Privacy Policy
Last updated: October 4, 2026
The short version: we collect only what we need to run your account and bill you. We don't sell your data, and we don't use advertising or analytics trackers. We never see your full card number, since the payment providers handle that. You can ask us to see, fix or delete your data at any time.
1. Who we are
Erupted Hosting LLC ("Erupted Hosting", "we", "us") is a United States company that provides VPS, game server and Discord bot hosting. This policy explains what personal information we collect through our website and services, what we do with it, and your choices. For data protection purposes we are the "controller" of the information described here. You can contact us at [email protected].
2. Information we collect
Information you give us
| When | What we collect |
|---|---|
| You create an account | Your name, email address and password. Your password is stored only as a salted hash, so we cannot read it. |
| You turn on two-factor login | The secret your authenticator app uses to make codes, stored encrypted, and ten one-time recovery codes, stored only as hashes so we cannot read them. Your sign-in history records when a code was used or got wrong. |
| You sign up or log in with Discord | Your Discord user ID and username, which Discord sends us after you approve. We ask Discord only for your basic profile, not your email address. We never receive your Discord password, and we can't read your messages or servers. |
| You give us a billing email | The email address you enter for your account, invoices and payment alerts. We email it a one-time link to confirm it belongs to you. We keep a record of that request (a hash of the link, not the link itself) for up to 30 days. |
| You give us billing details | Before your first purchase: your full legal name, billing address and phone number, and optionally your company name and tax or VAT ID. We use them on invoices and for tax records, fraud and chargeback prevention, and checking we are allowed to serve you. We do not pass your address or phone number to our payment providers. |
| You agree to our terms and place an order | Which version of our Terms of Service and Privacy Policy you agreed to, when, and the IP address you were using. We record the same, and the IP address, when you place an order, as evidence of what was agreed. Each invoice also keeps a copy of the billing name and address it was issued to. |
| You order and pay | The plans you order, and your invoices and payment records: invoice number, amount, dates, status, which payment method you used, and the reference the payment provider gives us. We do not receive or store your full card number or PayPal login. |
| You use a promo or referral code | Which code you used and the discount it gave. If it was another customer's referral code, we record that they referred you, and that customer sees your account name and whether they earned credit for it. If you share your own referral code, we record who used it. We also keep a line-by-line record of any account credit you earn or spend. |
| We set up your service | The details needed to run it, such as the IP address and login information we add to your dashboard. |
| You write a review | Customers who have paid for a service can write one review: a star rating, an optional headline and text, and the display name you choose. Once approved, the review, that name, the month, and which kind of service you use are shown publicly on our website. We never show your email address or account details. We also keep the time you agreed to it being shown. You can edit or delete your review at any time from your account, and we can remove one that breaks our rules. |
| You upload an image to image hosting | The image itself, and its file name, type, size and dimensions. The image is public: anyone who has its address can see it, with no login. It is stored exactly as you uploaded it, so anything saved inside the file (a photo can carry the place and time it was taken) is part of what is public. It is deleted when you delete it or delete your account. |
| You open a support ticket | The subject and messages you write, the topic and service you choose, any images you attach, a log of who did what on the ticket and when (opened, replied, closed), and the star rating and comment you may leave once it is closed. Images are stored privately: they are shown only to you and our support team, never on a public web address. Photos can contain hidden data such as the place they were taken, and we do not remove it, so please think before you upload a photo rather than a screenshot. Please never put passwords or card numbers in a ticket. |
| You cancel a service | The reason you pick and any comment you add, along with the plan, its price and how long you had it. |
| You choose which messages you get | Your choices, for each kind of message, by email and by Discord. |
| You contact us | The name, email address, product of interest and message you send through our contact form, and anything you tell us in a support conversation. |
Information collected automatically
- Session cookie. When you log in we set a cookie that keeps you signed in (see the section on cookies).
- Where your account was created. The IP address you created your account from. We use it to limit how many accounts one network can open, and to stop referral rewards being claimed by the person who gave them.
- Sign-ins and devices. Each time you sign in, or a sign-in to your account fails, we record the time, how you signed in, the IP address and the browser's identification string. We keep the last 100. We also keep a list of the devices that are signed in now, with the same details and when each was last active. You can see both, and sign a device out, under Devices & activity on the Account page.
