Privacy policy

Customer account and registration

Data

e-mail, password (stored only as a one-way hash), first name, last name, phone, billing details (company, company ID, VAT ID, address, country), language, e-mail verification, time and version of acceptance of the Terms

Legal basis

performance of a contract (Art. 6(1)(b) GDPR)

Retention

for as long as the account exists; then the data needed to defend legal claims for another 3 years

Verification of company ID and billing details

Data

company ID, company name and registered address from the public ARES register

Legal basis

performance of a contract; legitimate interest in accurate documents (Art. 6(1)(f) GDPR)

Retention

as for the account

Orders and provision of services

Data

orders, configuration and status of services, IP addresses and service names, access credentials to services (encrypted), history of actions in services

Legal basis

performance of a contract

Retention

for the duration of the contract and 3 years after

Sharing and transfers of services

Data

e-mail of the invited member or transfer recipient, permissions, status of the invitation or transfer

Legal basis

performance of a contract; legitimate interest of the service holder

Retention

for the duration of the service and 3 years after

Game panel, subdomains and DNS

Data

e-mail of the customer and of users the customer added to the server, in the game panel (our own infrastructure), subdomain names (DNS at Cloudflare or on our DNS server) and reverse DNS records (these are public)

Legal basis

performance of a contract; for added users, legitimate interest in operating the service the customer made available to them

Retention

for the duration of the service

Web hosting

Data

website domain, hosting account name, database and SFTP user names, plan and usage (disk space, data transfer); passwords are generated and shown to you only once and are not stored by us (the web hosting server only has their one-way hash); website content, databases and visitor access logs are processed by us as a processor (clause 2.2)

Legal basis

performance of a contract

Retention

for the duration of the contract and 3 years after; website access logs 30 days

txAdmin gateway (FiveM)

Data

the domain you verify for txAdmin, the server port and identifier, a record of verifying and removing the domain; the gateway terminates the encrypted connection and forwards the traffic to the game server, including the logins of your server's administrators, but does not store or log the content; IP addresses are kept only in memory to limit the number of requests

Legal basis

performance of a contract

Retention

settings for the duration of the service; the domain verification record as audit logs; IP addresses only in memory for minutes

Customer API

Data

key name, its public prefix and a one-way hash of the secret part (SHA-256; you see the full key only once), permissions, selected services, allowed IP addresses, expiry, time and IP address of last use; actions performed via the API are recorded as account actions

Legal basis

performance of a contract; legitimate interest in account security

Retention

until the key is deleted or the account is closed; actions as audit logs

Domains (registration, transfer to us, renewal and management)

Data

domain name; holder details that we pass from the billing profile to the registrar and the registry (first name, last name, where applicable company, company ID and VAT ID, address, e-mail, phone), and the first and last name of the person who consented to the registry rules; domain and contact identifiers at the registry, domain status and expiry, name servers, DNS records in the zone on our DNS servers; for a transfer to us the AUTH-ID (stored encrypted)

Legal basis

performance of a contract

Retention

service data for the duration of the contract and 3 years after; the zone on our DNS servers is deleted when the contract ends; the AUTH-ID is deleted after the transfer is completed or rejected or the order is cancelled, at the latest after 60 days; data in the registry is kept by the registry under its own rules

Player management and player graph (Minecraft)

Data

player nicknames you add to the whitelist, operators or bans in the Players tab (for servers with account verification we send them to Mojang to verify the account and look up the UUID); every 5 minutes the number of connected players, without names

Legal basis

performance of a contract

Retention

player lists are in your server; player count measurements 35 days, can be turned off and deleted in the Players tab

Server crash alerts (only if you turn them on)

Data

alert settings, the address of your Discord webhook (stored encrypted), alert history (time, type, exit code, likely cause); server log lines only go into the sent message, after hiding IP addresses, e-mails, tokens and passwords, and we do not store them

Legal basis

performance of a contract (feature at your request)

Retention

settings until turned off or the service is transferred; alert history 12 months

Discord notifications (only if you turn them on)

Data

Discord ID, username, private channel identifier, language and chosen notification topics, content of notifications (service name, type of event, time); when linking we only ask Discord for the account's basic identity and, only if you tick it, for adding you to the StormHost Discord server; we do not keep Discord access tokens

Legal basis

performance of a contract (feature at your request)

Retention

until unlinked in Account settings → Notifications or until the account ends (support can also delete them on request); the link record in the audit log 12 months

