Privacy policy

Transverto LTD (registration number 16918599), 61 Bridge Street, Kington, HR5 3DJ, United Kingdom operates Hostingsurge.

This policy covers the personal data we process for our own purposes: about you as an account holder, team member, buyer, abuse reporter or visitor of hostingsurge.com. Data that you as a customer put into your own sites, databases and mailboxes we process on your behalf, as a processor, under the data processing agreement at /legal/dpa.

• Account data: email address, name and a hashed password (never stored in plain text); if you choose it, the link to sign-in with GitHub, Google or your company’s SSO.
• Security data: sign-in sessions (time, IP address and browser), two-step verification and an audit log of important account and team events.
• Contact and customer details (part of your account data): your address and country, company details if you register as a company (company name, organization number, VAT number) and, if you give them, your phone number, website and how you heard about us. A new account fills them in before it can be used; you can change them under Settings → Your details. If you buy a .se or .nu domain you also give the name, address, email, phone and personal identity or organization number of its owner; the number is stored encrypted.
• Team data: organizations, members and roles.
• Project data: files, configuration, environment variables (encrypted) and deployment history for your projects.
• AI builder chats: the prompts you send to the AI builder and its replies, kept with the project.
• Logs: build, runtime and request logs needed to run and troubleshoot your service. The request log holds time, method, hostname, path, status and duration, but no IP address, browser or referrer.
• Email content: if you use the email service, our own mail servers handle the content of your mailboxes.
• Orders and invoices: the buyer’s name, address, country, organization and VAT number where given, what was bought, the amount and the payment reference.
• Abuse reports: what you write in the form at /security#report-abuse, and your email address and name if you give them.
• Support: what you write to us.
• Cookies: see /legal/cookies for the full, factual list.

• Creating and running your account, teams and projects, deploying, storing, sending email and showing logs: contract (Article 6(1)(b)).
• The AI builder: contract (Article 6(1)(b)). Prompts and project files are sent to the model only when you use the builder yourself.
• Orders, payments, invoices and bookkeeping, and checking VAT numbers in the EU’s VIES: legal obligation (Article 6(1)(c), the Swedish Bookkeeping Act and VAT Act) and contract (Article 6(1)(b)).
• Security: protection against intrusion, overload and automated sign-ups (per-IP limits, Cloudflare Turnstile), backups, audit logs and troubleshooting: legitimate interest (Article 6(1)(f)) in a secure and available service.
• Support, security and abuse: authorised staff can open an account’s dashboard read only, to see what the account holder sees, and every such view is logged: legitimate interest (Article 6(1)(f)).
• Abuse reports and action against abuse: legitimate interest (Article 6(1)(f)) and, where the law requires it, legal obligation (Article 6(1)(c)).
• Service messages (verification, security notices, orders, uptime alerts): contract (Article 6(1)(b)). We send no marketing email.
• Contact and customer details: contract (Article 6(1)(b)) and, for invoices and bookkeeping, legal obligation (Article 6(1)(c)). Personal identity or organization number when you buy a .se or .nu domain: contract (Article 6(1)(b)), since the domain registry requires it. Knowing how you heard about us: legitimate interest (Article 6(1)(f)) in understanding where our customers come from. The phone number is optional.
• The sign-up waitlist: steps taken at your request before a contract (Article 6(1)(b)).
• Language suggestion and the language cookie: legitimate interest (Article 6(1)(f)) in showing the site in your language.
• How you found us (the address you came from, the first page and campaign words in the link), saved on the account when you sign up: legitimate interest (Article 6(1)(f)) in knowing which channels work. Deleted with the account.
• Establishing, exercising or defending legal claims: legitimate interest (Article 6(1)(f)).

The website suggests a language based on the country you are visiting from. The country is looked up locally on our server from your IP address, without storing the address or sending it to anyone. The language you read the site in, whether you picked it or followed a link in that language, is remembered in the hs_lang cookie (see /legal/cookies) so the next page and the dashboard open in the same language.

The analytics customers see for their sites come from our own proxy, without cookies. No IP address is stored in the analytics: a visitor is counted by a hash whose key changes every day, and the key is deleted the next day and is never in a backup. The proxy’s raw log, which does hold IP addresses, stays on the server for at most two days and never leaves it. That processing is done for the customer, under /legal/dpa.

