

We disclose data where a binding legal obligation requires it or where disclosure is lawfully necessary to protect rights, investigate abuse, or defend legal claims. We assess the scope of the request and disclose only what is necessary. We do not sell personal data or share it for cross-context behavioral advertising, and we do not use personal data for targeted advertising.

We retain personal data for the purpose that justifies it, then delete it or make it no longer identifiable unless a legal obligation or documented legal claim requires continued retention. Account data is kept while the account is active and as needed to complete closure, resolve account issues, or meet legal obligations. Confirmation codes remain usable only for their verification purpose and expire when that purpose ends; associated security records are retained only as needed to investigate abuse.

Audit URLs and measurements are kept as needed to provide the report and its account context. Technical logs are retained for operation, troubleshooting, and security investigation, with retention limited according to their purpose and risk. Support correspondence is retained as needed to resolve the request and maintain necessary records. Billing records are retained for the period required by applicable accounting and tax law or to resolve payment disputes.

Session and security cookies expire according to their session or protective function. Data in backups remains subject to the relevant backup cycle and restricted recovery use until it is overwritten or deleted. Hosting backup retention depends on the subscription described in the WordPress hosting plans. A specific legal retention requirement can prevent immediate deletion of an otherwise closed account record.

Server regions are North America, Europe, and Asia-Pacific, and customers choose a region per site. Region selection for a hosted site does not by itself guarantee that all account, support, or billing processing takes place in that region. Service providers can process data in other jurisdictions as needed for their role.

Where a transfer from the European Economic Area, the United Kingdom, or another protected jurisdiction requires safeguards, we use a lawful transfer mechanism appropriate to that transfer. This can include an applicable adequacy decision or approved contractual safeguards, together with an assessment and supplementary measures where required. Email [email protected] for information about the mechanism relevant to your data and how to obtain a copy of applicable safeguards, subject to necessary confidentiality protections.

Depending on your location and the applicable law, you can request confirmation of processing, access to your data, correction, deletion, restriction, or a portable copy. You can object to processing based on legitimate interests and withdraw consent for processing that relies on consent. These rights can be subject to legal exceptions, including required record retention and protection of other people's data.

US state residents can exercise applicable rights to know or access, correct, delete, and obtain a portable copy of their personal data. Applicable law can also provide rights to opt out of sale, sharing, targeted advertising, certain profiling, or certain uses of sensitive data. We do not sell or share personal data for cross-context behavioral advertising, use it for targeted advertising, or use it for profiling that produces legal or similarly significant decisions.

Email [email protected] to make a request. Identify the account or interaction involved and the right you wish to exercise. We verify identity in proportion to the request and can ask for information needed to locate the record or confirm your authority. An authorized agent can submit a request where applicable law permits it, with evidence of authority and any required identity verification. We respond within the time required by applicable law and explain any permitted extension, refusal, or limitation.

If we deny a request, you can appeal by replying to the decision or emailing the same contact and explaining why you seek review. We provide the outcome and information about further recourse required by applicable law. You can also complain to the competent data protection authority or state regulator. We do not discriminate against you for exercising privacy rights. Deleting data necessary for an account can prevent us from continuing that account's service.

You can use browser controls to remove or block cookies. Blocking necessary session or security cookies can prevent sign-in or other protected service functions. Keep your account email current and protect your password and confirmation codes. We use access controls and hosting safeguards appropriate to the service, but no method of storage or transmission removes all risk.

NowHosted is intended for business use and is not directed to children. We do not knowingly collect children's personal data for service accounts. If you believe a child has provided personal data, contact [email protected] so we can assess the information and delete it where required. Customers remain responsible for the legality of personal data collected through their own hosted sites.

We update this policy when the service or legal requirements change. The date above identifies the current version. Where a material change affects your rights or requires notice or consent, we provide the notice or seek consent required by applicable law before applying that change. Contact [email protected] for policy questions, privacy requests, or a DPA.