Privacy Policy

exy.sh is committed to developing long lasting relationships based on trust. As such, exy.sh will do everything in its power to ensure that your right to privacy is maintained and protected.

Our Services are not directed at children under 13 years of age.

exy.sh may request or collect personal information from online users in a variety of ways, including through online forms for ordering products and services, and other instances where users are invited to volunteer such information.

The information we collect is the following:

• Username
• Email
• Hashed Password
• Your acceptance of our Terms of Service and the verification status of your email address
• Security settings you enable: two-factor authentication secrets and backup codes, and the public keys of registered passkeys
• If you sign in with Google or GitHub: the name, email address and account identifier that the provider returns to us
• Billing Information: orders, invoices, account credit and the payment status reported by our payment provider
• Optional billing profile: first and last name, address, VAT ID and phone number
• Sign-in records: IP address, browser user agent, sign-in method and whether the device is new to your account
• Sessions: IP address and browser user agent of each active sign-in session
• Order records: IP address and browser user agent at the time of ordering, used for fraud prevention
• Activity records: actions performed on your account and your servers, including the IP address they were performed from
• Server data: hostname, IP addresses and the initial access credentials of your servers, which are stored encrypted
• Copies of the emails we send to you, including their full content
• Emails you send to our support and abuse mailboxes

First and last name and your address are only stored if you provide them, however they are not mandatory when using our services. If you provide a billing profile, we use it only to determine and document the applicable value added tax. We do not ask for identity documents.

We do not use analytics, advertising or tracking tools on our websites or in our control panel.

We do not inspect the content stored on your servers (RDP/VPS) or the network traffic they send and receive, and we do not keep any network logs for them. To protect our network, we check the IP addresses of our servers against public abuse and reputation lists (Spamhaus and URLhaus) and process abuse complaints that third parties send us by email. Such a listing or complaint can lead to the suspension of the affected server.

Your personal information may be transferred to and stored at our office and associated data centers. By accepting our Terms of Service, you are explicitly consenting to this transfer and storage taking place.

We will take all steps reasonably necessary to ensure that your personal information is treated securely and in accordance with this Privacy Policy.

We use the following service providers to operate exy.sh:

• Data center operators in the EU and North America act as our processors. They provide the servers and network on which our platform (websites, control panel, API and database), the backups of the backup add-on and your virtual servers run, in the location you select when ordering.
• Cloudflare, Inc. (USA) provides DNS, a reverse proxy and protection against attacks for exy.sh and its subdomains, so all requests to our websites, control panel and API pass through Cloudflare, which processes your IP address and request data. Cloudflare Turnstile protects our sign-in and sign-up forms against automated abuse and processes your IP address and browser characteristics for this purpose.
• Resend sends our transactional emails (for example email verification, password resets, invoices and service notices) from send.exy.sh. Emails are sent from Resend's EU region (Ireland) using Amazon SES. Link tracking is disabled.
• Proton AG (Switzerland) hosts our support and abuse mailboxes. When you write to us, your email is stored there.
• Cryptomus processes our cryptocurrency payments. Cryptomus receives the amount, the currency, the order ID and a payment description containing the server name and billing cycle. We do not send your name or email address to Cryptomus.
• Sentry (Functional Software, Inc.) receives error reports from our control panel and backend. Error reports do not contain IP addresses, cookies, request bodies or your name or email address; the control panel attaches your numeric user ID so that we can investigate errors.
• Google and GitHub process your data if you choose to sign in with them.

A cookie is a piece of data stored on the user's computer tied to information about the user. We only use cookies that are necessary to provide our Services:

• A session cookie that keeps you signed in to the control panel. It is deleted when you log out and expires after 7 days without use.
• A language cookie (NEXT_LOCALE) that stores your preferred language on our website for 1 year.
• Security cookies that Cloudflare may set to distinguish legitimate visitors from automated attacks.

We do not use cookies for analytics or advertising. Cookies used on the exy.sh website do not contain your name, email address or password. Your browser's help file contains information and instructions for removing cookies.

Like most standard websites, we use log files. This information may include Internet protocol (IP) addresses, browser type, Internet service provider (ISP), referring/exit pages, platform type, date/time stamp, and number of clicks. We use it to operate and administer the site, keep it secure, and investigate errors and abuse. Cloudflare, which proxies all requests to our websites, also processes this request data.

Some of the information stored in our log files, including but not limited to IP addresses, may be linked to personally identifiable information.

On rare occasions it is necessary to send out a strictly service related announcement, if, for instance, our service is temporarily suspended for maintenance. We also send service notices such as invoices, expiry reminders and sign-in alerts that contain the IP address and device of a sign-in.

Generally, users may not opt-out of these communications, though they can deactivate their account. However, these communications are not promotional in nature.

Though we make every effort to preserve your privacy, we may need to disclose personal information when required by law, if we have a good faith belief that such action is necessary and required to comply with a current judicial proceeding, a court order or legal process served on exy.sh.

The information provided to exy.sh is kept for as long as your account exists and afterwards for as long as we are legally required to keep it, and may be stored on one or more databases directly or indirectly maintained by exy.sh. We do not automatically delete sign-in records, session records, order records, activity records or copies of sent emails while your account exists.

When a server is not renewed, we send a reminder 3 days before it expires, suspend it 1 day after expiry and delete it 7 days after expiry. The deletion removes the server together with its disks, its backups, its access credentials and its server logs irreversibly. Orders and invoices relating to the server are kept to meet our legal obligations.

Accounts cannot currently be deleted from the control panel. If you ask us to delete your account, we anonymize it: your email address, name and username are replaced, your billing address is removed, and your sessions and stored sign-in credentials are deleted. Orders and invoices are kept for the statutory retention periods, and the records listed in section 2 are kept.

exy.sh employs industry standard security measures to protect the confidentiality of the information. While we cannot guarantee that loss, misuse or alteration to data will not occur; we make every effort to prevent such occurrences.

Any other particularly sensitive information is encrypted prior to transmission by you to exy.sh.

You are responsible for the security of the login information, such as usernames and passwords, which give you access to your private information maintained by exy.sh. We recommend that you enable two-factor authentication or a passkey for your account.

Make sure you keep login information in a safe place and do not share it with others. Note that keyloggers, viruses, or other surveillance devices can intercept login information on the computers from which you access our Services, so you should take precautions regarding such devices, especially from public computers.

In addition, you should always log out from any relevant Services when you are not actively using them.

As a Data Subject, you have the following data protection rights: If you wish to access, correct, update, or request deletion of your personal information, you can do so at any time by emailing [email protected].

In addition, you can object to the processing of your personal information, ask us to restrict the processing of your personal information, or request portability of your personal information. Again, you can exercise these rights by emailing [email protected].

You have the right to opt-out of marketing communications we send you at any time. We currently do not send marketing emails; if we do, you can exercise this right by clicking on the "unsubscribe" link in those emails. To opt out of other forms of marketing, please contact us by emailing [email protected].

Similarly, if we have collected and process your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect the processing of your personal information conducted in reliance on lawful processing grounds other than consent.

You have the right to complain to a data protection authority about our collection and use of your personal information. For more information, please contact your local data protection authority.

We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.