Privacy & GDPR

Last updated 2026-06-14.

This notice explains what personal data we process under the EU GDPR and how. We keep data collection to the minimum needed to run the Service.

1. What we collect

• Account data: a generated api_key, account id, tier, timestamps.
• Phone number (optional): only if you verify one, to prevent abuse and to notify you about your hosting. Verification is performed via Twilio.
• Payment data: handled by Stripe. We do not store card numbers; we store your prepaid credit balance and a transaction ledger.
• Usage & technical data: resource metering (RAM-hours, egress, disk), server state, IP address of API requests (for rate-limiting and abuse prevention).
• Your server content: whatever you put on your server. We don't inspect it except as needed for security/abuse handling or legal compliance.
• Feedback: messages you send to /feedback, plus an email if you choose to include one.

2. Why (purposes & legal basis)

• Providing the Service and billing — performance of contract.
• Abuse prevention, security, rate-limiting — legitimate interests.
• Phone verification & service notifications — legitimate interests / your consent.
• Legal and accounting obligations — legal obligation.

3. Your phone number — our promise

We will never sell or share your phone number. It is used only to verify your identity and to inform you about your hosting (e.g. low resources). Every SMS includes an opt-out; opting out stops notifications.

4. Processors we use

• Hetzner (Germany) — server infrastructure.
• Cloudflare — DNS.
• Stripe — payments.
• Twilio — SMS verification & notifications.

These act as processors/sub-processors under appropriate safeguards.

5. Retention

We keep account, billing and ledger data while your account is active and as required for accounting/legal purposes. Server content is retained until you delete the server or it is removed per the Terms. Feedback is kept to improve the Service.

6. Your rights

Under the GDPR you may request access, rectification, erasure, restriction, portability, and object to processing. You may withdraw consent (e.g. SMS opt-out) at any time. To exercise any right, contact us via the feedback form on thevibehosting.com. You also have the right to lodge a complaint with the Czech Data Protection Authority (ÚOOÚ).

7. Security

Servers run in isolated, sandboxed containers with hard limits. We apply reasonable technical measures, but no system is perfectly secure — keep your own backups and secrets safe.

8. Changes

We may update this notice; the latest version is always at this URL.

Data controller: The Vibe Hosting (sole operator), Czech Republic. Contact: via the feedback form on thevibehosting.com.