Privacy Policy

This Privacy Policy explains how we process personal data when you visit insave.hosting, use the client area at my.insave.hosting, or use our services. It does not cover the data that you, as our customer, store on your hosting or servers; for that data see section 9.

1. Who is responsible

inSave Hosting OÜ, registry code 17479863, Kaupmehe tn 7-120, 10114 Tallinn, Estonia, e-mail info@insave.hosting, is the controller of the personal data described here.

If you pay in Ukrainian hryvnia (through WayForPay or by bank transfer to a Ukrainian bank account) or in cryptocurrency through CoinPayments, your contract for the services paid that way is with Fizychna osoba-pidpryiemets Horhul Ihor Serhiiovych (Ukraine, taxpayer number 3418309473) under the Public Offer. The sole proprietor is the controller of your contract, payment and accounting data under the Law of Ukraine “On Personal Data Protection”, and inSave Hosting OÜ processes that data on its behalf to run the client area and the services. Requests about this data can be sent to the same address, info@insave.hosting.

We have not appointed a data protection officer, as the law does not require one for our processing. Write to info@insave.hosting with any privacy question.

2. What data we process, why, and on what legal basis

Data	Purpose	Legal basis (GDPR)
Account data: name, company, e-mail, phone, address, VAT number, login details	Creating and managing your account, providing the services, contacting you about them	Contract (Art. 6(1)(b))
Sign-in data from Google, Facebook or GitHub, if you choose to sign in with them: name and e-mail address	Signing you in, matching the login to your account by e-mail address, pre-filling your details when you register	Contract (Art. 6(1)(b))
Billing data: invoices, payments, currency, payment method details returned by the payment provider (never full card numbers)	Billing, refunds, fraud prevention	Contract; legal obligation to keep accounting records (Art. 6(1)(c)); legitimate interest in preventing fraud (Art. 6(1)(f))
Verification data: identity or payment confirmation we request in case of fraud suspicion	Preventing fraud and abuse	Legitimate interest (Art. 6(1)(f))
Domain registrant data: names, addresses, e-mail and phone of the registrant and contacts	Registering and maintaining domain names with the registrar and registry	Contract; legal and registry obligations
Support data: tickets, chat messages, e-mails, call notes	Answering requests, improving support	Contract; legitimate interest
Technical data: IP addresses, server and access logs, login history, security events	Running and securing the platform, investigating incidents and abuse	Legitimate interest in security (Art. 6(1)(f))
Website analytics and marketing data (cookies, page views, clicks, scrolling and mouse movement on our pages, campaign data)	Understanding how the site is used, measuring advertising	In the European Economic Area, the UK and Switzerland: consent (Art. 6(1)(a)), which you can withdraw at any time. Elsewhere: legitimate interest in understanding how the site is used and measuring our advertising (Art. 6(1)(f)); you can object at any time with “Cookie settings”. See the Cookie Policy
Abuse reports: notifier’s name, e-mail and the content of the notice	Handling notices under the Abuse procedure	Legal obligation under the Digital Services Act; legitimate interest
Service e-mails and, if you opt in, news and offers	Informing you about your services; marketing with your consent	Contract; consent for marketing

You must provide account, billing and registrant data to use the services; without it we cannot conclude or perform the contract. We do not use automated decision-making that produces legal effects for you.

Signing in with Google, Facebook or GitHub

If you choose to sign in to the client area at my.insave.hosting with Google, Facebook or GitHub, we receive your account identifier, name and e-mail address from that provider. We do not request access to your e-mail messages, files, repositories, contacts or any other data in your Google, Facebook or GitHub account.

We use this data only to sign you in, to match the login to your inSave Hosting account by e-mail address and to pre-fill your details when you register. We do not store your Google, Facebook or GitHub account identifier; your name and e-mail address are kept as part of your account data, as described in section 6. We do not sell this data, do not use it for advertising and share it only with the infrastructure and service providers that run the client area, as described in section 3.

inSave Hosting’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. Who receives your data

We share personal data only as far as needed for the purposes above, with:

