Skip to content
AluyAluy

Privacy Policy

In force 14 October 2026 · version 2026-10-14

Data protection and security. What we collect, why, and your GDPR rights.

Who is responsible

Controller (Art. 4(7) GDPR): Julian Achter (Einzelunternehmer), trading as Aluy

Postal address: Am Hang 55, 85737 Ismaning, Germany

The simple version

Privacy-respecting: We collect minimal information necessary for billing and support. We maintain essential operational logs for service reliability only. We do not monitor your server content.

We don’t sell your data or use invasive web tracking. We respect user privacy, and we don’t ask for identity documents.

What we collect

Account stuff: Name, email address, billing address. For business customers: company name, VAT ID (if applicable). Standard business information for hosting services.

Payment info: Payments are accepted via PayPal (including card payments) and cryptocurrency (via Heleket, 2328 or OxaPay). We use third-party payment processors for payment processing. We do not store full card numbers or payment credentials on our systems.

Server logs: Connection logs for security, operations, and troubleshooting. Standard monitoring for service reliability.

Account audit log: For every security-relevant action on your account (successful logins, failed sign-in attempts, logouts, password changes, two-factor changes, admin actions, payments, GDPR requests, role changes) we record the timestamp, the action, the IP address and user-agent of the request, and a correlation id. Because you stay signed in for up to 30 days from a single login, we also record, at most once per day per IP address, the IP address used to access your account while a session is active — so we have an accurate picture of which networks actually used the account, not just the moment you signed in. We do not log individual page views or actions beyond this. This is what lets us answer abuse reports, investigate account takeovers, and respond to lawful authority requests with precision. The IP address and user-agent are removed after 30 days. Retention is described under “How long we keep it”.

Outbound email log: When we send you transactional email (verification, invoices, password resets, GDPR notices, broadcasts) we record the recipient, sender, subject, the template used, the SMTP message-id and delivery status, and the rendered body. The body is redacted after 30 days; the envelope is kept for 1 year so we can prove that a specific invoice or notice was sent. You can see every email we have sent you in your account dossier (Account → Data export).

No identity checks (KYC): We don’t ask for ID documents. The only exception is an AS number we sponsor at the RIPE NCC: RIPE NCC’s rules require the sponsoring LIR to verify the holder’s identity, so for ASN orders we ask for the documents RIPE NCC requires and keep them with the LIR / RIPE assignment record (retention below).

Support tickets: Your questions and our answers. We keep these to help you better.

IP address records: which of our IP addresses each of your services held, from when to when, and each change of a VPS’s IPv4 address. Addresses move between customers, so this is how we match an abuse report or an authority request about an address to the right customer. Retention is described under “How long we keep it”.

What we don’t do

  • We do not track you across websites
  • We do not sell your data to third parties
  • We do not monitor your server content
  • We do not use invasive analytics
  • We do not share data unless legally required
  • We do not use automated decision-making or profiling that produces legal effects concerning you (Art. 22 GDPR)

Legal basis for processing

Under GDPR Article 6, we process your data based on:

Contract performance (Art. 6(1)(b)): Account management, billing, service provision, technical support

Legitimate interest (Art. 6(1)(f)): Network security, fraud prevention, service improvement, basic logging. You may object to processing based on legitimate interest at any time (Art. 21 GDPR); we will then cease processing unless we demonstrate compelling legitimate grounds that override your interests.

Legal obligation (Art. 6(1)(c)): Tax records, business records (e.g. retention periods under German tax and commercial law, §§ 147 AO, 257 HGB — often up to 10 years for tax-relevant documents), law enforcement requests

Consent (Art. 6(1)(a)): Marketing communications (if you opt-in), non-essential cookies. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

How we use your data

  • Billing and payment processing
  • Technical support
  • Account security
  • Legal compliance (when required)
  • Service announcements (rare)

How long we keep it

Account data: While you’re a customer. We do not automatically delete inactive accounts after a year. You can request erasure under Art. 17 at any time (subject to the statutory holds below).

