Privacy

The waitlist

We store your email address, your optional answers to "Which plan?" and "What will you run?", the IP address you signed up from, and the page or campaign that sent you (referrer and UTM tags). We use the email address to tell you when orders open, and the IP address only to stop abuse of the sign-up form. We keep it until 90 days after the launch email goes out, or until you ask us to remove you, whichever comes first.

Your account

• Your email address, and a hash of your password. We can't read the password itself.
• Whether you've confirmed your email. The links we send to confirm it or reset your password are stored as hashes and stop working after 24 hours and 1 hour.
• If you turn on two-factor authentication: the secret your authenticator app shares with us, stored encrypted, and your recovery codes, stored as hashes.
• The SSH public keys you add, so we can put them on your servers.
• For each API token: its name, access level, expiry, the address ranges you limited it to (if any) and when it was last used. We keep a hash, never the token.
• For each passkey you add: the name you give it, its public key (it can only check a sign-in, never make one), the authenticator's model number, and when it was added and last used.

We keep these while your account is open. You can see and change all of them in the panel.

If you change your email address, we keep the old and the new address and the dates, so a change made by someone else can be undone. If you sign up through a referral link, we record which account referred you, the IP address you signed up from and whether the referral earned credit, to check that nobody refers themselves.

If other people are on your account, we keep who they are, their role and when they joined. For each invite you send: the email address it went to, the role, who sent it, when it expires and whether it was accepted or revoked.

Logins and sessions

For each browser that's logged in, we store its IP address, its browser and system name (the user agent), when the session started and when it was last used. A session stops working after 14 days without use, or after 30 days whatever happens. We use this to keep you logged in and to show you, on the account page, where you're logged in.

We also keep a security log of logins, failed logins and changes to your password, two-factor, SSH keys and API tokens, each with the IP address and browser. The panel shows you the latest 50. We keep the log while your account is open, so that a break-in can be traced afterwards.

Each browser that signs in also gets a random device cookie, kept for 400 days. We store a hash of it with the browser's name, the last IP address and when it was first and last seen (up to 50 browsers per account), so we can tell you when a browser your account hasn't used before signs in.

Billing

We keep your orders, invoices, payments, account credit and refunds: the amounts, the dates and what each one was for. Bitcoin payments go through BTCPay Server, which we run ourselves, so no outside payment company sees them. BTCPay gets the invoice number and amount, not your name or email address. Bitcoin transactions are public on the Bitcoin network, as they are for any Bitcoin payment. If we refund you through a Bitcoin claim link, you enter your own address on that BTCPay page.

If you pay with PayPal, PayPal processes that payment. PayPal receives your PayPal account details and the payment information under its own privacy statement; we send it the invoice number and amount. From PayPal we receive your name, the email address of your PayPal account, the PayPal transaction and capture ids and the amount, and we keep them with your billing records. A PayPal refund goes back to the PayPal account you paid with.

If you fill in billing details (name, company, address, tax ID), we keep them and print them on your invoices. Each invoice keeps a copy of the details as they were when it was issued, so a later change never rewrites an issued invoice. We check the format of a tax ID but don't look it up anywhere.

We keep billing records for as long as tax and accounting law requires, which can be longer than your account exists.

Your servers

• Each server's hostname, plan, distribution, IP addresses, firewall rules, reverse DNS names and snapshot names, and a log of what was done to it (start, stop, reinstall and so on) and by whom.
• The one-click app, extra packages and setup script you choose for a server. Setup scripts are stored encrypted, and copied onto your server to run there.
• The name, tags and private notes you give a server. Only you see the notes.
• If you choose a root password when ordering, a hash of it, stored encrypted, until the server is built; then it is deleted. A rescue mode password is never stored.
• Usage figures, taken every five minutes: CPU, memory, disk reads and writes, and network traffic. They draw the graphs on the server page and count your monthly transfer. We delete them after 35 days.
• For the browser console: when a session opened, how long it lasted and how many bytes went each way. Not what you typed or what the screen showed.
• Which account held each IP address, and when. We keep this after a server is deleted, because abuse reports often arrive days later and have to reach the right account.

We don't read the files on your server's disk.

Notifications, alerts and webhooks

We keep the notifications the panel shows you for 90 days (at most 500 per account), your notification settings, and the alert rules you set on your servers with when each last fired and resolved.

For each webhook endpoint you add: its URL, description, the events you chose and its signing secret, stored encrypted. For each delivery: the event we sent, when, how many attempts it took, the status code and the first 1 KiB of your endpoint's answer. We keep the latest 50 deliveries per endpoint. The events go to the address you chose, so whoever runs that endpoint receives them.

The AI assistant

The panel's AI assistant answers questions about your servers using Claude, a model made by Anthropic. Anthropic processes this data for us, as our processor, to produce the answer.

