Privacy notice

Controller

The controller of personal data under this notice is Nimbus Cloud Hosting OÜ, Sepapaja 6, 15551 Tallinn, Estonia, registry code PLACEHOLDER-REGCODE. Questions about this notice go to support@nimbusvps.example.

What we collect — the complete list

Your email address, which is also your login.

Invoice data: the invoice name you chose to print on invoices, the order line (plan, site, term, add-ons), the euro amount, the asset and amount paid, and the invoice status.

The configuration of your servers: plan, image, hostname, IP addresses, SSH key material you upload, and the technical settings you change in the console.

Seventy-two hours of connection metadata per server (source and destination addresses and ports, protocol, byte counts, timestamps) for the sole purpose of investigating abuse reports and network faults.

Support tickets and their contents, for twenty-four months from the last message.

That is the list. There is no analytics pipeline, no advertising profile, no data broker, and no 'we may also collect' appendix hiding a second list.

What we never collect

Government identity documents, passport scans or national ID numbers. Selfies or liveness checks. Phone numbers or phone verification. Payment cards, bank accounts or billing addresses that must match a name. Social media accounts, friend graphs or referral chains.

Data you never collect cannot be leaked, subpoenaed, sold or lost. That sentence is the entire reason this section exists.

Payments

Payments are handled by a payment processor that quotes a euro amount and shows you a payment address. We do not see your wallet address or private keys, and the processor does not see your server data.

For refunds we return the asset you paid at the day-of-purchase exchange rate, which the processor settles; the same 'we do not see your keys' boundary applies in reverse.

How long we keep things

Server configuration and content: deleted within twenty-four hours of termination or deletion, unless deletion is itself the subject of an open abuse investigation.

Connection metadata: seventy-two hours, after which it is overwritten. Extensions happen only for an open abuse investigation and are lifted when it closes.

Support tickets: twenty-four months from the last message.

Invoices: ten years, because Estonian accounting law requires us to keep them that long. Invoice data contains no identity documents and only the name you chose to print.

Email address: until you close the account, and within twenty-four hours after you do, except where an invoice under the ten-year retention rule references it.

What we do with your data

Provisioning and operating the service you ordered; responding to support and abuse reports; complying with legal obligations that apply to us; and preventing fraud against the service.

We do not sell data, rent data, or use it to advertise anything to you. The quarterly operations newsletter is the only mail we send, and it has its own opt-in.

Where your data lives

The data you store on a server lives in the site you chose — that is the product. Our account data (email, invoices, tickets) is processed in the European Union.

Choosing a site outside the EU is a choice about where your content is stored, and the jurisdiction of that site applies to it. The location is printed on every order and every invoice.

Law enforcement and abuse

We respond to lawful requests from courts and authorities, in the jurisdiction of the site concerned or of our company, with what we actually hold — which, per this notice, is a short list.

Abuse reports from the public go to abuse@nimbusvps.example and are investigated against the 72-hour connection metadata window. Where a report is validated, the response is governed by the acceptable use policy.

Your rights

Under the GDPR you have the right to access, correct, export and erase your personal data, and to object to or restrict processing. Because we hold so little, most requests resolve to: here is the invoice list, and here is the deletion confirmation.

Exercise any right by writing from the email address on the account to support@nimbusvps.example. We verify requests by that address alone — the no-KYC rule applies to rights requests too.

You may also lodge a complaint with the Estonian Data Protection Inspectorate (AKI) or your local supervisory authority.

Changes to this notice

If this notice changes in a way that matters — a new data type, a longer retention, a new processor — we will announce it on the status page and by email to account holders at least thirty days before it takes effect. Administrative clarifications may take effect sooner and are dated on this page.