Payments

Data

amount, payment method, payment identifier and status at GoPay or PayU, for a recurring payment its identifier; for a bank transfer the variable symbol, amount, payer's name and account number from the bank statement; we do not see card details

Legal basis

performance of a contract; legal obligation (Art. 6(1)(c) GDPR)

Retention

10 years from the end of the year of payment

Invoicing and tax records

Data

billing details, proforma invoices, invoices, corrective documents, payment receipts; for customers with a recurring invoice kept outside the customer account, also an overview of their invoices and payments

Legal basis

legal obligation (Income Tax Act, Tax Code, where applicable the VAT Act and the Accounting Act)

Retention

10 years from the end of the year of issue

Credit

Data

credit movements (top-ups, spending, refunds)

Legal basis

performance of a contract; legal obligation

Retention

for as long as the account exists and then 10 years from the end of the year of the last movement; until then movement records are not changed or deleted (erasure on request is therefore not possible, Art. 17(3)(b) GDPR)

VIP shop (selling perks to players on a game server)

Data

for the shop operator: shop name and address, seller details (name or company, company ID, address, e-mail), acceptance of the terms, commission and settlement; for the player: nickname, e-mail, purchased item, price, status of payment, delivery and refund, consents (time, IP address, browser identification, terms version, language)

Legal basis

for the sale we are the operator's processor (clause 2.2); in our own name performance of the contract with the operator, legal obligation (payments and documents) and legitimate interest in proving the purchase and preventing fraud

Retention

payment and settlement records 10 years from the end of the year of payment; other purchase data and consents for as long as the shop exists and 3 years after

Proof of consents and requests

Data

acceptance of the Terms, confirmation of whether you order as a business, confirmation of a plan deviation, request for immediate start of the service, withdrawal from the contract, consent to recurring payment (incl. the maximum amount), consent to a service transfer, consent to the registry rules for a domain – always with time, IP address, browser identification, document version and language

Legal basis

legitimate interest in proving consent and defending legal claims

Retention

for the duration of the contract and 3 years after; for a recurring payment at least 12 months after it ends

Withdrawal from the contract and refunds

Data

name, e-mail, contract details, text of the statement or request, time of sending, IP address, browser identification, reason (category and optional text), the chosen refund method and consent to it, bank account number and account holder's name (stored encrypted), messages about the request, the decision and its justification, progress of the refund

Legal basis

legal obligation (confirming the withdrawal and refunding under sections 1829 to 1836 of the Civil Code); legitimate interest in proving and defending legal claims; for the reason for withdrawal, legitimate interest in improving the services

Retention

for the duration of the contract and 3 years after; the free text of the withdrawal reason 12 months after sending; the bank account number 90 days after the refund; records of refunded payments and credit as for payments and credit

Handling complaints

Data

name, e-mail, contract and service details, description of the defect and since when it has lasted, the remedy requested, the chosen refund method and consent to it, bank account number and account holder's name (stored encrypted), messages about the complaint, records of the service's operation used for the assessment (monitoring, incidents), the decision and its justification, progress of the refund or service extension

Legal basis

legal obligation (confirming and handling a complaint under section 19 of the Consumer Protection Act, rights for defective performance under the Civil Code); performance of a contract; legitimate interest in proving and defending legal claims

Retention

for the duration of the contract and 3 years after; the bank account number 90 days after the refund; records of refunded payments and credit as for payments and credit

Prevention of abuse of services

Data

records of withdrawals, complaints, refund requests and payments reversed through the bank (chargebacks) and their outcomes; any measure concerning new orders (reason, validity, who decided)

Legal basis

legitimate interest in assessing repeated abuse of services; a person always decides and we do not share the data with anyone outside StormHost

Retention

for the duration of the contract and 3 years after; for the assessment we only use the last 12 months; a measure is valid for at most 12 months

Account and login security

Data

IP address, device type, browser and operating system, network country derived from the IP address, time and method of login, failed attempts, identifier of a known device (stored by us only as a one-way hash); if you turn on two-step verification (2FA), also the secret key for your authenticator app (stored only in encrypted form, AES-256-GCM), backup codes (only as a one-way fingerprint, HMAC-SHA256, so they can't be read from the database), when you turned 2FA on and when you last used a code; if you add a passkey, only its public key, identifier, name, the type of password manager (if known), and when it was added and last used (your fingerprint, face or PIN never reach us, verification happens on your device); account settings show the devices you're signed in on (taken from the sign-in record)

Legal basis

legitimate interest in protecting the account against misuse; for 2FA and passkeys also performance of the contract

