Carbon Hosting Privacy Policy
Document date: 2026-10-16
Version date: 2026-10-16
About this policy
This policy explains what personal data the Carbon Hosting service processes, why it is processed, how long it is kept, and what rights you have.
Who is responsible (the controller): the operator behind the trade name Carbon Hosting is the controller of your personal data (the party responsible for it under data protection law where that law applies), exactly as defined in the Terms of Service under Operator and governing law (clause 2.13). This policy states no company name and no legal form: who the operator is follows that clause of the Terms of Service.
How to reach the operator about this policy: through the support ticket system in the client area. The support ticket system is the official contact channel for support, privacy requests, and billing questions.
What this policy covers: the Carbon Hosting website, the client area, the server panel, checkout, and the hosted servers.
What data the service processes
The service processes the categories of data described below.
Account data. The registration details you provide in the client area (for example your email address and account settings) and the login method you use: email plus password, or third-party account login where used.
Third-party account login data (where used). When you sign in through a third-party account service, the operator links your login by that provider's user identifier and the email address that provider confirms. That is all this policy describes for third-party account login.
Billing and order data. The order, plan, billing cycle, add-on, invoice, and payment status records created for your orders.
Payment data. Payments are processed by our payment processor. Our payment processor handles your payment card details directly when you pay; this policy does not claim that the operator holds your card details. The operator receives payment status records (for example that an invoice was paid or failed) needed to operate the service. Refunds and payment disputes work through the payment provider exactly as the Terms of Service refund chapter provides.
Server content. The content you store on your rented server (worlds, files, configurations) and its backups, stored on the platform.
Support records. Your support tickets (including the server a ticket concerns) and the emails you send or receive.
Server and access logs. Technical logs the platform keeps to run and secure the service.
Cookies. As described in the Carbon Hosting cookie notice, which is part of these legal documents.
Why we process data
Where the GDPR (Regulation (EU) 2016/679) applies, we process personal data on these bases:
- To perform our contract with you: delivering the rented server, billing, renewals, support, and the suspension, cancellation, and deletion mechanics, exactly as the Terms of Service provide.
- In our legitimate interests: keeping the service secure, preventing abuse, and keeping the records that keep the service running.
- Where a legal obligation applies.
- Where we ask for your consent: for example for any future non-essential cookies.
Personal data is not used to build advertising profiles, we do not sell personal data, and we do not run cross-context behavioral advertising.
How long data is kept
The table below states what happens to each category of data and where the rule comes from.
| Data | What happens | Where the rule comes from |
|---|---|---|
| Server content and backups on a non-payment suspension | Suspension happens immediately at the payment failure itself, with no grace period; the server is deleted 7 days after suspension; deletion removes the server and all of its backups; deleted data and backups are irrecoverable. | Terms clause 2.9 |
| Server content and backups after self-serve cancellation | Your server keeps running until the end of the period you already paid for; your world and server data are kept for 7 days after the paid period ends, then they are deleted and cannot be recovered. | Terms clause 2.10 |
| Server content and backups after a termination for cause | When the operator terminates the account for cause under the Terms of Service, the server ends and the client is informed of the action and the reason; the server's data is kept for 7 days after the termination, then it is deleted and cannot be recovered. No refund is owed on a termination for cause. | Terms of Service Termination chapter and a board decision (2026-10-16) |
| Data | What happens | Where the rule comes from |
|---|---|---|
| All server data including backups on a chargeback | When a payment dispute arrives, all of that client's servers are automatically suspended at once and the account is disabled; for 7 days the client may only download (export) their servers; after those 7 days all of that client's servers are deleted, including all backups, irrecoverably; after that deletion the client is permanently banned from purchasing any new servers. | Terms clause 2.11 |
| Billing and invoice records | Kept for 7 years. | Board decision (2026-10-16) |
| Support tickets and emails | Kept for 7 years. | Board decision (2026-10-16) |
| Server and access logs | Kept for 7 years. | Board decision (2026-10-16) |
| Email records | Kept for 7 years. | Board decision (2026-10-16) |
| Account data | Kept for as long as your account is active; on a verified deletion request, account data is deleted within 30 days and removed from backups within the next scheduled backup cycle. | Your choices and rights (below) and a board decision (2026-10-16) |
Your choices and rights
EU, EEA, and UK. Where Regulation (EU) 2016/679 (the GDPR) applies, you have the rights the regulation gives you. In plain words, these include the right to be informed about how your data is used, to get access to your data, to have inaccurate data corrected, to have your data erased, to restrict how your data is processed, to object to processing, to receive your data in a portable form, to withdraw consent where processing rests on consent, and to complain to a supervisory authority.
California. Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies, the rights described in that law include knowing what personal information is collected, used, and shared, having it deleted, having it corrected, opting out of its sale or sharing, and not being discriminated against for exercising those rights. Stated plainly for California readers: we do not sell personal data, and we do not run cross-context behavioral advertising.
How requests are handled. Contact the operator through the support ticket system in the client area, from your account email address. The operator checks that a request really comes from the account holder before acting on it. Where the GDPR applies, the operator responds within one month, a period set by the regulation itself, which the regulation allows extending for complex requests.
Who we share data with
The operator uses a small set of sub-processors to run the service: our payment processor, our email delivery provider, our DNS and proxy protection provider, and our hosting provider. What each one processes sits in the Carbon Hosting sub-processor list, which is part of these legal documents.
Beyond the sub-processors, personal data is shared where the law requires it, and where the operator must act under the Terms of Service (for example to respond to payment disputes through the payment provider). Nothing else.
International transfers
For who processes what, and where the sub-processors serve from, see the Carbon Hosting sub-processor list. The operator does not currently offer the service to customers in the EU or the UK. Which specific transfer mechanisms would apply is not decided in these documents: transfer mechanisms are confirmed before any EU or UK enablement, together with a dedicated review before any cross-border marketing, EU or UK currency display, or EU or UK enablement in our payment checkout.
Cookies
Only strictly necessary cookies are used at launch and no consent banner is served, as described in the Carbon Hosting cookie notice.
Changes to this policy
Changes to this policy are posted with an updated version date. Material changes are also announced through the client area or by email before they take effect. If you keep using the service after a change takes effect, that means you accept the changed policy.
Children
The service is not intended for children. Accounts are tied to billing identities that can hold an agreement under the Terms of Service. The service is not directed at children under 13, we do not knowingly collect data from children under 13, and accounts require an adult billing identity.