Privacy notice
Written in plain language. CloudPanel is run by the service operator.
What we collect, and why
- Account: name, email and a password hash — to let you sign in and contact you about your services.
- Security: your authenticator secret (encrypted) and recovery-code hashes — to protect your account.
- Orders and billing: what you buy, invoices and payment records — to deliver services and meet accounting law.
- Domain contacts: name, address, phone and email you give us — the domain registry requires them.
- Support: tickets, replies and attachments you send.
- Optional profile: company, phone and address — only if you add them.
What we deliberately don't do
- No advertising, analytics, tracking pixels, or third-party scripts, fonts or images. Pages load only from this site.
- Only two essential cookies: a session cookie and a short-lived security token. No tracking cookies, so there is no cookie banner.
- Notification emails contain no details — only a sign-in link.
- IP addresses are stored truncated (for example 203.0.113.0) and removed from logs after 30 days.
Who sees your data
- Our support staff, only to help you. Every time staff open your account or a ticket it is logged, and you can see that log under Security & privacy.
- Staff sign in through our own identity provider (Authentik). Customers are not sent there.
- We do not sell or share your data for marketing.
How long we keep it
- Account data: while your account exists. Deleting your account erases personal data and tickets immediately.
- Invoices and payment records: kept after deletion, with your details removed, because accounting law requires it.
- Security/audit log: 730 days. Notifications: 90 days. Sessions and reset links: until they expire.
Your rights
Under UK/EU data protection law you can access, correct, export and erase your data. Signed-in customers can download their data and delete their account themselves under Security & privacy. For anything else, contact the operator. You can also complain to the ICO (UK) or your local data protection authority.
Security
Multi-factor authentication is required for every account. Provider credentials and authenticator secrets are encrypted at rest. Connections use HTTPS.