Privacy Policy

1. Who we are and how to contact us

Orihost is responsible (the "controller") for the personal data described in this policy. For any privacy question or request, contact our data protection contact at [email protected]. For general support, email [email protected].

2. Which services this policy covers

• orihost.com: our website.
• billing.orihost.com: our billing and customer portal.
• panel.orihost.com: our free hosting panel.
• ppanel.orihost.com: our premium hosting panel.
• audit.orihost.com: OriAudit, our website-audit tool.
• status.orihost.com: our status page.
• Our Discord server: including our Orihost Utilities bot (see section 17).

3. What we collect and where it comes from

4. Why we use your data and our legal basis

Where the EU or UK GDPR applies, we rely on the following legal bases:

Where we rely on legitimate interests, we have weighed our interests against your rights. You can ask us for details and you can object (see section 9).

You must provide an email address, a username and a password to create an account, and billing details to buy paid services (we need them to issue legally required invoices). Without them we cannot provide the service. Everything else, such as linking Discord or GitHub or accepting analytics cookies, is optional.

5. Automated decisions

We use the following automated decisions, which can significantly affect you:

• Multiple-account detection (free panel). When you sign up or sign in with Discord, we compare your device token with other accounts and with the hashed tokens of previously suspended accounts. If your device token matches an account that is older than yours, or a suspended account, your account is automatically restricted (you cannot create servers) and your servers are suspended. Staff may also review accounts that share an IP address and suspend newer linked accounts.
• Automated abuse scanning. An automated system scans server files for patterns associated with prohibited activity listed in our Terms (for example crypto-mining, self-bots, proxies and obfuscated code). A match can suspend the server automatically; some matches are queued for staff review.
• Free-server expiry. Free servers that are not renewed are suspended when their renewal period runs out.
• Non-payment. Paid services are suspended if an invoice is unpaid a few days after its due date (normally 3) and terminated, with server data deleted, if it remains unpaid (normally 14 days after the due date). The exact periods are shown for each product.

Important: a suspended server is kept for at least 3 days, and we email you about 48 hours before it is permanently deleted. Servers are not deleted while an appeal is being reviewed, and an approved appeal restores them (see our Terms of Service).

We use these decisions because they are necessary to provide our services under our contract with you and to keep the free tier fair. You will be told the reason for a suspension. You can ask for a human review and contest the decision using the appeal form in the panel or by emailing [email protected].

If a server sends requests to Discord's API faster than our limit, it is automatically blocked from reaching Discord for 1 to 60 minutes. Repeated limits within 24 hours last longer. This protects the shared IP address of the node from being banned by Discord. The block and its reason are shown on your server's page in the panel, and it ends by itself. It never suspends the server.

6. Who we share data with

We do not sell personal data. We share it only with the following recipients, and only as far as each needs it:

We also disclose data where the law requires it (for example to courts or authorities), to our professional advisers, to protect the rights and safety of our users or the public, and to a buyer if our business is sold (we will tell you if that happens).

7. International transfers

Some recipients, and some of our servers, are outside the European Economic Area, in particular in the United States and Canada. When we transfer personal data:

• to Canada, we rely on the European Commission's adequacy decision for Canada;
• to the United States, we rely on the EU–U.S. Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses included in the provider's data-processing terms.

You can ask for more information about these safeguards at [email protected].

8. How long we keep data

Retention periods for Discord bot data are enforced automatically once a day. You can ask for earlier deletion at [email protected].

9. Your rights

Where the EU or UK GDPR applies, you have the right to:

• Access your data and receive a copy;
• Rectify inaccurate or incomplete data;
• Erase your data, subject to legal retention duties;
• Restrict our processing in certain cases;
• Data portability: receive data you gave us in a machine-readable format;
• Object to processing based on legitimate interests, and at any time to direct marketing;
• Withdraw consent at any time, without affecting earlier processing;
• Not be subject to a decision based solely on automated processing that significantly affects you, and to ask for human review (see section 5).

How to use your rights: in the billing portal, use Account → Privacy to download your data or delete your account (this also deletes your premium panel account); in the premium panel, use Account → Your Data & Privacy to download your panel data; on the free panel, use Account Settings. For anything else, email [email protected]. We reply within one month (extendable by two months for complex requests) and may ask you to verify your identity.

When you delete your billing account, your servers are terminated, your premium panel (ppanel) account is deleted, and your personal data is then removed. Issued invoices and payment records are kept for as long as accounting law requires.

When you delete your free-panel account, we delete your servers and personal data, with three exceptions. We keep payment records, without your name, for as long as tax law requires. If your account was suspended, we keep a one-way hash of your email and device tokens for 12 months to prevent ban evasion. Records of abuse-related suspensions and Discord API rate limits (date, reason, server name and account ID) are kept after deletion to prevent abuse; file excerpts used as evidence are deleted after 12 months.