Billing records (invoices, orders, payments, balance ledger): 10 years (legal requirement under §§ 147 AO, 257 HGB)

LIR / RIPE assignment records (organisation name, assignment size, justification, and the redacted contact fields after an Art. 17 request): kept for the life of the resource plus 10 years after it is returned or withdrawn. This is a RIPE NCC / tax documentation obligation and is not deleted on erasure (Art. 17(3)(b) GDPR).

Security audit log (successful logins, failed sign-in attempts, logouts, the IP used to access your account while signed in (recorded at most once per day per IP), password changes, two-factor changes, admin actions on your account, payments, GDPR requests, broadcasts, role / permission changes): 365 days, then automatically deleted. Each row captures the action, the timestamp, the actor (when known), the IP address and user-agent of the request, and a correlation id. The IP address and user-agent are removed after 30 days, and the daily records of the IP used to access your account are deleted after 30 days. Entries that are part of our bookkeeping (orders, payments, invoices) are kept with the billing records for 10 years; their IP address and user-agent are removed after 180 days, the period in which a payment can still be disputed. We need this retention to investigate account takeovers, abuse reports, and disputes — most of which surface weeks or months after the fact.

Operational audit log (routine application bookkeeping that has no forensic value after a month): 30 days, then automatically deleted.

IP address records (which of your services held which of our IP addresses, from when to when, and the IPv4 changes of a VPS): while your service holds the address and for 1 year after it was released or the change was completed, then automatically deleted. This also applies after an Art. 17 erasure (Art. 17(3)(e) GDPR). Records of an account with a service under legal hold are kept until the hold ends.

Cancellation declarations (made on our cancellation page “Verträge hier kündigen” or through its confirmation link): the date and time of receipt, the contracts concerned and their end dates, whether we sent a confirmation e-mail (and if not, why), the type of cancellation and the requested end date, the contract reference and reason you entered, the e-mail address you entered (for an address that belongs to no customer account, only a keyed hash of it), a pseudonymised (keyed-hash) IP address and the browser user-agent: kept until the end of the third calendar year after the year of the declaration (the regular limitation period, §§ 195, 199 BGB), so that you and we can prove that and when a contract was cancelled, then automatically deleted. Legal basis: Art. 6(1)(c) GDPR with § 312k BGB, and Art. 6(1)(f) GDPR (establishing and defending legal claims). The confirmation e-mail goes only to the address of a customer account and does not repeat the contract reference or reason you typed; if you do not use the confirmation link it contains, we send one reminder to that address after five days. If our input filter flags the contract reference or the reason (for example markup or characters such as “<” or “|”), we record and process the declaration without that field; the flagged text is kept separately as a security record for 30 days. If more than 20 declarations reach us from the same network on one day, we record each further one only with the date and time of receipt, the keyed hash of the e-mail address, the type of cancellation, the requested end date and the customer account concerned, without the contract reference, reason, IP hash or user-agent.

Outbound email log (transactional and broadcast email we send to you): envelope (recipient, sender, subject, template, message-id, status) 1 year; rendered message body 30 days, after which the body is redacted but the envelope is kept so we can still prove that a particular invoice or notice was sent. Email rows older than 1 year are deleted in full.

Web server access logs (nginx): 7 days, then automatically deleted. The application itself does not log page views.

Backups: once a day we back up our customer database and ticket attachments. Each backup is encrypted on our server before it is uploaded and stored with Web1 Oy in Finland, which cannot read it. We keep the newest 7, so data we delete is gone from our backups within 7 days.

Support tickets: 2 years for reference, or until you exercise your right to erasure under Art. 17 GDPR — whichever comes first. We have no statutory obligation to retain support correspondence; the 2-year period is a legitimate-interest retention (Art. 6(1)(f)) and is overridden by an erasure request. The only exception is where individual messages are necessary to defend a specific, identifiable legal claim under Art. 17(3)(e) GDPR (e.g. ongoing abuse / fraud investigation, pending dispute) — those messages may be retained, under restricted processing (Art. 18 GDPR), until the relevant limitation period expires.

