Privacy Policy

Who we are

HostingWC (“we”, “us”) runs hostingwc.com and the client dashboard at my.hostingwc.com and decides how the personal data described here is used. For any privacy question, email [email protected].

We use personal data to answer your messages, to provide and bill for the services you order (our contract with you), to keep our systems and customers secure and prevent abuse (our legitimate interests), and to meet legal obligations such as tax and accounting records.

Contact and inquiry forms

The forms on the contact, migration, platform and care pages ask for your name, email address, optionally your website address (required on the migration form) and a message, plus the questions on that form, such as the topic, your current host, the number of sites, your platform or stack, expected traffic, the plan you are interested in or your company name.

• How it is sent: when you press send, our server turns your answers into an email to our team and sends it through an email delivery provider. We reply from our own mailbox. The email does not contain your IP address.
• Spam check: the forms use Cloudflare Turnstile to tell people from bots. It loads when you start filling in a form and processes signals such as your IP address and information about your browser and device, under Cloudflare’s own privacy terms. A hidden field that people never see also catches automated submissions.
• Rate limiting: to stop floods of messages, our server counts submissions per network. It stores a one-way hash of your IP address, mixed with a random secret and the date, together with the times of the submissions, in a small file outside the website. The address itself is not stored, and the counters are removed once they expire.
• What we use it for: only to answer your message and, if you become a customer, to keep a record of what we discussed.

The speed test

When you test a site on the homepage or on the speed audit page, your browser sends the address you entered to our server, and our server asks Google PageSpeed Insights to measure it. Google loads that public page from its own servers; its processing is covered by Google’s privacy policy. Do not test addresses that contain private information, such as a password-reset link.

• To allow one audit a minute per network, our server keeps a hash of your IP address (mixed with a random secret), a hash of the tested address and which tests ran, for about a minute.
• The result for an address is kept on our server for up to five minutes, so that opening the full report straight after a quick test does not measure the same page twice. It contains the public measurements of that page, not information about you.
• Your browser keeps the last result so a reload can show it again; see the next section.

Storage in your browser

The website itself sets no cookies, and it uses no advertising or analytics cookies, pixels or tracking scripts. It keeps a few settings in your browser’s local storage, which stay on your device and are not sent to us:

Theme

wc-theme: light, dark or system.

Speed test

wc-speedtest, wc-audit-last: the last tested address and its results, shown again for up to a day. wc-audit-url: the address you typed, carried over to the full audit page.

Cooldown

wc-speedtest-cool, wc-audit-cool: when the next test can run, so the waiting time survives a reload.

Sign-in status

wc-signed-in: whether the last check found you signed in to the dashboard, so the header shows the right button straight away.

You can clear these at any time in your browser’s settings. Cloudflare, which protects and delivers the website, may set cookies that are strictly necessary for security, for example to tell people from bots. The client dashboard uses its own cookies to keep you signed in.

Sign-in status check

Each page of the website asks my.hostingwc.com whether you are signed in, so the header can show “Go to dashboard” instead of “Sign in”. If you have a dashboard session, your browser sends its session cookie with that request. The answer is only yes or no; the website does not receive your name or any account details.

Domain search

When you search for a domain name on the domains page, your browser asks public domain registration services (RDAP, through rdap.org and the registry for each ending) whether that name is registered. Those services see the names you search and your IP address, as with any website request.

Client dashboard and billing

When you create an account or order a service, the client dashboard holds:

• account data: your name, email address, company, postal address, phone number if you give it, and your sign-in and security settings;
• billing data: orders, invoices, payments, the plan prices that apply to you, and tax details;
• service data: your plans, domains, sites and their settings, the monthly performance reports, and your support conversations with us.

Payments are processed by PayPal or by card payment processors, who receive the payment details you enter and handle them under their own privacy policies. When you register a domain, the registrant details are passed to the registrar and the registry for that ending, as their rules require, and may appear in public registration data depending on the ending and the privacy options available.

Data in your sites

The websites, databases and mailboxes you host with us may contain personal data about your own visitors and customers. That data is yours: we store and process it only to provide the services, keep them secure and follow your instructions, and we do not use it for anything else. You are responsible for your own privacy notice to those people.

Server logs and security

Like any web server, ours record requests in logs: the IP address, date and time, the page or file requested, the response, and the browser’s user agent and referring page. We use them to keep the services running, to investigate errors and to detect and stop abuse. Our form and speed-test code writes short technical lines to the error log, for example that a spam check failed, without your name, email address or message.

We protect personal data with access controls, encrypted connections and by keeping secrets out of the website. No system is perfectly secure, and we cannot guarantee that data will never be accessed without permission; if a breach affects you, we will tell you as the law requires.

Who we share data with

We share personal data only with service providers who help us run the business, each for its own task and under its own privacy terms:

• the infrastructure our website, dashboard and your services run on;
• an email delivery provider, for form messages and account emails;
• Cloudflare, for delivering and protecting the website and for the spam check;
• Google PageSpeed Insights, for the addresses you ask us to test;
• PayPal and card payment processors, for payments;
• domain registrars and registries, for the domains you register.

We may also disclose data when the law or a valid order from an authority requires it, to protect our rights, customers or the public, or to a buyer as part of a sale or reorganisation of our business, which would remain bound by this policy. We do not sell personal data or share it for advertising.

How long we keep data

We keep personal data only as long as we need it for the purpose it was collected for:

• form messages, as long as needed to answer them and keep a reasonable record of our correspondence;
• account, service and support data, while you are a customer and for a reasonable period afterwards;
• billing records, for as long as tax and accounting laws require;
• rate-limit counters and speed-test results, for minutes to a day, as described above;
• server logs, for a limited period for security and troubleshooting.

After that, we delete the data or make it anonymous.

International transfers

Our service providers may process data in countries other than yours, including countries whose data protection laws differ from those where you live. Where the law requires it, we rely on appropriate safeguards for those transfers, such as standard contractual clauses offered by the provider.

Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy;
• correct data that is wrong or incomplete;
• delete data we no longer need, or that you no longer want us to keep, unless the law requires us to keep it;
• object to, or ask us to restrict, how we use it, and take it with you in a portable format.

To use any of these rights, email [email protected]. We may ask you to confirm your identity before we act, and we answer within the time the law allows. You can correct most account details yourself in the client dashboard. You also have the right to complain to the data protection authority where you live.

Children

Our services are for businesses and adults. They are not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data, contact us and we will delete it.

Changes to this policy

We update this policy when our services or the law change. The date at the top shows the latest version. If a change materially affects how we use your data, we will tell you by email or in the client dashboard before it takes effect.

Contact

Privacy questions and requests: [email protected].