Complaints: you have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live, work or where you believe the infringement took place. A list of EU authorities is available at edpb.europa.eu. We would appreciate the chance to resolve your concern first.

10. Monitoring of hosted content

To enforce our Terms and protect our network, we (a) run automated scans of server files for known abuse patterns (section 5), and (b) in specific cases, authorised members of our management team manually review server files, databases and configurations. Manual reviews are limited to what is needed to investigate a suspected violation or security issue, and the information reviewed is kept confidential. We keep short file excerpts only as evidence for a suspension. We also count how many requests each server sends to Discord's API (not their content) to apply the rate limit described under "Automated decisions".

When you host applications that process personal data of your own users (for example a Discord bot or a game server), you are responsible for that data, and we process it on your behalf only to provide the hosting.

11. Discord server membership

If you sign in with Discord on the free panel, we add your Discord account to the Orihost Discord server, using the permission you grant on Discord's authorisation screen. We tell you this, and ask you to accept our Terms, before your account is created. You can leave the Discord server at any time. If you prefer not to join, register with email instead.

12. Cookies and similar technologies

We use strictly necessary cookies and local storage to run our services. With your consent we also use analytics cookies (and, on the free panel, advertising cookies). You can accept, reject or customise these in the cookie banner and change your choice at any time through Cookie settings in the footer. Details for each site are in our Cookie Policy.

Some pages also load content from other servers, which then receive your IP address: images on the free panel (albeu.com, i.e-z.host) and some images in our blog posts.

13. Security

We protect personal data with measures appropriate to the risk, including TLS encryption between your browser and our sites, hashed passwords, encrypted storage of sensitive tokens and keys, optional two-factor authentication (mandatory for staff), role-based staff access and logging of staff and account activity. No system is completely secure. If a personal data breach is likely to result in a high risk to you, we will inform you without undue delay.

14. Children

You must be at least 16 years old to use our services, and you confirm this when you sign up. We do not knowingly collect personal data of anyone younger. If you believe someone under 16 has given us personal data, contact [email protected] and we will delete it.

15. Changes to this policy

We may update this policy when our services or the law change. If we make material changes, we will tell you by email or with a notice on our sites before they take effect. The date at the top shows the latest version.

16. Contact

Privacy questions and requests: [email protected]. General support: [email protected].

17. Our Discord server and the Orihost Utilities bot

Orihost Utilities is our Discord bot. It only operates in our own Discord server. Retention periods for the data below are in section 8.

• Tickets. When you open a ticket, we store your Discord user ID, the ticket channel, the ticket category and the ticket's timestamps. When the ticket is closed, an HTML transcript of it is posted to a private staff channel and sent to you by direct message.
• Priority tickets. Whether you can open a priority ticket depends on your roles in our Discord server.
• AI assistant. In ticket channels only, an AI assistant can answer you. It reads the ticket's messages and the text of attached text files; lines that look like passwords or tokens are removed, and images are not read. Up to the last 40 messages are sent to OpenRouter (see section 6), with each speaker labelled only as "Customer" or "Staff". We do not add Discord IDs or usernames, but message text is sent as written. If you linked your Discord account in billing, the AI only receives a one-line summary ("verified customer with N active services and M invoices"), without your email address, name or account ID. AI replies are marked as AI-generated, and staff can take over the ticket at any time. When you ask, the AI can hand the ticket to staff or close it; we store the reason for a hand-off.
• Help articles. Staff can let the AI assistant propose help articles based on past ticket transcripts. A staff member reviews each one. The articles contain no personal data; the AI learning records and the article's link to its source are kept as set out in section 8.
• Giveaways. When you enter a giveaway, we store your Discord user ID and username. We also store the winners and a list of users excluded from giveaways. When a giveaway ends, participants' Discord roles may be checked for bonus entries. Staff sign in to the giveaway dashboard with Discord, using Discord's "identify" permission.
• Staff-ping protection. If you ping a staff member, the bot warns you. Five staff pings within one hour cause an automatic 5-minute timeout in our Discord server. Ping counts are kept in memory only and are not stored. Discord records the timeout in the server's audit log.
• Staff statistics. We keep ticket statistics for our staff members until they leave our Discord server.

Legal basis. Where the EU or UK GDPR applies, we support our customers under our contract with them (Art. 6(1)(b)). We rely on legitimate interests (Art. 6(1)(f)) for the quality of our support, the AI assistant, giveaways and moderating our Discord server. You can object (see section 9).

Your rights. You can ask us to delete your ticket transcripts and giveaway entries by emailing [email protected], subject to section 9.