• Account, teams and projects: for as long as the account or project exists. A deleted project leaves a single backup, kept for 30 days.
• Account deletion: the account is closed at once and, after a 30-day grace period, it is deleted together with the teams you were the only member of. What remains is an anonymized row ("Deleted user") that audit history and bookkeeping refer to.
• Control-database backups (accounts, teams, project settings and encrypted environment variables): these cannot be rewritten, so a deleted user’s rows stay in them until the copies age out. Local copies are kept for 14 days and the point-in-time copy for 7 days. Off-site copies are kept daily for 30 days, weekly for 12 weeks and monthly for 6 months, so for up to about six months. The storage provider keeps removed files for at most 30 more days. The copies are encrypted and used only to restore the platform after an incident.
• Backups of site files, app data, WordPress and customer databases: rewritten every night without the files of deleted projects.
• Backups of email and object storage: on the same schedule, for up to about six months.
• Build and runtime logs: 1 day (Free), 7 days (Pro) or 30 days (Business).
• Visitor analytics: hourly figures for 30 days and daily figures for 13 months, without IP addresses.
• Invoices, credit notes and payments: 7 years after the end of the calendar year in which the financial year ended, as the Swedish Bookkeeping Act requires.
• Unpaid orders: the buyer’s name, address and numbers are erased 90 days after the order was cancelled or expired.
• Security data (sessions and audit log): for as long as the account exists. On deletion the sessions are removed and the audit log is anonymized.
• Abuse reports and support cases: for as long as the case needs and afterwards to be able to show what was done.

A complete, named list of sub-processors and where they are located is at /legal/subprocessors — including where your server hosting, off-site backups, DNS, source code storage, deployment, certificates, email, AI builder model calls and domain registration happen. Everything runs on our own server at OVHcloud in France, email included, except what is listed there.

Other recipients that process data for their own purposes: the Swedish Tax Agency and other authorities where the law requires it, and GitHub or Google if you choose to sign in with them. No data is sold, and there is no third-party tracking or advertising on the platform.

You pay with Bitcoin through a BTCPay Server that we run ourselves on our own server, with no third-party payment provider. We do not take card details, and Stripe is not used. Note that blockchain transactions are public.

Server hosting and off-site backups are within the EU.

Some sub-processors are outside the EU:

• Cloudflare (US): DNS, and the Turnstile human check at sign-up, password reset and the abuse form. Safeguards: the EU–US Data Privacy Framework and the EU standard contractual clauses.
• GitHub (US, Microsoft): source code storage. Safeguards: the EU–US Data Privacy Framework and the EU standard contractual clauses.
• Let’s Encrypt (US, nonprofit): certificates. Receives only domain names, which are published in public certificate logs.
• Dynadot (US): only if you buy a domain through us. Registrant details go to the registrar and the domain’s registry under the rules of the top-level domain.
• DeepSeek in China, which processes the prompts and project files you send to the AI builder. China has no EU adequacy decision. Which Article 46 safeguard (or Article 49 derogation) applies is being settled in the legal review. Do not send the AI builder personal data it does not need.

• Access and portability (Articles 15 and 20): download your data as a file under Settings → Your data. Your project files and versions can be exported at any time from the dashboard.
• Erasure (Article 17): delete your account under Settings → Your data. Where that is not available yet, contact us below and we handle the request. What stays in backups and bookkeeping is set out under Retention.
• Correction (Article 16): you can update your account details directly in the dashboard.
• Restriction (Article 18) and objection (Article 21): you can object to processing based on legitimate interest.
• We answer within one month. We may need to confirm that it is you.
• Complaints: you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se, or with the data protection authority of the EU country where you live or work.

The platform sets only strictly necessary cookies (sign-in, two-step verification, language and selected team) and no analytics or advertising cookies. Nor does the platform add such cookies to customers’ sites (a customer’s own site may set its own). The browser’s session storage also keeps how you found us until the tab closes; it is sent only if you sign up. The full list is at /legal/cookies.

We update this policy when the platform changes, and change the date above. Material changes are announced in the dashboard or by email.

Reach the operator at hello@hostingsurge.com.