Data centre and infrastructure providers in the European Union and the United States that host our servers and backups.
Payment providers: Stripe, Wise, Revolut and CoinGate for payments to inSave Hosting OÜ; WayForPay, Ukrainian banks and CoinPayments for payments to the sole proprietor named in section 1.
Domain registrar and registries: Openprovider (Hosting Concepts B.V., the Netherlands) and the registry of each domain extension, which may publish registration data where their rules require it.
Service providers: Google (business e-mail and workspace, Google sign-in, Google Analytics and advertising measurement according to your cookie choices), Meta (advertising measurement on Facebook and Instagram according to your cookie choices), Microsoft (Clarity analytics: clicks, scrolling and mouse movement on our website and client area according to your cookie choices), OpenAI (measurement of our ads in ChatGPT according to your cookie choices: pages viewed, sign-ups, orders and sales requests with the order value, and the ad click and browser references, plus your e-mail address, phone number and name (hashed in your browser before sending), country, city, region and postal code when they appear on the page; and the text of a support chat conversation when our team uses AI assistance to suggest or improve a reply or to summarise the conversation), Cloudflare (DNS, content delivery and protection of our websites), Atlassian (internal documentation and task tracking), Slack (internal team messaging, including copies of support chat conversations), Objectis (Cookie-Script consent management), and our accounting and legal advisers.
Our engineers, all bound by confidentiality, who access systems only as needed to provide and support the services.
Authorities and courts, when the law requires it, and the person who filed an abuse notice when the Abuse procedure provides for it.

Our support chat runs on our own servers. If you write to us in Telegram, WhatsApp, Facebook Messenger or Instagram, your messages also pass through that platform and are processed under its own privacy policy.

4. Transfers outside the European Economic Area

Some recipients process data outside the EEA:

United States: Google, Meta, Microsoft, OpenAI, Slack, Cloudflare, Stripe and our US data centres if you order a service in a US region. Transfers rely on the EU–US Data Privacy Framework where the recipient is certified, or on the European Commission’s Standard Contractual Clauses.
Ukraine: the sole proprietor named in section 1 and members of our team who provide support. Transfers rely on Standard Contractual Clauses and confidentiality obligations.
Other countries: domain registries located outside the EEA for the extension you register, as needed to perform your contract (Art. 49(1)(b) GDPR).

You can ask us for a copy of the safeguards that apply.

5. Where your service data is stored

Hosting plans run in the region you choose at checkout: EU-Central (Germany), US-East or US-West. Backups are stored in a different country from the primary data.

6. How long we keep data

Account and contract data: for the duration of the contract and up to 3 years after it ends, the general limitation period for claims.
Accounting records (invoices, payments): 7 years after the end of the financial year, as required by the Estonian Accounting Act.
Support tickets and correspondence: up to 3 years after the ticket is closed.
Server, access and security logs, including login history: at least 90 days and no longer than 12 months, unless needed longer to investigate a specific incident.
Backups of active services: kept for the period stated in the plan description, then deleted on rotation.
Data in services and their backups: deleted after the service is terminated, on the normal backup rotation; backups made under managed services are kept for 30 days after the service ends.
Analytics and marketing cookies: see the Cookie Policy.
Abuse notices and our decisions: up to 3 years.

7. Your rights

You have the right to:

access your personal data and get a copy;
have inaccurate data corrected;
have data erased when there is no longer a reason to keep it;
restrict processing in certain cases;
receive the data you gave us in a machine-readable format (portability);
object to processing based on legitimate interest, and to direct marketing at any time;
withdraw consent at any time, without affecting processing before the withdrawal.

Send requests to info@insave.hosting. We may ask you to confirm your identity first. We answer within one month; for complex requests this can be extended by two more months, and we will tell you if so.

You have the right to lodge a complaint with a supervisory authority, in particular the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the authority of your country of residence.

You can stop signing in with Google, Facebook or GitHub at any time by removing inSave Hosting from the apps connected to your Google, Facebook or GitHub account. You can still sign in with your e-mail address and password; if you have not set a password, use the password reset on the login page. To have all your personal data deleted, write to info@insave.hosting from the e-mail address on your account. We delete it within one month, except data we must keep by law (see section 6).

8. Security

We protect data with access control on a need-to-know basis, encryption in transit, isolation between customer services, monitoring, regular updates and backups stored in a separate location. If a personal data breach puts your rights at risk, we will inform you and the supervisory authority as the law requires.

9. Data you store on our services

For the data you upload to your hosting, servers or mailboxes, you are the controller and we act as your processor: we process it only to provide the services and on your instructions, and we do not access it except to provide the service, fix a problem you report, or comply with the law. Business customers who need a data processing agreement under Article 28 GDPR can request one at info@insave.hosting.

10. Children

Our services are not intended for people under 18, and we do not knowingly collect their data.

11. Changes

We may update this Privacy Policy. We will announce material changes by e-mail or in the client area before they apply. The date at the top shows when it was last updated.