Retention

the IP address and device and network data are removed 12 months after the login (known devices are recognised using the last 180 days); the 2FA key and codes are deleted as soon as you turn 2FA off or close your account, a passkey as soon as you remove it or close your account; records relating to an incident being handled until it is resolved

Audit logs and abuse prevention

Data

records of important actions in the account and services (who, when, from which IP address, what changed) and of administrator interventions

Legal basis

legitimate interest in security, traceability and resolving disputes

Retention

routine actions in services (power on and off, files, backups, databases, firewall, restore, crash alerts, webhook deliveries) 12 months; for logins, logouts, failed attempts and password resets the IP address and device data are removed after 12 months; records of orders, payments, credit, consents and transfers for the same period as the related documents; other records (account and security changes, API keys, reinstalls, administrator interventions) for as long as the account exists and 3 years after; relating to an incident or dispute until it is resolved

Account preview by an administrator

Data

who started and ended a preview of your account, when and for what reason; with full access also every action performed; passwords, keys and tokens are never shown in a preview

Legal basis

legitimate interest in support, checking that services work correctly and traceability of interventions

Retention

as audit logs (other records)

Protection of forms and the website

Data

IP address and technical browser data (Cloudflare Turnstile, bot protection), number of requests from an IP address

Legal basis

legitimate interest in protection against bots and attacks

Retention

not stored by us; request counters only in memory for minutes

Leaked password check

Data

when a password is set, we send only the first 5 characters of the password hash to the Pwned Passwords service; neither the password nor the full hash leaves us (not personal data)

Legal basis

legitimate interest in account security

Retention

not stored

Web server logs

Data

IP address, time, page address, browser, result of the request

Legal basis

legitimate interest in security and fixing website errors

Retention

14 days

Error reports from the website and customer account

Data

time, page address without parameters, type of error and a cleaned message (without e-mails, IP addresses, tokens and passwords), identifier of your account, service or order; we do not store the IP address or browser

Legal basis

legitimate interest in detecting and fixing errors

Retention

30 days

Database backups

Data

the data listed above

Legal basis

legitimate interest in recovery after a failure (Art. 32 GDPR)

Retention

14 days, then automatically overwritten

Queries in the tools

Data

queries entered into the tools (IP address, domain, game server address), with the “my IP” option your IP address; for game servers also publicly available data the server itself publishes (e.g. nicknames of players online)

Legal basis

legitimate interest in providing the tool you used

Retention

not stored permanently; server cache for at most 1 hour; for player heads the UUID-to-skin mapping for at most 6 hours, head images and plugin icons (not linked to the visitor) until evicted from the cache

Spark profile analysis

Data

the server profile you submit as a link or file; the analysis result without the profile author's name or UUID and without JVM system properties; the profile code; your IP address only in server memory to limit the number of analyses

Legal basis

legitimate interest in providing the tool you used

Retention

we do not keep the profile itself; analysis result 30 days; profile code at most 24 hours; request counters only in memory for minutes

Communication and support

Data

e-mail, Discord username, content of communication

Legal basis

performance of a contract; legitimate interest in handling the request

Retention

3 years after resolution

Service e-mails

Data

e-mail address, content of messages (confirmation of the contract, documents, login alerts, service status)

Legal basis

performance of a contract; legal obligation; legitimate interest in security

Retention

we do not keep the service e-mails themselves (we only record that a document was issued and sent); copies of correspondence in our mailbox 3 years

Operational notices (maintenance, outages, changes to the Terms and prices)

Data

e-mail and language of the service owner and, depending on the notice, also of members with shared access and game panel users added to the server by the customer; content of the notice; delivery record

Legal basis

performance of a contract (information about the service and changes to the contract); for members and panel users, legitimate interest in informing them about an outage or maintenance of a service they use

Retention

the e-mail in the delivery record and the content of the notice 12 months, for changes to the Terms and prices 3 years

Service status notification subscription (where available on the Status page)

Data

e-mail, language, one-way hash of the confirmation link, time of subscribing and confirming

Legal basis

consent (Art. 6(1)(a) GDPR), which you confirm via the link in the e-mail

Retention

until you unsubscribe via the link in every e-mail (unsubscribing deletes the record); an unconfirmed subscription 48 hours

Internal notifications

Data

notifications about orders, payments, logins, services, errors and refund requests for our operations; e-mails, names, IP addresses and cities in them are masked (e.g. j…@s….cz, 1.2.x.x); for refund requests and complaints we only send the request number, the amount and the reason category (for a complaint, the remedy requested), never the text of the reason, the description of the defect or messages

Legal basis

legitimate interest in operating the services

Retention

until the message is deleted, at most 12 months

Review invitation (clause 3.3)

Data

e-mail address, language, whether a service has been running and paid for at least 21 days; record of sending or declining the invitation

Legal basis

legitimate interest in customer feedback; sending to our own customer under section 7(3) of Czech Act No. 480/2004 Coll.