- Technical data. Like any website, our servers receive your IP address and basic browser information with every request. We use it to protect the site, for example to limit repeated login attempts, and our web server keeps access and error logs that include it.
Notes our team keeps
Our support team may keep short internal notes on your account, for example about a billing arrangement or a problem we fixed for you. They are not shown in your account or in the file you can download, but you can ask us for a copy.
What's on your servers
The files, software and data you place on your VPS, game server or bot are yours. We do not routinely access them. See our Terms of Service for the limited cases when we might.
What we don't collect
We don't run advertising trackers or third-party analytics on our website, and we don't build advertising profiles.
3. How we use it
- To create and manage your account and log you in.
- To process orders, issue invoices, confirm payments and keep billing records.
- To set up, run, secure and support your services.
- To reply to your messages and support requests, and to contact you about your account, invoices and service changes.
- To tell you about changes and news to do with our services. You can turn these announcements off with the unsubscribe link in any of them, or under Notifications on the Account page.
- To run our referral programme and keep track of account credit.
- To understand why customers leave, from the reasons given when a service is cancelled.
- To detect, investigate and prevent fraud, abuse, attacks and breaches of our Terms.
- To comply with laws that limit who we can provide services to, such as sanctions and export rules.
- To meet legal, tax and accounting obligations and to handle disputes.
We don't use your information to make automated decisions that have legal or similarly significant effects on you.
4. Legal bases
If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:
- Contract: to create your account, take orders and provide the services you buy.
- Legitimate interests: to keep our services secure, prevent fraud and abuse, and respond to enquiries, balanced against your rights.
- Legal obligation: to keep financial records and respond to lawful requests.
- Consent: where we ask for it, which you can withdraw at any time.
5. Who we share it with
We don't sell your personal information. We share it only with:
| Who | Why, and what they receive |
|---|---|
| Stripe | Card payments. Stripe collects your card details directly on its own page. We send it your email address, the invoice amount and description. Stripe's privacy policy applies. |
| PayPal | PayPal payments. We send the invoice amount and description; PayPal already knows who you are through your PayPal account. PayPal's privacy statement applies. |
| Discord | Sign-in. Discord learns that you are signing in to Erupted Hosting, and sends us the details listed above once you approve. Messages to you. If you link Discord and are a member of our Discord server, our bot can send you direct messages about invoices, payments, your services, support replies, referral credit and announcements. They carry things like invoice numbers, amounts, plan names and the subject of a ticket, never the text of a support reply or your logins. You can turn each kind off under Notifications on the Account page. Alerts to our team. We use a private Discord channel to alert our team so we can respond quickly. An alert can include your name, the subject and text of a support ticket message you send, a comment you leave when rating a ticket, and the text of a review you submit. It never includes your email address, payment details or server logins. Discord's privacy policy applies to what it does with your information. |
| Our email provider | The service that delivers our emails: confirmation links, invoice notices, payment receipts and overdue notices. It receives your email address, your name and the text of each message. |
| Infrastructure providers | Companies that host our servers, network and backups, and only so far as needed to run our services. |
| Authorities and advisers | Law enforcement, courts, regulators or professional advisers, when we are legally required to or need to protect our rights, our customers or the public. |
| A future owner | If we sell or reorganize the business, your information may be transferred to the new owner, who must honor this policy. |
6. Cookies and similar technology
We use three essential cookies, and none of them can be read by scripts on the page. erupted_session keeps you logged in and expires after 7 days or when you log out. erupted_oauth exists for at most 10 minutes while you sign in with Discord, to make sure the sign-in you finish is the one you started. erupted_2fa exists for at most 5 minutes after you enter your password, while we wait for your two-factor code. We don't use advertising or analytics cookies.
Our pages also keep a few things in your browser's own storage: whether you chose the light or dark theme, that you closed the cookie notice or an announcement, and a referral code from a link you followed (until your first payment). Until you close the tab, they also keep small things that make pages load smoothly, such as your name for the menu and a support message you have not sent yet.
Because these cookies and stored items are strictly necessary to provide what you ask for, we don't ask for consent to set them.
Our website does not respond to "Do Not Track" browser signals, because we don't track visitors across other websites.
Payment providers set their own cookies on their own pages when you pay. Those are governed by their policies.
