Privacy Policy

This page explains, in plain language, what happens to your information when you visit HostyXo's website or use our client area to run hosting and domains through us. We're not going to pretend a hosting company needs pages of legal jargon to say "we collect what we need to serve you and we don't sell it" — but the details matter, so here they are, broken down by what we collect, why, and what say you have over it.

• Account information — your name, email address, phone number, and a password (or a linked Google/Facebook/GitHub account) when you sign up for a client area account.
• Billing & contact information — company name if applicable, street address, city, postal code, and country. We need this to generate correct invoices and, for domain orders, to submit the WHOIS/registrant record the registry requires.
• Payment information — payments run through bKash, and what reaches us is a confirmation and a transaction reference, not your PIN or full account details. Those never leave bKash's systems.
• Service data — which plans, domains and add-ons you've ordered, plus the content of support tickets and messages you send our team.
• Technical data — IP address, browser and device type, and the pages you visit, picked up automatically through server logs and cookies as you'd expect from any website.

• Setting up and running your client account, and actually delivering the hosting or domain Service you paid for.
• Processing payments, generating invoices, and catching fraudulent orders before they cause a real problem.
• Registering and managing domains with the registry on your behalf.
• Answering support tickets and the other messages you send us.
• Sending service notices you can't opt out of — invoices, renewal reminders, security alerts — and, only if you've said yes to it, the occasional product update.
• Keeping our servers secure, stable and fast for every customer on them, not just you.

A few parts of this site rely on services Google provides, and each comes with its own small privacy footnote:

• Sign in with Google (also Facebook and GitHub) — if you use one of these to create or log into your account, that provider sends us your name, email, and profile photo where available. We never receive or store your password for that account; the login itself happens entirely on Google's, Facebook's, or GitHub's side.
• Google Maps — the map on our Contact page is embedded directly from Google. Loading that page sends your IP address and some device information to Google under their own Privacy Policy, which we don't control.
• Google Fonts — our typography loads from Google's font servers rather than being bundled into our own files. Like any external resource, that means your browser makes a request to Google's servers to fetch it, which can include your IP address.

None of this data passes back through us — it's a direct connection between your browser and Google, governed by Google's own privacy terms.

We use cookies to keep you logged into the client area between visits, remember which currency you'd rather see prices in, and get a general sense of how the site is being used. You're free to block or delete cookies from your browser settings at any point — some client-area features just won't work properly without them, since that's how we know it's you.

We don't sell personal information — not to data brokers, not to advertisers, not to anyone. The only sharing that happens is what's actually needed to run the Services you've signed up for:

• Domain registries and registrars — the WHOIS/registrant details a registration or transfer legally requires.
• bKash — to actually process the payment you initiate.
• Google, Facebook, GitHub — only if you choose to sign in through one of them (see Section 3).
• Infrastructure and data center providers — the physical servers and networks our platform runs on.
• Legal authorities — if we're compelled to by Bangladeshi law, a court order, or a legitimate regulatory request.

We keep account and billing records for as long as your account stays active, and for a reasonable period after that to satisfy tax, accounting, and legal record-keeping obligations — the kind of paper trail any registered business in Bangladesh is required to hold onto.

Passwords are hashed, not stored in plain text. Traffic to and from our site runs over HTTPS. Access to customer data internally is restricted to what our support and engineering teams actually need to do their jobs. None of that makes us immune to every possible attack — no one can honestly promise 100% security — but it's the same baseline any serious hosting company should be holding itself to, and we take it seriously because our own infrastructure depends on it too.

• Update your own account details any time from My Account in the client area — no need to email us for routine changes.
• Unsubscribe from marketing emails with one click from the email itself. Service notices like invoices and security alerts stay on, since those exist to protect your account, not to market to you.
• Ask for a copy of what we hold on you, or ask us to delete your account and associated data, by writing to hello@hostyxo.com — we'll act on it, minus whatever we're legally required to keep for accounting purposes.

HostyXo is based in Bangladesh and most of our customers are too, but we do get orders and visitors from elsewhere, including the EU. If GDPR applies to you, the rights described above — access, correction, deletion — line up with what GDPR calls the right to access, rectify, and erase your data, and we honor requests on that basis regardless of where you're writing in from. There's no separate process; the same email address handles it.

Our Services are built for adults running websites and businesses — they're not aimed at anyone under 18, and we don't knowingly collect information from children. If we learn that a child's data has ended up in our systems without appropriate consent, we'll remove it.

We'll update this page as our Services change — a new payment method, a new sign-in provider, a new legal requirement. The "Last updated" date at the top always reflects the current version, and continuing to use HostyXo after an update means you've accepted it.

Questions about this policy or your data are welcome at hello@hostyxo.com, or through our Contact page.