Retention

record of sending or declining for as long as the account exists (so the invitation is not sent again)

Notices of illegal content

Data

name and e-mail of the notifier, content of the notice, decision

Legal basis

legal obligation (Digital Services Act)

Retention

3 years after resolution

Other legal obligations and defence of legal claims

Data

data needed for a specific proceeding or authority request

Legal basis

legal obligation; legitimate interest

Retention

for the duration of the proceeding

Account, orders and provision of services (including sharing, game panel, web hosting, txAdmin gateway and API)

Legal basis

performance of a contract

Retention

for the duration of the contract and 3 years after

Recipients

Cloudflare (delivery and protection of the website, DNS); Let's Encrypt (only the domain name for a certificate); Mojang (verifying players in the Players tab)

Domains

Legal basis

performance of a contract

Retention

for the duration of the contract and 3 years after

Recipients

WEDOS (registrar); the domain registry

Discord notifications and crash alerts

Legal basis

performance of a contract (at your request)

Retention

until turned off or unlinked

Recipients

Discord

Payments and refunds

Legal basis

performance of a contract; legal obligation

Retention

10 years from the end of the year of payment

Recipients

GoPay (until 23 December 2026); PayU; our bank

Invoicing, tax records and credit

Legal basis

legal obligation

Retention

10 years from the end of the year of issue or last movement

Recipients

Fakturoid; the tax office on request

VIP shop

Legal basis

processing for the operator; in our own name performance of a contract, legal obligation and legitimate interest

Retention

payments 10 years, other data for as long as the shop exists and 3 years after

Recipients

payment gateway; shop operator (seller); e-mail delivery

Consents, withdrawals, complaints and prevention of abuse

Legal basis

legal obligation; legitimate interest

Retention

for the duration of the contract and 3 years after

Recipients

no one outside StormHost (refunds are carried out by the payment gateway or bank)

Account security, audit logs and account preview

Legal basis

legitimate interest; for 2FA and passkeys performance of a contract

Retention

12 months, other records for as long as the account exists and 3 years after

Recipients

Cloudflare (Turnstile); Have I Been Pwned (only an anonymous part of the password hash)

Web server logs, error reports and database backups

Legal basis

legitimate interest

Retention

14 days, 30 days and 14 days

Recipients

no one (our internal Discord channel only gets a summary without personal data)

Free tools

Legal basis

legitimate interest

Retention

not stored, Spark analysis result 30 days

Recipients

internet registries, PeeringDB, DNS resolvers, Mojang

Communication, support, service e-mails and operational notices

Legal basis

performance of a contract; legal obligation; legitimate interest

Retention

3 years after resolution; notices 12 months (changes to the Terms and prices 3 years)

Recipients

Seznam.cz (e-mail delivery); Discord (communication on Discord, notices in the channel)

Service status notification subscription

Legal basis

consent

Retention

until you unsubscribe

Recipients

Seznam.cz (e-mail delivery)

Review invitation

Legal basis

legitimate interest

Retention

for as long as the account exists

Recipients

no one

Notices of illegal content and other legal obligations

Legal basis

legal obligation

Retention

3 years after resolution or for the duration of the proceeding

Recipients

public authorities, only where the law requires it

GOPAY s.r.o. – operator of the GoPay payment gateway (until 23 December 2026)

Role and purpose

processing payments, recurring payments and refunds; an independent controller for payment data

Data

first name, last name, e-mail, address (street, city, postcode, country), amount and order description; you enter card details directly at GoPay

Location

Czech Republic / EU

PayU S.A., ul. Grunwaldzka 186, 60-166 Poznań, Poland, KRS 0000274399 – payment institution

Role and purpose

processing payments by card, Apple Pay, Google Pay and bank transfer and refunds of them; an independent controller for payment data

Data

first name, last name, e-mail, language, IP address, amount and order description; you enter card details directly at PayU

Location

Poland / EU

The bank where we hold the account for bank transfers

Role and purpose

receiving bank transfers and refunds to an account; an independent controller

Data

the data in the payment (payer's name and account number, amount, variable symbol); for refunds the account number and the account holder's name