DSA Art. 16 notices: Notice rows are kept for accountability. Notifier name, email, IP hash, and user-agent are anonymised 3 years after the decision (or after creation if no decision), unless a legal hold applies. The notice itself (location, legal explanation, decision) is retained.

On Art. 17 erasure we delete: profile data, postal address, phone number, VAT-ID, password hash, two-factor secrets, passkeys, sessions, OAuth links, marketing-consent state, all support tickets, ticket messages, and ticket-attachment files, and the rendered bodies of email we sent to you. We anonymise notifier name, email, IP hash, and user-agent on DSA Art. 16 notices you filed or that concern your services (the notice row itself is kept). We scrub IP / user-agent / actor and subject links from every historical audit-log row that referenced your account, leaving only action, timestamp, entityType, and a retention class — enough to preserve accountability (Art. 17(3)(e) GDPR), nothing that identifies you. We retain only what we are legally required to keep: invoices, the buyer name + address frozen onto each invoice (§ 14 Abs. 4 UStG), the orders / payments / balance ledger that backs them, the email envelopes that prove dispatch of those invoices, and the consent-log row that proves consent was obtained (Art. 7(1) accountability). The IP address records described above are kept until their 1-year period ends (Art. 17(3)(e) GDPR). Erased data is gone from our backups within 7 days. All retained records are placed under restricted processing pursuant to Art. 18 GDPR and are accessed only where legally required. Erasure is refused while a service is under legal hold.

Pre-erasure dossier archive: Immediately before your account is anonymised we produce a sealed ZIP archive of everything we held about you at that moment, together with a SHA-256 hash manifest. The archive is kept for 30 days under Art. 17(3)(e) GDPR (defence of legal claims) so that, if you later dispute what was deleted, we can show exactly what existed at the moment of erasure. After 30 days the archive is deleted automatically.

Data is deleted or anonymised once the retention purpose expires and no statutory retention obligation prevents deletion. All retention windows are enforced by an automated daily job — they are not maintained by hand.

Your rights

Under GDPR (Articles 15–22) and other privacy laws, you have the following rights:

Access (Art. 15): Request a copy of your personal data

Rectification (Art. 16): Correct inaccurate or incomplete data

Erasure (Art. 17): Request deletion when legally possible

Restriction (Art. 18): Limit how we process your data

Portability (Art. 20): Receive your data in machine-readable format

Objection (Art. 21): Object to processing based on legitimate interest

Withdrawal of consent (Art. 7(3)): Withdraw consent at any time without affecting the lawfulness of prior processing

Self-service data export (Art. 15 + Art. 20): Logged-in customers can download a full machine-readable copy of their data at any time from Account → Data export in the portal. The download is a ZIP archive containing your profile, orders, invoices, payments, services, support tickets and attachments, the outbound email log, your sessions, every audit-log entry that references your account, and a cover sheet with SHA-256 hashes of every file for integrity verification. We do not retain a copy of the archive; we log only the fact that you requested it.

How to exercise other rights: Email us at lain@aluy.net with your request. We’ll respond within 30 days as required by Art. 12(3) GDPR.

DSA Art. 16 notices: If you file a notice of illegal content, we process your name, email (unless the CSAM anonymity exception applies), IP address hash, user-agent, the location you identified, and your legal explanation. We keep the notice row for the statutory/accountability period. After a decision (or, if none, after creation) we anonymise notifier name, email, IP hash, and user-agent after 3 years, unless a legal hold applies. Notices that concern your hosted service also appear in your data export.

Law-enforcement and supervisory-authority disclosure: We only disclose personal data to authorities where we are legally compelled to (e.g. a request under § 100j TKG, § 19 DDG, §§ 161, 163 StPO, court order, or an equivalent instrument in the jurisdiction of one of our servers). Every disclosure is produced as a sealed ZIP dossier with a cover sheet that records the requesting authority, the reference / Aktenzeichen, the legal basis cited, and the SHA-256 hash of every file in the archive. The act of producing the dossier is itself written to our audit log so we have an internal record of every disclosure for the duration of the audit retention window. Where the law allows, we will inform you of a disclosure that concerned your data.

