Privacy Policy

FlowHost collects personal and technical data to provide VPS and web hosting services. We collect account information such as your name, email address, billing address, and account credentials provided during registration. Payment data including transaction metadata and payment histories are processed via third-party payment gateways for one-time invoice payments, and we never store raw credit card numbers on our servers. We also collect technical and network telemetry including IP addresses, authentication timestamps, bandwidth usage metrics, system resource utilization like CPU, RAM, and storage, as well as server access logs required to maintain node stability and infrastructure security.

FlowHost, Sweden. Contact: [email protected].

We process personal data under the following GDPR legal bases:

• Performance of a contract: providing and billing services, account management, and customer support.
• Legal obligation: keeping invoices and payment records as required by the Swedish Bookkeeping Act.
• Legitimate interest: security, fraud and abuse prevention, and operational logs.
• Consent: website analytics (for example Google Analytics), only when you accept analytics cookies.

We use trusted processors to operate our services: OVHcloud (infrastructure where customer servers run), Contabo (website hosting), Stripe and PayPal (payments), Brevo (transactional and support email), and Google Analytics (website analytics, only with your consent).

FlowHost enforces a zero-tolerance policy for network abuse, illegal activities, and terms of service violations. Upon receiving valid network abuse reports, DMCA notices, or security alerts, FlowHost reserves the right to take immediate action, up to and including service suspension or termination. Depending on the severity and urgency of the incident, such as active malicious attacks versus standard inquiries, we may notify the customer before or concurrently with taking corrective action.

Some processors (for example Stripe, PayPal, and Google) may process personal data outside the EU/EEA. Where that happens, transfers are protected by appropriate safeguards such as the EU-US Data Privacy Framework or Standard Contractual Clauses.

We retain personal data only as long as needed for the purposes below:

• Account data: while the account is active.
• Invoices and payment records: 7 years, as required by the Swedish Bookkeeping Act.
• Audit log: 7 years, after which entries are deleted or anonymized.
• Other logs: application and operational logs (including web/server and login related logs kept by the platform) are retained for up to 90 days. There is no separate automated retention schedule configured beyond that.

When a hosting service or VPS is canceled or terminated, associated virtual disks and instance data are permanently deleted. Customers are responsible for exporting their data before cancellation.

FlowHost never accesses the contents of a customer's server unless the customer opens a support ticket and asks for help, or when required by law.

Necessary cookies (such as the login/session cookie) keep you signed in and are required for the Client Portal to work; they do not need consent. Analytics and affiliate referral cookies are used only with your consent. You can Accept or Decline them via the cookie banner on our website, and change your choice anytime through Cookie settings in the footer. If you decline, analytics tools such as Google Analytics will not load and no referral cookie is saved.

Under the GDPR you may request access, correction, deletion, restriction of processing, data portability, objection to processing based on legitimate interests, and withdrawal of consent where processing is based on consent. Send requests to [email protected].

We do not use automated decision-making or profiling.

FlowHost may update this Privacy Policy from time to time. When we make significant changes, we will notify customers by email.