Proposed launch terms, not yet effective. Company details and service-specific commitments must be confirmed before live orders. The sections below describe the proposed policy in full.
On this page
1. What this policy covers
This policy describes the proposed handling of personal information associated with the Starcloud website, customer portal, orders and support. It distinguishes account information used to operate the service from content that a customer chooses to process inside a server.
The final notice must identify the legal entity responsible for processing and its contact details. This draft describes the intended service model; the actual processing inventory, providers and retention schedule must be verified before the notice becomes effective.
2. Information you provide
Account information may include your name, email address, authentication details and the contact information you enter. Billing records may include a billing address, business or tax information, order selections, invoices, payment status and transaction references.
Support correspondence contains the messages and attachments you choose to send. Server configuration may include a hostname, operating-system selection, region, SSH public key and allowed IPv4 addresses or ranges. Do not submit private keys, passwords, complete card details or unrelated sensitive information through support or server configuration fields.
3. Technical and service records
Requests to the website and portal can generate technical records such as an IP address, browser information, request time, error information and security events. Account sessions and service records help associate authorised actions with the correct account and investigate errors or misuse.
The intended purposes are to deliver requested pages, keep users signed in, operate orders and services, prevent fraud and investigate incidents. Data collection should be limited to what is appropriate for these purposes. This draft does not claim that a particular analytics or advertising system is installed.
4. Why information is used
Information is used to create and secure accounts, process accepted orders, provide customer support, issue invoices, communicate material service changes and comply with applicable accounting or legal obligations.
Where data-protection law requires a legal basis, the relevant basis may be performance of a contract, steps requested before a contract, compliance with law or a legitimate interest such as protecting the service against abuse. A legitimate interest must be balanced against the rights of the person affected.
Optional marketing or non-essential tracking that requires consent must use a separate choice. Withdrawing that consent must not cancel an unrelated service or prevent access to essential account functions.
5. Cookies and browser storage
The portal uses session-related technology to support authentication and normal account operation. Browser storage may also remember preferences such as language, theme and interface choices. These mechanisms have different purposes from advertising or cross-site tracking.
You can manage cookies and local storage through your browser. Clearing them may sign you out or reset preferences. A final cookie inventory should identify the technologies actually used and their durations; optional analytics or marketing technologies must not be treated as essential simply because they are convenient.
6. Service providers and disclosure
Running the service may require infrastructure, payment, communication and support providers to process limited information for their assigned functions. For example, a payment provider may handle a payment while the portal retains its status and transaction reference. Information should be shared only to the extent needed and under appropriate contractual restrictions.
Disclosure may also be necessary to comply with a valid legal request, investigate fraud, protect rights or address a security incident. Requests should be assessed for validity and scope. A business transfer involving personal information must respect applicable law and appropriate notice obligations.
This draft does not authorise the sale of personal information or its use for unrelated advertising. The provider list and any jurisdiction-specific disclosures must reflect the services actually enabled at launch.
7. Processing locations and transfers
A server region identifies the location selected for that compute service. It does not, on its own, guarantee that account records, support messages, payments or every backup are processed only in that region.
Before offering a residency commitment, the relevant processing locations and service scope must be stated expressly. Where personal information is transferred across borders and applicable law requires safeguards, those safeguards must be in place and described in the final notice or relevant processing agreement.
8. Retention and deletion
Information should be retained only for as long as its purpose and applicable obligations require. An active account needs operational records; invoices may need to be retained for statutory accounting periods; a substantiated security incident or dispute may justify preserving relevant evidence.
When a record is no longer needed, it should be deleted or anonymised through the applicable retention process. Closing an account does not necessarily erase records that must be kept by law. Deleted information may remain temporarily in restricted backup copies until those copies expire through their normal lifecycle.
Retention periods must be based on the applicable legal requirements and actual systems, rather than an assumed universal period. Server deletion and any purchased backup retention are separate from the retention of billing and account records.
9. Security and your choices
Protection of personal information requires appropriate technical and organisational measures, including restricted access, secure account authentication and controlled handling of support information. No internet service can promise absolute security.
Use a unique password, protect the email account used for recovery and limit access to people who need it. Report suspected account compromise through support. Any incident involving personal information must be assessed and handled under the applicable notification requirements.
10. Requests about your information
Depending on applicable law, you may be entitled to access, correct or erase information, restrict or object to processing, obtain a portable copy, withdraw consent or complain to a data-protection authority. These rights may have conditions or exceptions, such as lawful retention of invoices.
Use a support ticket for an account-related request, or consult the Contact page for available contact methods. Describe the request and the information concerned. Identity checks should be proportionate to the sensitivity of the information; do not send identity documents unless a secure and appropriate process has been explained.
Requests must be handled within the time limits required by the law that applies. This draft does not introduce a shorter contractual deadline, waive an available right or require an account holder to abandon a complaint to an authority.
11. Personal information on your server
If you process other people’s information using a server, you are responsible for your purposes, lawful basis, notices and application-level controls. Access to infrastructure for operating the service does not transfer ownership of that content to Starcloud.
Where a controller-processor relationship requires a separate data-processing agreement, it must be in place before the relevant processing begins. That agreement should address instructions, security, assistance, subprocessors and deletion. A server order alone must not be treated as a substitute for a required agreement.
12. Updates to this notice
The effective notice should be updated when processing practices materially change and should identify its revision date. Important changes to purposes, recipients or choices should be communicated where required. A new notice does not automatically permit an incompatible use of information collected earlier.
Questions about this policy?
If you have an account, open a support ticket with the relevant service or invoice reference. Otherwise, check the contact page for available ways to reach us.