Right to lodge a complaint: You may lodge a complaint with a supervisory authority in the EU/EEA. The authority competent for our business is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany. You may also lodge a complaint with the supervisory authority of your habitual residence or place of the alleged infringement.

Data processors & third parties

We use the following processors to provide our services. All processors are bound by data processing agreements (DPAs) under Art. 28 GDPR:

Data processing agreement (AVV) for business customers: Where you use our services to process personal data of your own end users, we act as your processor under Art. 28 GDPR. The current AVV is published at /legal/dpa.

Our infrastructure (BYOIP / BYOASN on rented dedicated servers): Our VPS and our own dedicated-server products run on dedicated servers we rent from third-party server providers in the Netherlands, Bulgaria, Finland, and Hong Kong. Hong Kong is outside the EU/EEA and is not covered by a European Commission adequacy decision — where you select a Hong Kong location, your service (and the customer data on it) is hosted there; see “International data transfers” below. On those rented machines we announce our own ASN and IP space (bring-your-own-IP / bring-your-own-ASN); our systems and customer data sit on our software stack. The underlying hardware owner / data-centre operator has physical-layer access to the server but no logical access to customer data on our systems beyond what is required to deliver the rented hardware (e.g. remote-hands, IPMI / KVM when explicitly requested). We may change the underlying hardware provider for a location without notice; the IPs, ASN, and service identity remain ours.

Resold Hetzner server auction: If you purchase a "Hetzner Server Auction" dedicated server, that hardware is owned and operated by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) on Hetzner’s own network, ASN, and IP space, in one of Hetzner’s own data centres in Germany (Falkenstein, Nuremberg) or Finland (Helsinki) depending on which auction unit you select. Hetzner is the sub-processor and primary data-centre operator for those services and Hetzner’s terms and privacy policy also apply in addition to ours.

Resold Hetzner storage boxes: If you purchase a Storage Box, it is created and operated by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in one of Hetzner’s data centres in Germany or Finland, depending on the location you choose. We create the box through Hetzner’s API; the files you store on it are held by Hetzner as our sub-processor. Hetzner’s privacy policy also applies.

Number resources & LIR services: IP, ASN, and LIR services are issued and operated under the policies and agreements of the RIPE NCC (Stationsplein 11, 1117 KX Schiphol, NL). RIPE NCC is a registry, not a processor of customer content; registration and routing data submitted under those services is published in the RIPE Database in accordance with RIPE policy.

Payment processors: PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) for PayPal, card payments, Apple Pay and Google Pay, and, for crypto, Heleket (heleket.com, Estonia), 2328 (2328.io) or OxaPay (oxapay.com). When you pay with crypto, you pay on the processor's own payment page: we send it only the order number and the amount, never your name or email. The processor handles your wallet, the transaction and what you enter on its page as an independent controller under its own privacy policy, and may run its own anti-money-laundering checks. 2328 and OxaPay are based outside the EU/EEA and not covered by an adequacy decision; a payment through them is a transfer necessary for the payment you chose (Art. 49(1)(b) GDPR). When you pay with PayPal, PayPal may run FraudNet in the checkout flow as an independent controller. If you choose Google Pay, Google processes your wallet and payment-card selection as an independent controller under its own terms (Google Payment Ireland Limited for users in the EEA); the payment itself is then processed by PayPal.

VirtFusion (VPS orchestration): we create a panel user with your name and email so your VPS can be provisioned and managed.

Trivox (dedicated-server upstream): used only for dedicated servers. Operational identifiers needed to provision and support the machine are transmitted.

BunnyWay d.o.o. (bunny.net, Slovenia): our website and customer portal are delivered through the Bunny CDN, which processes your IP address and request details (such as the requested URL and your browser’s user agent) to deliver pages and protect the site against attacks. Bunny DNS is also used where we host DNS zones for you. Bunny is established in the EU.

