Privacy Policy

This Privacy Policy explains how VPS.SC collects, uses, shares and protects personal data when you use our cloud of virtual machines and the Workspace at my.vps.sc. We collect what we need to give you an Account, run your Machines, support you and keep the Services secure. We do not sell personal data, we show no ads, and we use no analytics or tracking tools; every email we send is about your Account or the Services. At launch, the Services are free for invited customers and charging is off. We do not accept payments or deduct usage charges. When paid top-ups are introduced with your agreement, Stripe will handle them, so your full card details will go to Stripe, not to us. References to payments, tax, invoices and Balance enforcement below apply only when paid service is available. What you keep on your Machines is your Content: you control it, and we handle it on your instructions to run the Services. Section 12 explains the few cases in which we handle limited evidence about abuse or a claim for our own purposes. You can ask us to show you, correct, export or delete your personal data by writing to hello@vps.sc.

1. Who we are

1.1 VPS.SC is a trade name of Jooule LLC, a New York limited liability company. Jooule LLC is responsible for the personal data this policy describes (in UK and EU law, it is the “controller”). Personal data in Content is different: we handle it on our customers’ instructions, as section 12 explains. Section 12.2 also says when we handle limited evidence about abuse or a claim for our own purposes.

1.2 This policy uses words that our Terms of Service define, with the same meanings. Here they are, word for word as our Terms of Service give them:

• “VPS.SC”, “we”, “us” and “our” mean Jooule LLC doing business as VPS.SC.
• “you” and “your” mean the person who accepts these Terms and, when that person acts for a business or other legal entity, that entity too.
• “Services” means everything we provide under the VPS.SC name: Machines, storage, networking, DNS hosting, the content delivery network (CDN), the Workspace, our programming interfaces and our support.
• “Account” means one person’s own login to the Services.
• “Content” means the software, files and data that you, or anyone acting through your Account or your Machines, store on or send through the Services: what is on your Machines and volumes and in their snapshots and backups, the files in your CDN zones, and your DNS records.
• “Machines” means the virtual machines (virtual servers) created through the Services.
• “Resources” means Machines and everything else created through the Services, such as volumes, snapshots, backups, IP addresses, firewalls, DNS zones and CDN zones.
• “Workspace” means our customer panel at my.vps.sc.
• “Project” and “Organization” mean the groups in the Workspace that hold Resources and the people who work on them.
• “Balance” means the prepaid amount, in US dollars, held for an Account.
• “Credits” means value we add to a Balance free of charge, such as a gift card or a promotional code.

In this policy, “these Terms” in those definitions means our Terms of Service. Where this policy talks about personal data and the rights that come with it, “you” means you as a person: someone who uses the Services, is invited to a Project or contacts us. “Personal data” means information about an identified or identifiable person. Some US laws call it “personal information”; this policy uses the two terms the same way.

1.3 This policy covers the Services and how we deal with you. Our Terms of Service and our Acceptable Use Policy set the rules for using the Services, and this policy does not repeat them. It does not cover other companies’ sites and services, such as Stripe’s payment page, which have their own privacy policies.

1.4 Our company privacy contact handles questions and requests at hello@vps.sc or +1 (347) 837-7382, and at the postal address in section 14.

2. The personal data we collect

2.1 Data you give us

• Account details. Your name, your email address (it is also how you sign in), your password, and the key and backup codes of your two-step verification. We store your password only as a hash, never as you typed it, and your backup codes the same way.
• Profile. The region the Workspace suggests first when you create a Machine, and a profile photo if you add one. Your photo is private: only people who are signed in to the Services and may see you there, such as the people in your Projects and Organizations and our team, can open it. If the same image is also published somewhere as a public file, for example in a CDN zone or at a public link it had before, that copy stays public. Copies that others have already made are outside our control.
• Billing details. Your country, your postal address and, if you give them, a company name and a VAT number. They appear on your invoices and receipts.
• Support requests. The tickets you open (their subject, category, priority, the Machine they are about and your messages), and what you tell us by email at hello@vps.sc or by phone, with the email address or phone number you contact us from.
• Your team. The email address of each person you invite to a Project, and the role you give them, and any email addresses you add to receive budget alerts.
• Access to your Machines. The names you give your Machines and other Resources, including each Machine’s hostname, which is published in public DNS (section 4.10), your SSH public keys (each with its name and fingerprint), and the root password of a Machine: one you set, or the one we generate when you order a Machine with neither an SSH key nor a password. We store these root passwords encrypted, so that you can reveal them later, and each time you reveal one we record that you did and from which IP address. Members of our platform team can also see them (section 4.2).
• Codes you redeem. The gift card and promo codes you redeem, and when.
• Your acceptance of our Terms of Service. Which version you accepted, and when.