7. How long we keep it
| Information | How long |
|---|---|
| Account details | While your account is open. If you delete it (or ask us to), we remove your personal details and anonymize the account straight away, except for the records described in the rows below. What we remove includes the IP address the account was created from, your sign-in history, our team's notes about you, and any comment you wrote when cancelling a service (the reason you picked stays as a statistic). We also keep a short record that an account was deleted, without your name or email. |
| Billing details and records of the Terms you agreed to | While your account is open. Details that appear on invoices, and the record of what you agreed to at each purchase, are kept for up to 7 years afterwards because tax, accounting and dispute rules require it. |
| Orders, invoices and payment records | Up to 7 years after the transaction, because tax and accounting rules require us to keep them. This is so even if you delete your account. An order keeps the plan and its price, the name you gave the service, the setup and login details we added to it (stored encrypted), and the IP address it was placed from. |
| Promo code, referral and account credit records | Kept with your billing records for up to 7 years, because they explain what an invoice charged. |
| Sign-in history and signed-in devices | Your last 100 sign-ins. A device stays on the list until about a day after its sign-in ends. |
| Reviews | Until you delete them (you can at any time) or your account is closed. A review that has been shown publicly may remain in search engine caches or archives for a while after we remove it. |
| Support tickets, their messages and attached images | While your account is open, and for a limited time afterwards, because we may need them to handle a dispute or a billing question. You can ask us to delete a ticket and its images at any time; we will, except where we must keep a record. Images you upload but never send are deleted automatically after 24 hours. |
| Contact form messages | Until we have dealt with them, then up to 12 months, after which they are deleted automatically. |
| Server data (your files and databases) | Deleted when a service is cancelled or terminated. Copies in backups are removed within 30 days after that. |
| Backups of our own database | Each backup is kept for up to 30 days, so something you delete can remain in a backup for that long before it is gone for good. |
| Our log of staff actions | A record of sensitive things our team does, such as changing a role, resetting two-factor login, adjusting account credit or deleting a ticket. An entry can name the account it was about, including the email address that account had at the time. It is kept as a security record and is not removed when you delete your account. |
| Security and access logs | Kept only as long as needed for security and troubleshooting. |
8. Security
We protect your information with measures such as hashed passwords, encrypted connections, limits on repeated login attempts, and restricted access to our systems. Inside our team, access to customer information is limited by role, so people see only what their job needs, and sensitive actions are logged. No system is completely secure, so we can't guarantee absolute security. If a breach affects your personal information, we will tell you and the relevant authorities where the law requires. Please use a strong, unique password.
9. Your rights and choices
Depending on where you live (for example under the EU or UK GDPR, or California law), you may have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct information that is wrong or incomplete;
- ask us to delete your information (we may have to keep some records, such as invoices, for legal reasons);
- ask us to restrict or stop certain uses of your information, or object to them;
- receive your information in a portable format;
- withdraw consent where we rely on it; and
- complain to your local data protection authority.
You can do most of these yourself from the Account page once you are signed in: change your name, email address, password and billing details; download a copy of your data as a file; and delete your account. Deleting your account removes your name, email, billing details, support conversations and images, review, sign-in history and our team's notes, and signs you out for good. Invoices, payments and the orders they belong to are kept (with the billing name and address they were issued to, and no longer connected to a login) for the tax and accounting reasons described above. So are the details saved on each order, and any entry in our log of staff actions that mentions your email address: see How long we keep it.
For anything else, or if you cannot sign in, email [email protected] from the address on your account. We may need to verify who you are, and we aim to respond within 30 days. We won't treat you differently for using your rights. We don't sell or "share" personal information for cross-context behavioral advertising.
10. International transfers
We are based in the United States, and our service providers may process information in the United States and other countries. If you use our services from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live. Where we transfer information from the EEA or UK, we rely on appropriate safeguards such as standard contractual clauses or an adequacy decision, as applicable.
11. Children
Our services are for people aged 18 and over. We don't knowingly collect personal information from anyone under 18. If you believe a child has given us information, contact us and we will delete it.
12. Changes to this policy
We may update this policy from time to time. When we make a material change we will post the new version here with a new "Last updated" date and, where appropriate, tell you through your account or by email.
13. Contact
Questions or requests about your privacy? Email [email protected], or write to Erupted Hosting LLC, 6545 Market Ave. North, Ste 100, Canton, OH 44721, United States.