Privacy Notice

February 2026

The short version: we collect what we need to sell you hosting, bill you and support you. We never see your card number. We do not sell your data or run advertising trackers. The detail is below.

1. Who we are

• PanicHost LLC operates panichost.com and provides web hosting, VPS, game servers, dedicated servers and domain registration.
• We are a limited liability company formed in the State of Colorado, United States. For data protection purposes we are the controller of the personal data described below, and you can reach our data protection contact at the address in the next line.
• For anything about your personal data, email [email protected].

2. What we collect

• Account details. Your name, email address and password. The password is stored only as a hash, so nobody here can read it.
• Billing details. Your billing name and address, and the invoices themselves. We never receive or store your card number. Payments go to Stripe directly and we keep only a reference that lets us charge the card you authorised.
• Service data. The domains, servers and plans on your account, their configuration, and access credentials for them, which are encrypted at rest.
• Domain registrant details. Where you register a domain, the contact details registries require. See section 6.
• Support correspondence. Tickets you open and emails you send us, so we have the history when you come back.
• Technical logs. IP addresses, timestamps and request details, kept for security, abuse investigation and debugging.
• We do not buy personal data about you, and we do not sell yours.

3. Why we use it, and our lawful basis

• To provide the service you ordered, including provisioning, support and billing. Basis: performance of our contract with you.
• To take payment and keep accounts. Basis: contract, and our legal obligation to keep financial records.
• To keep the platform secure and investigate abuse. Basis: our legitimate interest in running a safe service, and protecting other customers.
• To send service email such as invoices, renewal reminders, and notices about your server. Basis: contract. These are not marketing and you cannot unsubscribe from them while you hold a service.
• To register domains, which requires passing your details to a registrar and registry. Basis: contract, and their legal requirements.

4. Who we share it with

• Stripe, our payment processor, which handles your card details directly under its own privacy policy.
• Our domain registrar and the relevant registry, when you register, transfer or renew a domain.
• Our email provider, to deliver mail we send you.
• Crisp, which runs the chat window on this site. If you open it, what you type in it, your IP address, browser and the pages you were on go to Crisp so we can answer you. Crisp is a French company and stores this in the EU. If you are signed in we pass your name, email and account number so you do not have to repeat them. If you never open the chat, no conversation exists to share.
• The infrastructure providers behind our VPS range, to the extent needed to provision and support a machine you have ordered.
• Where the law requires it, or to respond to a valid legal request. We will tell you when we are permitted to.
• We do not share your personal data with advertisers, data brokers or anyone else for their own purposes.

5. Cookies

• Session cookie. Keeps you signed in. Strictly necessary, and the site cannot work without it.
• Referral cookie (ph_ref). Set for 90 days when you arrive through a partner's referral link, so the partner is credited if you sign up later. It stores only a partner code. It is not used for advertising and is not shared.
• Crisp chat cookies. The chat window sets its own cookies and local storage so a conversation survives you changing page or coming back later. They identify a chat session, not a person, and they are not used for advertising. Declining them means the chat cannot keep your conversation.
• We do not run third-party advertising trackers, and we do not run an analytics product that profiles you across sites.
• The referral cookie is first party, holds nothing but a partner code, and is never used to profile you or to advertise. It is not strictly necessary to run the site, so if you are in the EU or UK you can ask us to remove it and we will, without any effect on your service.

6. Domain registration and WHOIS

• Registering a domain requires giving accurate contact details to the registrar and registry. This is an ICANN and registry requirement, not our choice, and supplying false details can cause the registry to suspend the domain.
• Personal contact details are redacted from public WHOIS for extensions whose registry permits it, which now covers most. Some country extensions require public details by policy, and we tell you before you buy one.
• Registries and registrars retain registration data under their own retention rules, which can outlast your account with us.

7. How long we keep it

• Account and service data: while your account is open, and for a reasonable period afterwards so you can come back.
• Invoices and payment records: for as long as tax and company law requires us to keep them, typically six to seven years, which is longer than we would otherwise keep them.
• A suspended, unpaid service and its data are deleted 14 days after termination. Once deleted, they cannot be recovered.
• Technical logs: a rolling window, kept only as long as useful for security and debugging.

8. Your rights

• You can ask for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, object to processing based on legitimate interest, or ask for it in a portable form.
• Much of it you can see and change yourself in your account settings, which is faster than asking us.
• Deletion has limits: we cannot delete invoices we are legally required to keep, and we cannot delete data needed to run a service you still hold.
• Email [email protected] and we will respond within 30 days.
• If you are in the UK or EU and are unhappy with our response, you can complain to your data protection authority. In the UK that is the ICO.

9. International transfers

• Our services run in more than one country, and some of the providers listed in section 4 operate outside the UK and EU. Where personal data is transferred, we rely on the safeguards those providers have in place, such as standard contractual clauses.
• In practice: our shared hosting runs in the United States, our game server nodes run in Germany, and a VPS runs in whichever region you chose when you ordered it. Our own systems and support are operated from the United States.

10. How we protect it

• Passwords are hashed. Server and control panel credentials, API keys and webhook secrets are encrypted at rest. API keys are stored only as a hash, so a copy of our database would not let anyone use them.
• Traffic to the site and control panel is encrypted in transit.
• Access to customer data by our staff is limited to what is needed for support, and staff access to a customer account is logged.
• No system is perfectly secure. If a breach affects your data we will tell you without undue delay, and notify the regulator where required.

11. Changes to this notice

• We will update this page when our practices change, and change the date at the top. If a change materially affects you we will email you.