You need a name, an email address and a password to have an Account. Other details, such as a VAT number or a profile photo, are optional.

2.2 Data we record when you use the Services

• Sign-ins and sessions. For each sign-in: the IP address, the device, browser and operating system it reports, and its times. A sign-in lasts at most 7 days. Settings in the Workspace lists the sign-ins that still work, and you can end any of them. We also keep the IP address your Account was created from, and the IP address and time of your last sign-in.
• Activity records. For each action in your Account, such as signing in, changing your password or creating or deleting a Machine: what was done, to what, by whom, when, and from which IP address and browser (its user-agent string). Some actions, such as revealing a root password, changing billing details or uploading a file, are also written to a separate audit record with the values before and after.
• Usage and billing records. What you run and for how long, what it costs, your Balance, and every top-up, Credit, gift card, promo code, invoice, receipt and budget. For each payment we keep its amount, its status and the payment provider’s references to it.
• Your Resources. For each Machine: its name, size, image, region, IP addresses, status and history (such as started, stopped or suspended), who created it and when, its CPU and memory readings, how full its disks are, and whether it answers on the network. We also keep your volumes, snapshots, backups, firewalls and their rules, floating IP addresses with who attached or detached them and when, DNS zones, and CDN zones with their custom domains, upload logins and traffic totals. We show the password of a CDN upload login only once, when it is made or reset, and we store CDN API keys only as hashes.
• Notices. The notifications in the Workspace and the emails we send you.
• Logs. Our web servers keep logs of the requests they answer, with the IP address, the time, the request and the browser. Our application logs record events such as a blocked sign-in or an email sent, with the email address or IP address involved.
• Our team’s notes. Notes our platform team writes about your Account, and internal notes on your tickets, which the Workspace does not show you.

2.3 Data we get from others

• The person who invites you. When an Owner or Admin of a Project, or our platform team, invites you, they give us your email address and any other details they enter for you, such as your role in a Project.
• Stripe. When paid top-ups are available and you add funds, Stripe tells us whether the payment succeeded, its amount and its references, and whether it is later refunded or disputed. Stripe does not give us your full card number.
• Public DNS. When you connect a domain to the Services, we look it up through public DNS resolvers to check where it points.
• People who report abuse. When someone tells us that something in your Account or your Content breaks our Acceptable Use Policy or infringes their rights, their report can include personal data about you, such as an IP address, a domain name or what your Content shows.

2.4 If you report abuse to us

If you report abuse, or send us a copyright notice or counter-notice under section 5 of our Acceptable Use Policy, we collect your name, how to reach you, what you report and the evidence you send, which can include personal data about other people. A copyright notice or counter-notice also holds the statements and the signature the law asks for, and a counter-notice holds your postal address and phone number.

2.5 What we do not collect

• Your full card number. When paid top-ups are available, you pay on Stripe’s own page.
• Data for advertising or analytics. The Workspace and our emails contain no analytics, advertising or tracking tools, and our emails carry no tracking pixels.
• Your location. We do not work out where you are from your IP address. Our CDN works out only the rough location of a visitor’s network, to send the visitor to its nearest server (section 12.4).

3. How we use personal data

We use personal data for the purposes below. Where UK or European Economic Area (EEA) data protection law applies to the processing, the table also gives the legal basis for each use.

In this table, “legal obligation” means a duty under UK law for the UK GDPR, and a duty under the law of the EU or of an EU member state for the EU GDPR. A duty under another country’s law is not enough on its own. Where we act on such a duty, we rely on legitimate interests, and only after weighing the interests and rights of the people affected. A demand from a foreign authority does not by itself make a disclosure lawful, and the legal limits on disclosure and transfer still apply.

Where the table says “contract”, we need the data to perform our contract with you. If you use the Services for an organization, the contract is with that organization, and the legal basis for your own data is our legitimate interest in providing the Services the organization uses. Where we rely on legitimate interests, you can object (section 8.2).

