What we collect
- Account: your email address, and a record of when you sign in.
- Billing and domains: your name, address, phone number and, for companies, your company number. Domain registries require these to register a domain in your name.
- Agent access: the public half of SSH keys you add, and hashed API tokens. We never see your private keys, and we can't read your tokens back.
- Payments: handled by Stripe. We never see or store your card number.
- Collected automatically: the IP address that asks for a sign-in link or a preview token, and when. Stripe records the IP address used to pay.
- Free previews: the email you verified, the IP address and browser or tool (user agent) that uploaded it, and when.
- Referrals (Share & earn): which customer's share link you came from, and counts of clicks on each link (a number only, nothing about who clicked). If you came by a share link, or typed a share code, and give us your email during that visit (to sign in, check out or contact us), we keep that email with the link's code for up to 90 days, so a later first order still counts for the person who sent you, without a cookie. To stop people referring themselves, we compare a new customer with the customer who referred them: email address, a fingerprint Stripe gives for the card (never the card number), billing address and postcode, and a scrambled (hashed) form of the internet address used to sign up or open Share & earn.
- Account credit: every change to your credit, with the reason.
- Abuse reports: what you tell us, your email if you give it, and your IP address. If someone reports your site or preview, we keep the report and what we did about it.
Why
To run your hosting, register your domains, take payment, send you reminders the law requires, and answer your emails. We don't sell your data or use it for advertising.
IP addresses and preview details are kept to stop fraud and abuse, to deal with reports, and to meet our legal duties, including domain registry rules, tax law and reporting child sexual abuse material to the National Crime Agency. Our legal bases are: our contract with you, legal obligations, and our legitimate interest in keeping the service safe.
Referral checks run on our legitimate interest in stopping fraud in our referral programme. The referral cookie is only set with your consent, which you can withdraw at any time from Cookie settings at the bottom of every page.
Who we share it with
- 20i, who run the UK servers your sites and mailboxes live on.
- Domain registries (for example Nominet for .uk), as every registrar must.
- Stripe, for payments.
- Resend, who deliver our emails to you.
- Cloudflare, who run parts of this website, our API and free previews.
- The National Crime Agency, the Internet Watch Foundation and the police, when we must report crime. We co-operate with lawful requests from them and from regulators.
How long we keep it
- Your account and billing details: while you are a customer, then 6 years, as tax and accounting law requires.
- IP addresses from sign-in and preview-token requests: 12 months at most (sign-in addresses within 2 days).
- Free previews: 7 days, then deleted, unless reported.
- A reported preview and who made it: 1 year. If we report it to the National Crime Agency, the law requires us to keep it, and the details from the two weeks before it was uploaded, for 1 year, and the report reference for 5 years.
- Abuse cases: 2 years, so we can spot repeat abuse and answer claims (5 years for child sexual abuse reports, in case the National Crime Agency or the police need them).
- Support emails and tickets: kept with your account records.
- Hashed internet addresses for referral checks: 30 days. An email kept with a share link's code: 90 days, or until your first paid order. Who referred you, and your credit history, are kept with your billing records.
- Links we email you: sign-in links expire after 15 minutes and work once; preview links after 1 hour; order links when the order starts or is refunded.
Cookies
The cookies the site needs to work: one to keep you signed in, one that tells the menu you're signed in, one that remembers your cookie choice, and, when you pay, Stripe's fraud-prevention cookies. One optional cookie remembers a referral link for 30 days, only if you accept it. No advertising cookies. Every cookie, what it does and how long it lasts.
Your rights
You can ask for a copy of your data, ask us to correct it, or ask us to delete it, by emailing support@help.clicked.cloud. We may refuse to delete data the law makes us keep, such as evidence held for the National Crime Agency. You can also complain to the Information Commissioner's Office. To report abuse, write to abuse@help.clicked.cloud.