Launch sale20% off everything — celebrating the launch of GHosting!

Privacy Policy

Last updated: 10 August 2026

1. Who is responsible

The data controller is Bytewave OÜ (Estonia), the company operating GHosting. To exercise any of your rights or ask questions, see contact.

2. What we collect and why

  • Account data — your email address and a hashed password (never the password itself). Needed to run your account and reach you about your servers. Legal basis: performance of contract.
  • Orders and invoices — what you bought and when. Legal bases: performance of contract and our legal accounting obligations.
  • Payment data — handled entirely by Stripe. We receive confirmation of payment and the last digits of your card for reference; we never see or store full card numbers.
  • Support messages — the content of tickets you open, so we can help you. Legal basis: performance of contract.
  • Server data — the game files, configuration and logs of your rented server, processed only to provide the hosting service.
  • Usage analytics — aggregate, cookieless page-view and trial-funnel counts derived from one-way-hashed request data. Campaign tags in a landing-page URL may be stored with an order so we can measure which GHosting links led to a purchase. We cannot identify or follow anonymous visitors across sites, and we do not use cross-site tracking. Legal basis: legitimate interest in understanding site usage.
  • Trial abuse prevention — a salted, one-way hash of the claimant network is retained for up to 30 days to enforce the rolling trial allowance. The raw network address is not stored. Legal basis: legitimate interest in keeping limited trial capacity available to genuine users.
  • Affiliate data — referral codes, accepted program terms, attributed purchases, commission records and payout history. This is needed to operate the program, prevent fraud and meet accounting obligations. Affiliates never receive a referred customer's identity or contact details.
  • Customer feedback: an optional star rating, comment, the server it concerns and the hosting credit granted for it. We use this to improve the service and respond to problems. With your separate permission, an anonymous version may be published on GHosting. Legal bases: legitimate interest for internal feedback and consent for public use.

3. Cookies and local storage

We use no third-party tracking or advertising cookies. When you log in, a session token is stored in your browser so you stay signed in. Campaign attribution is retained for the current tab. If you follow an affiliate link, the referral code and capture time may be stored in first-party browser storage for up to 30 days so the correct affiliate can be credited if you purchase. Dismissing a customer feedback prompt stores a first-party reminder time for up to 7 days. These values are not used to follow you across other websites.

4. Who we share data with

Only processors necessary to run the service: Stripe (payments), our transactional email provider (delivery of account and billing emails), and European infrastructure providers that physically host our servers. We never sell your data. Feedback is displayed publicly only when you give separate permission, and public reviews do not include your email address, server name or server address.

5. How long we keep it

  • Account data: for as long as your account exists. You may ask us to delete it at any time.
  • Invoices and order records: 7 years, as required by Estonian accounting law.
  • Server files: paid-plan files are deleted no earlier than 7 days after the term ends; free-trial files are deleted after a 3-day post-trial grace period.
  • Aggregate analytics: indefinitely — it contains no personal data.
  • Raw affiliate click hashes: up to 90 days. Financial commission and payout records are retained with the associated accounting records.
  • Customer feedback: while your account exists or until you ask us to delete it. Withdrawing publication permission removes it from public display without reversing hosting credit already granted.

6. Your rights

Under the GDPR you can request access to, correction of, deletion of, or a portable copy of your personal data, and you can object to processing based on legitimate interest. Write to us via the contact page and we will respond within 30 days. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority.

7. Changes

If we change this policy in a way that affects you materially, we will email account holders before the change takes effect.