Privacy & GDPR

Last updated 2026-10-18.

This notice explains what personal data we process under the EU GDPR and how. We keep data collection to the minimum needed to run the Service.

1. What we collect

• Account data: a generated api_key, account id, tier, timestamps.
• Phone number (optional): only if you verify one, to prevent abuse and to notify you about your hosting. Verification is performed via Twilio.
• Payment data: handled by Stripe. We do not store card numbers; we store your prepaid credit balance and a transaction ledger.
• Usage & technical data: resource metering (RAM-hours, egress, disk), server state, IP address of API requests (for rate-limiting and abuse prevention).
• Your server content: whatever you put on your server. We don't inspect it except as needed for security/abuse handling or legal compliance.
• Feedback: messages you send to /feedback, plus an email if you choose to include one.
• Website analytics: when you browse thevibehosting.com pages (not your servers or the API), Google Analytics, the Meta Pixel and the Reddit Pixel measure page views and which ads brought you. They set cookies and receive your IP address and browser details.

2. Why (purposes & legal basis)

• Providing the Service and billing — performance of contract.
• Abuse prevention, security, rate-limiting — legitimate interests.
• Phone verification & service notifications — legitimate interests / your consent.
• Legal and accounting obligations — legal obligation.
• Website analytics and ad measurement — your consent.

3. Your phone number — our promise

We will never sell or share your phone number. It is used only to verify your identity and to inform you about your hosting (e.g. low resources). Every SMS includes an opt-out; opting out stops notifications.

4. Processors we use

• Hetzner (Germany) — server infrastructure and encrypted off-site backups (EU).
• Google (Analytics), Meta (Pixel), Reddit (Pixel) — website analytics and ad measurement; these may transfer data outside the EU under the EU–US Data Privacy Framework / standard contractual clauses.
• Cloudflare — DNS.
• Stripe — payments.
• Twilio — SMS verification & notifications.

These act as processors/sub-processors under appropriate safeguards.

5. Retention

We keep account, billing and ledger data while your account is active and as required for accounting/legal purposes. Server content is retained until you delete the server or it is removed per the Terms; daily encrypted backups are kept up to 6 months (14 daily, 8 weekly, 6 monthly), so deleted data disappears from backups as they age out. Feedback is kept to improve the Service.

6. Your rights

Under the GDPR you may request access, rectification, erasure, restriction, portability, and object to processing. You may withdraw consent (e.g. SMS opt-out) at any time. To exercise any right, email hello@thevibehosting.com (or use the feedback form on thevibehosting.com). You also have the right to lodge a complaint with the Czech Data Protection Authority (ÚOOÚ).

7. Security

Servers run in isolated, sandboxed containers with hard limits. We apply reasonable technical measures, but no system is perfectly secure — keep your own backups and secrets safe.

8. Changes

We may update this notice; the latest version is always at this URL.

Data controller: The Vibe Hosting, operated by @LadaHrbacek, Czech Republic. Contact: hello@thevibehosting.com · contact page.