1. Scope & controller
AZ-Servers Infrastructure, 1201 N Orange St, Suite 700, Wilmington, DE 19801, is the data controller for personal data processed through this website, the client area and our billing systems. References to “we”, “us” and “our” mean that entity.
This policy covers our storefront, client area, support channels and any marketing we send. It does not cover third-party sites we link to, or software you install on your own server — you are the controller for data you store there.
2. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account & billing | Name, company, email, phone, postal address, VAT/tax ID, country, currency | You, at registration and checkout |
| Order & service records | Products ordered, hostnames, IP allocations, datacenter location, configuration choices | Generated when you order |
| Payment data | Transaction ID, amount, status, last four digits and card brand | PayPal / Stripe (we never receive full card numbers) |
| Support content | Ticket messages, attachments, chat transcripts, call notes | You, when contacting support |
| Technical & security logs | IP address, user agent, request path, timestamps, authentication events | Automatically, when you use the site or client area |
| Network telemetry | Flow data, attack signatures and mitigation events for your service | Our network and DDoS platform |
| Marketing preferences | Email opt-in status, campaign engagement counts | You and our email provider |
We do not intentionally collect special-category data (health, biometric, political or religious data). Please do not include such data in support tickets or server hostnames.
3. How we use data
- Provision, configure and operate the services you order.
- Authenticate you and protect your account against takeover and fraud.
- Issue invoices, process payments, manage renewals and recover debts.
- Respond to support requests and troubleshoot incidents.
- Detect and mitigate abuse, attacks and violations of our AUP.
- Meet legal, tax, accounting and registry obligations.
- Send service notices (maintenance, security, billing) — these are not marketing.
- With your consent, send product news and offers; you can opt out at any time.
- Analyse aggregate usage to capacity-plan and improve the platform.
We do not sell personal data, and we do not use it to train third-party AI models.
4. Legal bases
Where the GDPR or comparable law applies, we rely on the following bases:
- Contract — creating your account, delivering services, billing and support.
- Legal obligation — tax records, fraud reporting, responding to lawful requests.
- Legitimate interests — network security, abuse prevention, service improvement and limited direct marketing to business customers. We balance these against your rights.
- Consent — optional marketing email and non-essential cookies.
You may withdraw consent at any time without affecting processing carried out before withdrawal.
5. Cookies & tracking
We use a small number of first-party cookies. The session cookie is strictly necessary and cannot be disabled while you are signed in.
| Name | Purpose | Lifetime |
|---|---|---|
az_session | Signed, encrypted session for the client area | 8 hours |
az-theme (local storage) | Stores your light, dark or system theme preference | Until cleared |
az_csrf | Protects forms against cross-site request forgery | Session |
We do not use advertising cookies, cross-site trackers or third-party analytics that profile you across the web. Any future analytics will be privacy-preserving and disclosed here before use.
6. Sharing & processors
We share data only where necessary, with parties bound by confidentiality and data-processing terms:
- Payment processors — PayPal and Stripe, to charge invoices and handle refunds.
- Datacenter partners — the minimum needed to rack, power and connect your hardware.
- Billing & support platform — our WHMCS installation and email delivery providers.
- Fraud & abuse services — to screen orders and investigate attacks.
- Professional advisers — auditors, accountants and lawyers under duty of confidence.
- Authorities — where required by law, court order or to protect life and safety.
If we are acquired or merge, data may transfer to the successor entity under this policy. We will notify you before any such transfer changes how your data is handled.
7. International transfers
Our infrastructure is global, so data may be processed in the United States and the European Economic Area. Where we transfer personal data out of the EEA or UK, we rely on an adequacy decision or the European Commission’s Standard Contractual Clauses, supplemented by technical measures such as encryption in transit and at rest.
8. Retention
- Account and billing records: 7 years after the last transaction, to meet tax and accounting law.
- Support tickets: 3 years from closure, then anonymised.
- Security and access logs: 90 days, unless retained for an active investigation.
- Network flow and mitigation logs: 30 days.
- Server data: deleted 72 hours after service termination, unless a legal hold applies.
- Marketing preferences: until you unsubscribe, plus 12 months of suppression records.
9. Your rights
Depending on your jurisdiction, you may have the right to:
- Access the personal data we hold about you and receive a copy.
- Correct inaccurate or incomplete data — most fields are editable in the client area.
- Request erasure where we no longer have a lawful basis to keep it.
- Restrict or object to processing, including direct marketing.
- Receive your data in a portable, machine-readable format.
- Withdraw consent for optional processing at any time.
- Lodge a complaint with your local supervisory authority.
California residents have the right to know, delete, correct and opt out of the sale or sharing of personal information. We do not sell personal information. To exercise any right, emailsupport@az-servers.com from your registered address. We respond within 30 days and may need to verify your identity.
Erasure requests cannot override records we must keep for tax, fraud prevention or an active legal claim. Where part of a request must be refused, we explain why.
10. Security
- TLS 1.2+ for all traffic between you and our systems.
- Signed, httpOnly session cookies and CSRF protection on state-changing requests.
- Role-based access control and audit logging for staff who can view client records.
- Encryption at rest for billing databases and backups.
- Payment card data is tokenised by PayPal and Stripe and never stored on our servers.
- Periodic access reviews and dependency vulnerability scanning.
No system is perfectly secure. If a breach affects your personal data, we notify you and the relevant regulator without undue delay where legally required.
11. Children
Our services are not directed at children under 18 and we do not knowingly collect their data. If you believe a minor has provided personal data, contact us and we will delete it.
12. Changes to this policy
We may update this policy to reflect changes in law or our processing. Material changes are announced by email or in the client area at least 30 days before they take effect. The “last updated” date above always reflects the current version.
13. Contact
Privacy questions and rights requests:support@az-servers.com. Abuse and security reports:abuse@az-servers.com. Postal address: 1201 N Orange St, Suite 700, Wilmington, DE 19801.
Policy version 2.4 · effective 11 November 2026 · AZ-Servers Infrastructure