• When someone on your account asks a question, we send Anthropic the question and what the assistant reads to answer it: the server's details (hostname, plan, image, state, IP addresses), its recent events, usage graphs, alert rules, panel firewall rules, reverse DNS, snapshots, backup status, rescue state, recent notifications about it, our status page and help articles. Nothing is sent until you press Ask.
• The assistant is on by default. When it is on, an alert firing or a failed action on one of your servers (a reboot, a snapshot, rescue) is also sent automatically, with the same kind of server data, so a short explanation can be added to the notification: at most a few a day per account. You can choose "on demand only" (nothing automatic) or turn the assistant off on your notification settings page or through the API.
• We never send passwords, private keys, API tokens, setup scripts or your servers' notes, unless you type them into a question. The assistant can't see inside your server or change anything.

We keep each conversation, and each automatic explanation, for 30 days, then delete it; you can delete a conversation sooner from its page. Conversations are in your data export and are deleted with your account. We also count questions and tokens per account per day, to keep within the daily limits.

Status emails

If you subscribe to status emails, we keep the email address, when you subscribed and when you confirmed it; signed in, the subscription is linked to your account. Every status email has a link that unsubscribes you, and unsubscribing deletes the address. We also remember which status banners you dismissed in the panel.

Support tickets

A ticket keeps its subject, category, the server you chose and every message in it, with your account. Our staff can add internal notes to a ticket that you don't see.

Abuse reports and staff actions

When someone reports abuse from one of our addresses, we record who reported it, the IP address, the time, the kind of abuse and their evidence, and link it to the server and account that held the address.

When our staff change something on your account or servers, such as adding credit, suspending a server or resetting two-factor, we record what they did, when, which staff member it was and the IP address they did it from. Staff can keep internal notes about an account. When a staff member views your panel to help you (read only, for at most 30 minutes at a time), we record who, when, the reason they gave and every page they opened.

What you do in the panel, the API and the CLI

Every change you make in the panel, the API or the vps9 CLI (creating or changing a server, its firewall, SSH keys, API tokens, payments and so on) is recorded with the time, your IP address, your browser's user agent and, for the API, which token was used. We don't record the pages you only look at or what you type into forms. Console sessions are recorded by start, end, amount of data and your IP address, never by what was typed or shown. For Bitcoin payments we keep the transaction ids, addresses and amounts, which are public on the Bitcoin network anyway. For PayPal payments we keep what PayPal sends us, as described under Billing.

Legal requests and preservation

We give your data to the police or a court only when we receive valid legal process or in a genuine emergency, limited to what is asked for and what we hold, and we log every request and what we disclosed. If we receive a lawful request to preserve an account's data, we may place a hold on it: its servers may be stopped, but its records and disks are kept, and are not deleted even for non-payment, until the hold ends.

Email

We email you about your account (confirmation, password resets, two-factor and API token changes), invoices and payment reminders, your servers and your support tickets. We send it through an email delivery service, which handles your address and each message in order to deliver it. We don't send marketing email to accounts.

Cookies and analytics

This website uses Google Analytics to count visits and sign-ups and see which sites send visitors. Google sets cookies to do this and processes your IP address under its own privacy policy. We don't send Google your email address.

The panel has no analytics. It sets only the cookies it needs to keep you logged in, carry a message to the next page, protect its forms, recognise a browser that signed in before (see Logins and sessions) and remember whether you like your server list as cards or a table.

Opening a referral link (a link with ?ref= in it) sets a cookie for 30 days that holds only the referral code, so the account you then sign up for counts as referred.

Who else sees it

• The email delivery service, for the messages above.
• Google, for website visits, as described above.
• PayPal, if you pay with PayPal, as described under Billing.
• Anthropic, which runs the AI assistant's model, as described under The AI assistant.
• The webhook endpoints you add, which receive the events you chose.
• The companies we rent servers and network capacity from. They host the machines our data is stored on. When you set reverse DNS, the name you choose is published through the network provider that holds our IP addresses.
• Anyone the law requires us to give it to.

We don't sell your details, and we don't share your email address with anyone else.

Seeing, correcting and deleting it

Most of it is on the panel's account, servers and billing pages, where you can change it. The account page also lets you download a copy of your data as one file, and delete your account once it has no servers and no unpaid invoices: it is deleted 7 days after you ask, and you can cancel until then. An account you own can't be deleted while other people are on it. When we delete an account, we keep the billing records the law requires us to keep (each invoice with the billing details printed on it), and the abuse and IP address records described above. Your email address, password, keys, tokens, passkeys, remembered browsers, security and activity logs, support tickets, notifications and their settings, alert rules, webhooks, AI assistant conversations and its setting, status email subscription, billing details, the names, tags and notes of your servers and staff notes about the account are deleted, pending invites you sent stop working, and you are removed from other people's accounts. If you can't use the panel, email hello@vpsnine.com from the address on your account, or open a support ticket.