Privacy and cookies

Last updated 14 October 2026

This explains what personal information VPS GB collects, why, who else handles it, how long we keep it, and your rights. It covers this website, the customer dashboard, and the services you order through it.

Who we are

VPS GB, London, United Kingdom, is responsible for your personal information (the "controller" under UK data protection law). For anything about your data, email [email protected].

What we collect and why

Your account

When you sign up we collect your name, email address, phone number, postal address and country, and a password. We store your password only as a one-way hash, so nobody here can read it. We use these to create and run your account, contact you about it, and invoice you. Legal basis: contract.

We confirm your email address with a link that expires after 48 hours, and password reset links expire after 1 hour.

Security and abuse prevention

We record the IP address you signed up from, and keep logs of sign-ins and account activity, to protect your account and our systems and to investigate abuse. We limit repeated failed sign-in attempts by IP address. Legal basis: legitimate interests (keeping accounts and services secure).

If you turn on two-step verification we store your authenticator secret, one-way hashes of your backup codes, and the public part of any passkey you register; never anything that could be used to sign in as you on its own. If you tick "remember this device", we store a one-way hash of a random token for 30 days (see cookies). Changing your password, resetting it, or turning two-step verification off forgets every remembered device.

Billing and payments

We keep invoices, payment records and the services each relates to. Card payments are taken by Stripe: you type your card details into Stripe's own form on our page, so your full card number never reaches us. We see only what Stripe tells us, such as the card brand, last four digits and expiry date, so we can show you which card is on file and remind you before it expires. Legal basis: contract, and legal obligation (keeping financial records).

The services you run with us

Websites, servers, files and anything else you put on a service you buy from us are yours. We process them only to provide that service, keep it running and secure, and back it up where your service includes backups. We do not look through them or use them for anything else.

If you order an SSL certificate, the details you enter for it (such as the domain, organisation and contact details) go to our certificate supplier and the certificate authority so they can validate and issue it. Publicly trusted certificates, and the domain names in them, are published in public Certificate Transparency logs by design; this is how certificates work for everyone, not a choice we make.

Support

If you contact us, by email, the "Get help" form in your account, or the contact form on our homepage, we use what you send us to answer you. The "Get help" form also includes, so you don't have to type them: your name, email and phone number from your account, the reference and type of the service you choose, and which browser you are using. It shows you that list before you send. Messages reach our support inbox by email; we don't use a live chat service. Legal basis: legitimate interests (answering your question), or contract where it is about a service you have with us.

Status updates (only if you choose to)

You can turn on status update emails from your account page or /status-updates. If you do, we record that you asked, and email the address on your account when we post a notice on our status page or schedule maintenance. Every email has a link that turns them off without signing in, and you can turn them off from your account at any time. Legal basis: consent.

Discord (only if you choose to)

You can link your Discord account from your account page. If you do, we store your Discord user ID so we can give you the roles that match your services on our Discord server. You can unlink it there at any time. Legal basis: consent.

What we don't do

We don't sell your information, use it for advertising, or run analytics or tracking on this website. We don't make decisions with legal or similarly significant effects about you by automated means alone.

Who else handles it

Our hosting platform, billing system, monitoring and logs run on our own infrastructure in the United Kingdom. We use these providers for specific jobs, and they only get what that job needs:

• Cloudflare: every visit to our website passes through Cloudflare's network, which protects it from attacks. Cloudflare also runs the "are you human" check on our sign-in and sign-up forms, and the DNS records we create for your servers' hostnames.
• Google Fonts: our website's typeface is loaded from Google's servers, so your browser connects to Google, which receives your IP address. No cookies are set.
• Stripe: card payments.
• Mailgun, in its EU region: sends our account and service emails, and delivers support and contact-form messages to our support inbox.
• TheSSLStore and the certificate authority it uses: only if you order an SSL certificate.
• Discord: only if you link your account.

Some of these providers may process data outside the UK. Where they do, we rely on the safeguards available under UK data protection law, such as UK adequacy regulations or the International Data Transfer Agreement or Addendum.

We may also share information where the law requires it, or to protect our customers or our services from fraud or abuse.

How long we keep it

• Your account: for as long as you have it. Ask us to close it and we will delete what we don't need to keep.
• Invoices and payment records: for as long as UK tax law requires, normally six years.
• Activity and security logs: deleted from the website's own database after 36 hours; copies in our monitoring system are kept for a limited period for security and troubleshooting.
• Remembered devices: 30 days, or until you change your password or turn off two-step verification.
• Data on your services: until you delete it or the service ends; backups expire on their own schedule after that.

Your rights

You can ask us for a copy of your personal information, and to correct, delete or restrict it, to object to how we use it, or to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Email [email protected]; we may need to confirm it's you before acting, and we'll reply within one month.

If you're unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Cookies and similar storage

We only store things on your device that are needed for something you've asked for: signing in, staying secure, or remembering a choice you made. We don't use advertising or analytics cookies, so there is no cookie banner to accept or decline.

You can block or delete cookies in your browser settings. If you block the ones we set, you won't be able to sign in.

Changes to this notice

We'll update this page when what we collect or who handles it changes, and change the date at the top.