Location

Czech Republic

Fakturoid s.r.o., company ID 04656679, Prague

Role and purpose

processor – invoicing

Data

billing details, e-mail, items and payments

Location

Czech Republic

Seznam.cz, a.s., company ID 26168685, Prague

Role and purpose

processor – sending e-mails

Data

e-mail address, content of service e-mails and notices

Location

Czech Republic

WEDOS Internet, a.s., company ID 28115708, Hluboká nad Vltavou

Role and purpose

domain registrar – registration, transfer, renewal and management of the domain at the registry (clause 21 of the Terms)

Data

holder details (first name, last name, where applicable company, company ID and VAT ID, address, e-mail, phone), the first and last name of the person who consented to the registry rules, domain name, name servers, for a transfer to us the AUTH-ID

Location

Czech Republic

Domain registries – CZ.NIC, z. s. p. o. (.cz), EURid vzw (.eu) and the registries of the other extensions we sell

Role and purpose

recording the domain and its holder; the registry is an independent controller for the registry data and under its rules may publish some of it in the public domain database (WHOIS / RDAP)

Data

holder details, domain name, name servers

Location

CZ.NIC Czech Republic; EURid Belgium; others depending on the extension, for some extensions outside the EU (clause 7)

Cloudflare, Inc.

Role and purpose

processor – delivery and protection of the website and customer account (CDN, protection against attacks and bots), DNS for the stormhost.eu domain including game server subdomains; for Turnstile partly an independent controller (improving bot detection)

Data

IP address, technical data about the browser and request, Cloudflare cookies, content of customer account pages (encrypted); for subdomains the subdomain name and the server's IP address

Location

USA and global network

Internet Security Research Group (Let's Encrypt)

Role and purpose

issuing a certificate for a web hosting or txAdmin gateway domain; an independent controller

Data

only the domain name; every issued certificate is recorded in the public Certificate Transparency logs

Location

USA

Discord Inc.

Role and purpose

independent controller of the community and support on Discord; we also receive internal notifications via Discord; crash alerts to the webhook you enter and private message notifications you turn on yourself

Data

username and messages on Discord; in internal notifications only masked data (e.g. j…@s….cz, 1.2.x.x); in notifications for you the service name, type and time of the event, for a crash possibly log lines without IP addresses, e-mails, tokens and passwords; never amounts, passwords or account numbers

Location

USA

Internet registries (RIPE NCC, ARIN, APNIC, LACNIC, AFRINIC, top-level domain registries), PeeringDB and public DNS resolvers (Cloudflare, Google, Quad9)

Role and purpose

answers to queries you entered yourself in the free tools: registration of an address, range or domain (RDAP of the registry that manages it), BGP routes in the Looking Glass (RIPE NCC), network operator details (PeeringDB only receives the AS number) and DNS

Data

the IP address, prefix, AS number or domain entered; with the “my IP” option your IP address

Location

RIPE NCC Netherlands; ARIN, PeeringDB, Cloudflare and Google USA; APNIC Australia; LACNIC Uruguay; AFRINIC Mauritius; Quad9 Switzerland; domain registries depending on the domain

Mojang (Microsoft Corporation)

Role and purpose

public Minecraft API – player profile and skin by UUID or nickname (api.minecraftservices.com, api.mojang.com, sessionserver.mojang.com, textures.minecraft.net) for the head image in the Minecraft Status tool, the Minecraft player tool and verifying players in the Players tab; the list of servers blocked by Mojang

Data

UUIDs of players from the server's public list, the nick or UUID entered in the Minecraft player tool and nicknames added in the Players tab; no other data about website visitors

Location

USA

Have I Been Pwned (Pwned Passwords)

Role and purpose

leaked password check

Data

only the first 5 characters of the password hash (anonymous)

Location

worldwide

VIP shop operator (the customer running the shop)

Role and purpose

the seller in the VIP shop; the controller for players' data

Data

player's nickname, purchased item, status of payment and delivery; the player's e-mail only to the extent needed to handle the purchase

Location

depending on the operator

Data centre operator TTC Teleport, Prague

Role and purpose

physical premises, power and connectivity for our servers; has no access to data

Data

–

Location

Czech Republic

Public authorities (courts, Czech Police, Czech Trade Inspection Authority, tax office, Office for Personal Data Protection)

Role and purpose

compliance with legal obligations

Data

depending on the specific request or the law

Location

Czech Republic