Policy version: 2026.08
1-Controller and Contact Method
SecretsHost is the controller of account, billing, and support data and determines the purposes and means of its processing. Privacy requests may be sent through a verified ticket from the Customer Panel or to [email protected].
Where SecretsHost hosts data uploaded by the Customer to a server for the Customer's users, the Customer is responsible for determining the purposes of that data, and SecretsHost processes it only within the scope of providing infrastructure and hosting.
2-Data We Collect
Depending on the service used, we may collect:
- Account data, such as name, email address, mobile number, country, and address.
- Billing data, such as invoices, amounts, currencies, payment status, and transaction identifiers.
- Verification data provided when an order, payment method, or account ownership is reviewed.
- Service data, such as server type, plan, IP address, operating system, and resource status.
- Security and login records, such as IP addresses, timestamps, login attempts, and sessions.
- Support ticket content, attachments, and conversations related to resolving an issue.
- Technical data about the device, browser, cookies, errors, and performance.
SecretsHost does not store full card numbers or security codes where payment is processed directly by an independent payment gateway.
3-How Data Is Collected
We collect data directly when an account is created, an order is placed, an invoice is paid, or a ticket is opened. Certain data may also be collected automatically when the website, Customer Panel, or service is used, including login logs, IP addresses, and essential cookies.
We may receive payment status, transaction identifiers, or verification results from payment gateways. We may also receive abuse reports from data centers, network providers, rights holders, or competent authorities.
4-Purposes of Processing
Data is used to:
- Create and verify accounts and operate requested services.
- Issue invoices, confirm payments, and manage renewals, cancellations, and refunds.
- Provide support, diagnose faults, and communicate about the service.
- Protect accounts and detect fraud, intrusions, and network abuse.
- Measure performance and improve the website, panel, and Customer experience.
- Meet legal obligations and respond to binding requests.
- Send service, billing, security, and important-change notices.
- Send marketing offers where consent or another lawful basis exists, with a way to opt out.
Depending on the circumstances, processing is based on performance of the contract with the Customer, compliance with a legal obligation, protection of a legitimate interest that does not override the Customer's rights, or the Customer's consent.
5-Required and Optional Data
An account cannot be created, an invoice issued, or a service activated without the required core data. Failure to provide additional verification data where a legitimate suspicion exists may prevent completion of the order.
Data used for marketing or surveys is optional where it is not required to provide the service.
6-Payments
Payments are processed through independent gateways or banks subject to their own policies and security requirements. We share only the invoice and transaction data required for processing and receive the payment result without needing to store sensitive card data.
We may retain the transaction identifier, payment method, amount, and refund status for accounting, support, fraud prevention, and legal compliance.
7-Cookies
We use essential cookies to sign users in, protect sessions, and remember language, currency, and display preferences. Limited cookies may also be used to measure performance, detect faults, or prevent abuse.
The browser may block certain cookies, but disabling essential cookies may prevent login, checkout, or use of parts of the Customer Panel.
8-Sharing Data
We do not sell personal data. We may share the minimum necessary data with:
- Payment gateways and banks to process transactions and refunds.
- Data centers and network providers to provide servers, connectivity, and protection.
- Email, notification, support, and platform-operation providers.
- Professional advisers and auditors where needed and subject to appropriate professional duties.
- Competent authorities or authorized parties where disclosure is legally required.
We require parties processing data on our behalf to use it only for the specified purpose and to protect it appropriately.
9-Processing Outside the Kingdom
Certain servers, support systems, or technical infrastructure may be hosted by providers outside the Kingdom of Saudi Arabia depending on the selected data center and service. In such cases, transfers are limited to data necessary to provide the service and are subject to relevant safeguards and legal requirements.
The server region is shown to the Customer where a location option is available. Selecting a data center outside the Kingdom does not mean that Customer account data will be used for purposes unrelated to providing the service.
10-Retention Period
We retain account data throughout the Customer relationship and afterward to the extent necessary to meet accounting and legal obligations, resolve disputes, and prevent fraud.
Server data is deleted after cancellation or termination according to the periods stated in the Terms. Portions may remain in periodic backups, where such backups exist, for a limited period until automatically overwritten and will not be used for any new purpose during that period.
When the purpose ends and no lawful basis for retention remains, data is deleted or anonymized.
11-Data Protection
We apply appropriate technical and organizational controls, including access restrictions, session protection, login-attempt monitoring, security updates, and backups necessary for operational systems.
No electronic method can eliminate every risk. The Customer is responsible for protecting their password, enabling available security measures, and not sending sensitive information in a ticket unless necessary.
If a data incident is likely to harm the rights of data subjects, SecretsHost will take containment and notification measures in accordance with applicable legal requirements.
12-Data Subject Rights
Under applicable law, the data subject has the right to:
- Know the lawful basis for collecting their data and the purpose for which it is used.
- Request access to their data and obtain a copy.
- Request correction, completion, or updating of inaccurate data.
- Request destruction of data for which the purpose has ended, unless a lawful basis for retention exists.
- Withdraw consent where consent is the basis used for processing.
Requests must be submitted through a verified ticket or approved email address. We may request information to verify identity before acting. A deletion request does not cover records that must be retained by law or another person's data.
13-Marketing Messages
Billing, security, and service-change notices are necessary operational messages and are not marketing messages. Marketing offers may be stopped using the included link or by contacting support.
Opting out of marketing does not prevent essential account and service messages.
14-Accounts of Persons Lacking Full Legal Capacity
The services are intended for persons who have the legal capacity to contract. If an account is created by a person lacking full legal capacity, it must be under the responsibility and approval of their lawful representative.
15-Changes to This Policy
This Policy may be updated when services, suppliers, or legal requirements change. The version date will appear at the top of the page, and material changes will be communicated through appropriate means.