Privacy policy

MercureHosting ("we", "us") sells hosting that is designed to need as little personal data as possible. This policy explains exactly what we collect, why, for how long, and what we never collect at all.

1. What we never collect

• Identity documents, selfies, phone numbers or proof of address
• Card or bank details. We only accept cryptocurrency.
• The contents of your servers, or logs of the traffic your servers send and receive
• Third-party analytics, advertising pixels or tracking cookies

2. What we collect and why

• Contact method. One email address or Telegram handle, used to deliver credentials, invoices and service notices.
• Optional name. Any alias you choose. We don't verify it.
• Order records. Product, plan, location, term, dates and amounts, so we can bill and renew your services.
• Payment references. The invoice ID, the deposit address issued and the transaction ID, so we can match payments. Public blockchains record transactions independently of us.
• Service metadata. Assigned IP addresses, resource usage and power state, needed to run and bill your server.
• Security logs. Short-lived connection logs on our website and network edge, used to stop DDoS attacks and abuse.
• Correspondence. Support and abuse tickets you send us.

3. Retention

• Edge and website security logs: rotated automatically within 7 days.
• Order and payment records: kept while your account is active and then for as long as accounting obligations require.
• Support correspondence: deleted 12 months after the ticket closes, unless it relates to an open abuse case.
• Server disks: securely wiped when a service ends. We don't keep backups of customer data unless you buy a backup service.

4. Cookies

The website uses only strictly necessary cookies (for example, to keep a session during checkout). There are no analytics or advertising cookies.

5. Sharing

We don't sell or rent data. We share it only with the infrastructure partners that physically host our equipment and with a crypto payment processor if you pay through one, and only to the extent needed to provide the service.

6. Legal requests

We respond only to valid legal orders issued in the jurisdiction where the relevant server is located, and we can only hand over what we actually hold, as listed above. Requests from other countries must go through that jurisdiction's legal process. Where the law allows, we tell affected customers before we disclose anything. See also our warrant canary.

7. Security

Access to customer records is limited to staff who need it, protected by hardware-backed two-factor authentication. We encourage you to encrypt sensitive data on your own servers. Dedicated servers support full-disk encryption with keys only you hold.

8. Your choices

You can ask us to correct your contact details or to close your account and delete everything we aren't required to keep. Write to support@mercurehosting.com from your registered contact method, quoting an order reference.

9. Children

Our services are not intended for anyone under 18.

10. Changes

If we change this policy we will update the effective date above, and for material changes we will notify active customers through their contact method before the change takes effect.

11. Contact

Privacy questions: support@mercurehosting.com. Abuse reports: abuse@mercurehosting.com.