Privacy Policy

Draft. This text was prepared as a starting point and has not been reviewed by a lawyer. Croco IT will replace it with the reviewed version; the version number on this page changes when that happens.

What we collect

• Account details: your name, email address, mobile number (optional), language, and the password you choose (stored hashed).
• Billing records: orders, invoices, payment method and the transaction reference you give us. Card numbers are never stored by us; they go to the payment provider (Paymob or Stripe) directly.
• Service records: the servers you own, their configuration as we set it (hostname, operating system, resources, addresses), their power state and resource usage, and an activity log of actions on your account (sign-ins, reboots, reinstalls, staff actions) with the IP address they came from.
• Support: the tickets you open and what is written in them.
• Technical: the IP address and browser of requests to this site, in server logs kept for a limited time.

What we do not collect

We do not read the contents of your server's disk, its memory or its network traffic. We see what Proxmox reports about the guest (state, usage, addresses). We open a console to your server only when you ask us to in a ticket.

Why we use it

To run the service you ordered, bill you, answer your tickets, send the emails the service needs (invoices, receipts, renewal reminders, server status, security notices), protect the platform and other customers, and meet legal obligations such as tax records.

Who sees it

Croco IT staff who need it to do their job. Our payment providers receive what they need to take a payment. Our email provider delivers the messages above. Nobody else, unless the law obliges us or you ask us to.

How long we keep it

Your account and service records for as long as you are a customer and for the period tax law requires after that (currently five years for invoices). Server logs and the activity log are kept for 12 months. When you close your account we delete or anonymise what the law does not require us to keep.

Your choices

You can read and correct your details from the account page and ask for a copy or for deletion by ticket. You can turn on two-factor authentication at any time. Email we send is limited to what the service needs; there is no marketing list.

Security

The control panel is served over HTTPS; passwords are hashed; server root passwords, API tokens and two-factor secrets are stored encrypted. Staff access to the admin panel requires two-factor authentication.

Contact

For anything about your personal data, open a ticket or email the support address shown on this site.