1.0 Scope & Data Controller
1.1 This Privacy Policy explains how HostWave ("HostWave", "we", "us") collects, uses and protects personal data when you visit this website (hostwave.cloud), use our client portal at my.hostwave.cloud, or purchase and use our hosting services.
1.2 HostWave is the data controller for the personal data described in this policy and processes it in accordance with the EU General Data Protection Regulation (GDPR) and applicable local data protection law.
1.3 Our client portal and billing system run on software we host and operate ourselves. Data you enter in the client portal is processed on our own infrastructure and is not shared with the software vendor.
1.4 This policy does not cover data that you or your users store on services you purchase from us (websites, virtual servers, storage). For that data you act as the data controller and we act solely as a hosting provider processing it on your instructions.
2.0 Data Collected by This Website
2.1 Server and security logs. When you visit hostwave.cloud, our web servers and our CDN / DDoS-protection provider automatically record technical data such as your IP address, browser user agent, the pages requested, referring page and timestamps. We use these logs exclusively to keep the website secure, prevent abuse and diagnose technical problems.
2.2 Browser preferences. Your light/dark theme preference is stored in your browser's localStorage. It never leaves your device, is not transmitted to us and cannot be used to track you.
2.3 Self-hosted analytics. We may use a self-hosted, cookieless analytics platform to understand how our website is used. It sets no cookies, stores nothing on your device and does not follow you across other websites; data is used only in aggregate and is never shared with third parties. We do not use third-party analytics, advertising pixels, fingerprinting or tracking cookies.
2.4 Embedded resources. Some pages may load resources from third parties (for example web fonts). When your browser fetches these resources, your IP address and user agent are disclosed to the respective provider.
3.0 Data Collected via the Client Portal
3.1 Account information. When you register or place an order at my.hostwave.cloud, we collect the details needed to create and manage your account: your name, company name (if applicable), postal address, country, email address, phone number, and a password (stored only in hashed form).
3.2 Technical and usage data. The portal records the IP addresses and timestamps of logins and orders and uses session cookies to keep you signed in securely. This information helps us secure accounts, investigate unauthorized access and screen orders for fraud.
3.3 Billing records. We keep records of your orders, services, invoices, transactions, account credits and applicable taxes for the duration required by accounting law.
3.4 Support communications. When you open a support ticket or email us, we store the correspondence and any attachments you provide so we can resolve your request and reference past issues.
4.0 Payment Information
4.1 Card and PayPal payments are processed by external payment gateways. Your full card number or PayPal credentials are submitted directly to the processor and never touch our servers; we receive only a payment confirmation and a transaction reference.
4.2 Cryptocurrency payments are processed through blockchain payment gateways. We store the transaction reference associated with your invoice. Blockchain transactions are public and immutable by design.
4.3 Order details, including your IP address and billing information, may be screened against fraud-prevention checks before a service is activated. Orders flagged as high-risk may be reviewed manually.
5.0 How We Use Data & Legal Bases
5.1 Performance of a contract (Art. 6(1)(b) GDPR): we process your account, billing and support data to provision the services you order, collect payment and provide technical support.
5.2 Legal obligations (Art. 6(1)(c) GDPR): we retain invoicing and transaction records to comply with bookkeeping and tax legislation.
5.3 Legitimate interests (Art. 6(1)(f) GDPR): we process log and technical data to secure our network, prevent fraud and abuse, maintain service quality and measure aggregate website usage. You may object to processing based on legitimate interests at any time.
5.4 Consent (Art. 6(1)(a) GDPR): where we rely on consent — for example for optional product announcements — you can withdraw it at any time without affecting the lawfulness of prior processing.
5.5 We do not sell personal data and we do not use automated decision-making that produces legal or similarly significant effects on you.
6.0 Sharing & International Transfers
6.1 Infrastructure providers. Our services run in datacenters in Germany, the United States and Luxembourg. Technical data necessary to operate your services resides in the location associated with the service you purchase.
6.2 Our CDN and DDoS-protection provider processes website traffic (including visitor IP addresses) to deliver this website and protect it against attacks.
6.3 Payment processors receive the data required to complete your payment, as described in Section 4.
6.4 Authorities. We disclose personal data to law enforcement or other authorities only where legally required.
6.5 Where personal data is transferred outside the European Economic Area, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or the provider's certification under the EU–US Data Privacy Framework.
7.0 Cookies & Local Storage
7.1 The hostwave.cloud website itself sets no tracking cookies. Your theme preference is kept in localStorage, which stores data only on your device; it is functional, is never sent to our servers and is not used for tracking.
7.2 The client portal at my.hostwave.cloud sets strictly necessary session cookies used to keep you logged in and to protect forms against cross-site request forgery. These cookies are essential for the portal to function and are deleted or invalidated when your session ends.
7.3 We do not set third-party advertising cookies and we do not participate in cross-site tracking. Because we use only strictly necessary cookies and functional localStorage, no cookie consent banner is required.
8.0 Data Retention
8.1 Account information is retained for as long as your account exists. When you close your account, personal data is deleted or anonymized unless a legal obligation requires longer retention.
8.2 Invoices and transaction records are retained for the period required by applicable bookkeeping and tax law.
8.3 Server and security logs are kept for a short, rolling period — typically no more than 90 days — unless a specific security incident requires longer preservation.
8.4 Support tickets are retained while your account is active and removed together with your account data upon closure.
9.0 Your Rights
9.1 Under the GDPR you have the right to access the personal data we hold about you, to have inaccurate data rectified, to request erasure, to restrict processing, to receive your data in a portable format, and to object to processing based on our legitimate interests.
9.2 Where processing is based on consent, you have the right to withdraw that consent at any time.
9.3 To exercise any of these rights, open a support ticket via the client portal at my.hostwave.cloud. We may need to verify your identity and will respond within one month as required by the GDPR.
9.4 If you believe our processing infringes data protection law, you have the right to lodge a complaint with the supervisory authority in your EU member state of residence.
10.0 Security, Changes & Contact
10.1 We protect personal data with technical and organizational measures appropriate to the risk, including TLS encryption for all connections, hashed password storage, isolation between customer environments, access controls and timely security patching.
10.2 In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, affected users, in accordance with Articles 33 and 34 GDPR.
10.3 We may update this Privacy Policy from time to time. Changes take effect when posted on this page and the "Last Updated" date will be revised accordingly. Material changes will be announced via the client portal or email.
10.4 For questions about this policy or how we handle your data, contact us at privacy@hostwave.cloud or open a support ticket in the client area.