Telegram Messenger Inc. (staff operations alerts): ticket and order alerts for our operators. Messages contain a link into the admin panel, not your full ticket text or email. Telegram is established outside the EU/EEA; the transfer relies on Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Cloudflare, Inc. (Turnstile bot management): used as a strictly necessary security measure on login, register, checkout, server order, notice, cancellation, looking-glass, email verification, and password-reset forms. Cloudflare is established in the United States. The transfer relies on the EU–U.S. Data Privacy Framework adequacy decision (Art. 45 GDPR), under which Cloudflare is certified, and otherwise on Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Web1 Oy (Latokarinkatu 3, 20200 Turku, Finland): stores our daily backups. They are encrypted before they leave our server, and Web1 does not have the key.

Email service: Transactional emails (invoices, support) sent via our own mail servers or third-party email service providers as necessary for service delivery.

Most processors are located within the EU/EEA or in a country covered by a European Commission adequacy decision under Art. 45 GDPR. Some infrastructure locations — in particular Hong Kong — are outside the EU/EEA and are not covered by an adequacy decision; for those we rely on appropriate data-transfer mechanisms (Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR) and, where required, additional safeguards. We may change sub-processors as operationally necessary; material changes will be communicated to you through our privacy policy updates.

International data transfers

Where personal data is transferred to a country outside the EU/EEA that does not benefit from an adequacy decision under Art. 45 GDPR, we rely on Standard Contractual Clauses (Art. 46(2)(c) GDPR) or other appropriate safeguards; a crypto payment through 2328 or OxaPay relies on Art. 49(1)(b) GDPR (see Payment processors). You may request a copy of the applicable safeguards by contacting lain@aluy.net.

Security & encryption

We implement industry-standard security measures to protect your data. We do not guarantee absolute security — no system connected to the internet can — but we take reasonable technical and organisational measures (Art. 32 GDPR):

  • HTTPS/TLS Encryption: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher
  • Password protection: Customer passwords are hashed using industry-standard algorithms (bcrypt/Argon2)
  • Encrypted backups: Backups are encrypted before they leave our server; only we hold the key
  • Access controls: Strict access controls limit who can access customer data internally
  • Security monitoring: We maintain security logs and monitor for unauthorized access attempts
  • Regular updates: Systems are kept updated with security patches

Note: Admin panel access attempts are logged for security purposes (with consent). These logs include IP addresses and timestamps and are retained for 30 days.

Data breach notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours (Art. 33 GDPR). Where the breach is likely to result in a high risk, we will also notify affected individuals without undue delay (Art. 34 GDPR).

Cookies

We use essential cookies for service functionality and non-essential cookies with your consent:

  • Login session (essential) — Keeps you logged in
  • CSRF protection (essential) — Prevents security attacks
  • Payment verification (essential) — Confirms payment status
  • Cloudflare Turnstile (essential) — Bot check on login, checkout, the Art. 16 notice form, and the cancellation form. Strictly necessary under § 25 Abs. 2 TDDDG; Cloudflare, Inc. is the processor.
  • PayPal FraudNet (essential when you pay with PayPal / card) — PayPal’s fraud-prevention script on the checkout card flow. Set by PayPal as the independent controller of that payment processing.
  • Preferences (non-essential) — Remembers interface choices such as dismissed notices (requires consent)
  • Referral attribution (non-essential) — If you arrive through a partner’s referral link and consent to “Referral attribution”, we set the aluy_ref cookie for 30 days so the referring partner can be credited if you sign up (Art. 6(1)(a) GDPR, § 25 Abs. 1 TDDDG). Without consent, the referral code is not stored.

A cookie consent banner appears on your first visit. You can accept all cookies, reject non-essential ones, or choose per category — and change or withdraw your choice at any time with Cookie settings in the site footer.

No tracking cookies, no advertising cookies, no third-party analytics.

For full details see our Cookie Policy.

Changes to this policy

We may update this policy as needed. Material changes will be notified by email. Continued use of the services after notification constitutes acceptance of the updated policy, except where separate consent is required by law.

Updated 14 October 2026