Privacy Policy

MaxHosting is the controller for the personal data described here. That means we decide why and how it's used, and we're responsible for handling it according to the EU General Data Protection Regulation (GDPR).

MaxHosting. You can reach us any time by opening a support ticket.

• Account: your email address and a password, which is stored hashed. If you sign in with Google we receive your name and email address from Google.
• Orders and subscriptions: what you've ordered, prices, payment status and subscription dates. Card details go directly to Stripe and never reach us.
• Billing details you enter, such as name, address and VAT number. They are stored with Stripe.
• Your game servers: settings, the files you upload, console output, backups, and the server's address and port.
• Support: the tickets and messages you send us.
• MaxPoints: your points balance and how you earned and used points.
• Technical data: IP address, browser type and logs from our systems, used to keep the service running and secure.

• To provide the service you've ordered: creating and running your servers, your account, payments, support and the emails that belong to the service, such as order confirmations and payment reminders. Legal basis: contract.
• To keep accounting records as Swedish law requires. Legal basis: legal obligation.
• To keep the service secure and prevent fraud and abuse, such as attacks from servers. Legal basis: legitimate interest.

We don't sell your data. We use these providers, which only process it to deliver their part of our service:

• Lovable and Supabase: website hosting, database, sign-in and file storage. They also send sign-in emails such as password resets.
• Stripe: payments, receipts and VAT. When Stripe acts as seller of record it is also responsible for the payment data it collects.
• Twilio SendGrid: sending service emails.
• Our data centre in Helsinki, Finland: running the game servers and storing their files and backups.
• Google: only if you choose to sign in with Google.

We may also disclose data when the law requires it, for example to the police or a court.

Some providers are based in the United States or have staff there. When data leaves the EU/EEA it's protected by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. Your game servers themselves run in Finland.

• Your account data, for as long as you have an account.
• A server's files and backups, until the subscription ends. Then they're deleted.
• Support tickets, for as long as you have an account.
• Accounting records such as orders and receipts, for seven years, as Swedish law requires.
• Technical logs, for a limited time, then they're deleted.

You have the right to get a copy of your data, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a machine-readable format. To use any of these rights, open a support ticket. We answer within a month.

If you think we handle your data incorrectly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se.

We only use what the site needs to work: your browser stores your sign-in so you stay logged in, plus a few settings for the site. We don't use tracking or advertising cookies, and our fonts are served from our own site. Stripe's checkout uses its own cookies to prevent fraud when you pay.

When you run a game server, you decide over the data about your players that the game stores, such as player names, chat and IP addresses in logs. We store and process that data on your behalf only to host your server, and we follow these terms and our Terms of Service when we do.

We may update this policy. If a change matters to you, we tell you by email before it takes effect. The date at the top shows when it was last updated.