1. Data we collect

Information you give us

Name - to identify your account and issue invoices.
Email address - for order confirmations, invoices and service notices.
Discord username - our primary support channel and how we hand over your server.
Minecraft server name - to label and configure your server.
Order notes - optional details you choose to send us.
Payment ID / transaction reference - to reconcile your payment.
Contact form messages - name, email, subject and message body.

Information collected automatically

IP address - used transiently for rate limiting and abuse prevention.
Server logs - request paths and timestamps, for security and debugging.

What we do not collect

We do not store card numbers, UPI PINs, CVVs or bank credentials. Card and netbanking payments are processed entirely by our payment provider (Razorpay); we only ever see a transaction identifier and its status.

2. Cookies and local storage

Theme preference - stored in your browser's localStorage. Not sent to us.
Order handoff - your current order is kept in sessionStorage so the payment page can display it. Cleared when you close the tab.
Admin session cookie - only set for staff logging into the admin panel. HttpOnly, SameSite=Strict.

We do not use advertising cookies, third-party analytics or cross-site trackers.

3. Why we process your data

To provide the service - creating, configuring and supporting your server (contractual necessity).
To take payment - matching transactions to orders and issuing invoices (contractual necessity).
To communicate - service notices, renewal reminders, support replies (contractual necessity).
To protect the service - rate limiting, fraud and abuse prevention (legitimate interest).
To meet legal obligations - tax and accounting records (legal obligation).

4. Who we share data with

We do not sell your data. We share only what is necessary with:

Razorpay - payment processing. Governed by their own privacy policy.
Our datacentre provider - infrastructure hosting in Mumbai, India.
Law enforcement - only where legally compelled.

5. How long we keep it

Order records - retained while your service is active and for up to 7 years afterwards for tax and accounting purposes.
Contact messages - up to 12 months after resolution.
Server data (worlds, configs) - deleted 7 days after termination.
Access logs - up to 90 days.

6. Security

Traffic is served over HTTPS/TLS.
Database access is restricted to the application; all queries use parameterised statements.
The admin panel is password protected with signed, expiring sessions and login rate limiting.
Security headers (CSP, HSTS-ready, frame protection) are applied to every response.

No system is perfectly secure. If we discover a breach affecting your data, we will notify you without undue delay.

7. Your rights

You can ask us to:

Access - provide a copy of the data we hold about you.
Correct - fix inaccurate details.
Delete - erase your data, subject to our legal retention duties.
Restrict or object - limit how we process your data.
Export - receive your data in a portable format.

Email support@ziayzu.host from your registered address. We respond within 30 days.

8. Children

Our services are not directed at children under 13. If you are under 18, please have a parent or guardian place the order. If we learn we hold data from a child under 13 without parental consent, we delete it.

9. Changes to this policy

Material changes are announced on our Discord server and by email at least 14 days before they take effect. The “last updated” date above always reflects the current version.

10. Contact

Privacy questions or requests: support@ziayzu.host or via our Discord server.

Privacy Policy