Privacy Policy

1. Who we are and how to contact us

Orihost is responsible (the "controller") for the personal data described in this policy. For any privacy question or request, contact our data protection contact at [email protected]. For general support, email [email protected].

2. Which services this policy covers

• orihost.com: our website.
• billing.orihost.com: our billing and customer portal.
• panel.orihost.com: our free hosting panel.
• ppanel.orihost.com: our premium hosting panel.
• audit.orihost.com: OriAudit, our website-audit tool.
• status.orihost.com: our status page.

3. What we collect and where it comes from

4. Why we use your data and our legal basis

Where the EU or UK GDPR applies, we rely on the following legal bases:

Where we rely on legitimate interests, we have weighed our interests against your rights. You can ask us for details and you can object (see section 9).

You must provide an email address, a username and a password to create an account, and billing details to buy paid services (we need them to issue legally required invoices). Without them we cannot provide the service. Everything else, such as linking Discord or GitHub or accepting analytics cookies, is optional.

5. Automated decisions

We use the following automated decisions, which can significantly affect you:

• Multiple-account detection (free panel). When you sign up or sign in with Discord, we compare your device token with other accounts and with the hashed tokens of previously suspended accounts. If your device token matches an account that is older than yours, or a suspended account, your account is automatically restricted (you cannot create servers) and your servers are suspended. Staff may also review accounts that share an IP address and suspend newer linked accounts.
• Automated abuse scanning. An automated system scans server files for patterns associated with prohibited activity listed in our Terms (for example crypto-mining, self-bots, proxies and obfuscated code). A match can suspend the server automatically; some matches are queued for staff review.
• Free-server expiry. Free servers that are not renewed are suspended when their renewal period runs out.
• Non-payment. Paid services are suspended if an invoice is unpaid a few days after its due date (normally 3) and terminated, with server data deleted, if it remains unpaid (normally 14 days after the due date). The exact periods are shown for each product.

Important: a suspended server is kept for at least 3 days, and we email you about 48 hours before it is permanently deleted. Servers are not deleted while an appeal is being reviewed, and an approved appeal restores them (see our Terms of Service).

We use these decisions because they are necessary to provide our services under our contract with you and to keep the free tier fair. You will be told the reason for a suspension. You can ask for a human review and contest the decision using the appeal form in the panel or by emailing [email protected].

6. Who we share data with

We do not sell personal data. We share it only with the following recipients, and only as far as each needs it:

We also disclose data where the law requires it (for example to courts or authorities), to our professional advisers, to protect the rights and safety of our users or the public, and to a buyer if our business is sold (we will tell you if that happens).

7. International transfers

Some recipients, and some of our servers, are outside the European Economic Area, in particular in the United States and Canada. When we transfer personal data:

• to Canada, we rely on the European Commission's adequacy decision for Canada;
• to the United States, we rely on the EU–U.S. Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses included in the provider's data-processing terms.

You can ask for more information about these safeguards at [email protected].

8. How long we keep data

9. Your rights

Where the EU or UK GDPR applies, you have the right to:

• Access your data and receive a copy;
• Rectify inaccurate or incomplete data;
• Erase your data, subject to legal retention duties;
• Restrict our processing in certain cases;
• Data portability: receive data you gave us in a machine-readable format;
• Object to processing based on legitimate interests, and at any time to direct marketing;
• Withdraw consent at any time, without affecting earlier processing;
• Not be subject to a decision based solely on automated processing that significantly affects you, and to ask for human review (see section 5).

How to use your rights: in the billing portal, use Account → Privacy to download your data or delete your account (this also deletes your premium panel account); in the premium panel, use Account → Your Data & Privacy to download your panel data; on the free panel, use Account Settings. For anything else, email [email protected]. We reply within one month (extendable by two months for complex requests) and may ask you to verify your identity.

When you delete your billing account, your servers are terminated, your premium panel (ppanel) account is deleted, and your personal data is then removed. Issued invoices and payment records are kept for as long as accounting law requires.

When you delete your free-panel account, we delete your servers and personal data, with two exceptions. We keep payment records, without your name, for as long as tax law requires. If your account was suspended, we keep a one-way hash of your email and device tokens for 12 months to prevent ban evasion.

Complaints: you have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live, work or where you believe the infringement took place. A list of EU authorities is available at edpb.europa.eu. We would appreciate the chance to resolve your concern first.

10. Monitoring of hosted content

To enforce our Terms and protect our network, we (a) run automated scans of server files for known abuse patterns (section 5), and (b) in specific cases, authorised members of our management team manually review server files, databases and configurations. Manual reviews are limited to what is needed to investigate a suspected violation or security issue, and the information reviewed is kept confidential. We keep short file excerpts only as evidence for a suspension.

When you host applications that process personal data of your own users (for example a Discord bot or a game server), you are responsible for that data, and we process it on your behalf only to provide the hosting.

11. Discord server membership

If you sign in with Discord on the free panel, we add your Discord account to the Orihost Discord server, using the permission you grant on Discord's authorisation screen. We tell you this, and ask you to accept our Terms, before your account is created. You can leave the Discord server at any time. If you prefer not to join, register with email instead.

12. Cookies and similar technologies

We use strictly necessary cookies and local storage to run our services. With your consent we also use analytics cookies (and, on the free panel, advertising cookies). You can accept, reject or customise these in the cookie banner and change your choice at any time through Cookie settings in the footer. Details for each site are in our Cookie Policy.

Some pages also load content from other servers, which then receive your IP address: images on the free panel (albeu.com, i.e-z.host) and some images in our blog posts.

13. Security

We protect personal data with measures appropriate to the risk, including TLS encryption between your browser and our sites, hashed passwords, encrypted storage of sensitive tokens and keys, optional two-factor authentication (mandatory for staff), role-based staff access and logging of staff and account activity. No system is completely secure. If a personal data breach is likely to result in a high risk to you, we will inform you without undue delay.

14. Children

You must be at least 16 years old to use our services, and you confirm this when you sign up. We do not knowingly collect personal data of anyone younger. If you believe someone under 16 has given us personal data, contact [email protected] and we will delete it.

15. Changes to this policy

We may update this policy when our services or the law change. If we make material changes, we will tell you by email or with a notice on our sites before they take effect. The date at the top shows the latest version.

16. Contact

Privacy questions and requests: [email protected]. General support: [email protected].