Automated decisions. No Balance-based suspension or deletion applies during the free launch. Once charging starts with your agreement, our systems decide on their own, from your Balance and what you owe:

• whether a new Machine may start: it starts only when your Balance covers its first minutes of use;
• when your Balance no longer covers what you owe, to suspend your running Machines, which switches them off, and to switch off your CDN zones, so that their files are no longer delivered; and
• if your Balance still does not cover what you owe 7 days after a Machine was suspended, to delete that Machine with its snapshots, and its backups about a day later.

We warn you in the Workspace and by email when your Balance is running low, and we tell you when Machines are suspended. A deleted Machine cannot be brought back, and the Content on it is lost. These decisions follow from the prepaid billing you agree to in our Terms of Service (section 5), and you can avoid them by keeping enough money in your Balance. If you think a decision is wrong, write to hello@vps.sc and a person will look at it.

We do not use personal data for advertising or to build marketing profiles, and we do not sell it (section 4.9).

4. Who sees personal data, and who we share it with

4.1 People in your Project and Organization. People in the same Project or Organization can see your name, email address and role, and your profile photo if you add one. They can see the Project’s activity records, which show what you did in the Project and when, but not the IP address or browser it came from. The tickets you open can be visible to them, as the Workspace explains when you open one. They do not see your SSH keys, your sessions or your sign-in records.

4.2 Our team. Members of our platform team can see your Account and its data. For the reasons section 7 gives, they can sign in to your Account, see the root passwords stored for your Machines and open a Machine’s console. When a member of our team signs in to your Account, the sign-in appears among your sessions in the Workspace while it lasts, and it is recorded in your Account’s activity records.

4.3 Service providers and other recipients. Other companies provide parts of the Services for us. Each receives only the personal data it needs for what it does:

• Stripe, when paid top-ups are available, takes payments. It receives the details of each payment, what you enter on its payment page and, where we send them, your email address and billing details. It also handles them under its own privacy policy.
• Let’s Encrypt, a certificate authority, issues the security certificates for the custom domains you add to CDN zones, and receives those domain names. Certificates, with the domain names they cover, are published in public certificate logs.
• Public DNS resolvers, such as those run by Cloudflare and Google, receive the domain names we look up to check where they point (section 2.3).
• Lagrange (London, United Kingdom) and TierNET (New York and Dallas, United States) provide the dedicated servers on which our Machines, with the Content on them, run (section 5.2), and the CDN’s delivery servers in those places.
• Lagrange also hosts our central servers (database, files, logs and the CDN’s control server) and our backup storage, in London.
• TierNET also hosts our DNS infrastructure, in Binghamton, New York.
• Other hosting and network providers: any other companies whose data centers, servers and networks house, connect or serve the Services (section 5).
• Google Workspace sends our emails, such as invitations, password links, invoices and notices, and hosts the hello@vps.sc mailbox. It receives each email’s recipient, subject and content, including attachments such as invoices, and the messages you send to hello@vps.sc.
• T-Mobile Business provides our published phone line and carries calls to that number.

Before another company starts to handle personal data in Content for us, we add it to this list (section 8.4 of our Terms of Service). Some of these companies, such as Stripe, also handle data under their own legal duties and privacy policies.

4.4 Reports of abuse. When someone reports that something in your Account breaks our Acceptable Use Policy, we may pass the report on to you so that you can put things right. If you report abuse, we share the information needed to investigate or respond. We disclose your identity or contact details only where necessary for that purpose or required by law, not by default. Tell us about any safety or confidentiality concern. Where appropriate and lawful, we tell you before disclosing identifying details. A copyright notice may need to be forwarded in full to handle the claim; we explain that when practicable. If you send a copyright counter-notice, we pass it, with your name and contact details, to the person who sent the notice.

4.5 Professional advisers. Our accountants and lawyers, where they need personal data to advise us or to keep our books.

4.6 Legal requests and protection. We disclose personal data when we believe in good faith that the law requires it, such as to answer a valid court order, subpoena or other legal process, or to report child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC). We also disclose it when it is needed to protect the rights, property or safety of our customers, the public or us, including to prevent fraud and abuse.

4.7 A sale or reorganization of our business. If we sell, merge or reorganize all or part of our business, or prepare to, personal data may pass to the buyer or successor and their advisers. Anyone who receives personal data this way must handle it as this policy describes, unless you are told otherwise first.

4.8 At your direction. We share personal data when you ask us to, for example when you invite someone to a Project or publish files through a CDN zone (section 12).

4.9 We do not sell personal data. We do not sell personal data, and we do not share it for cross-context behavioral advertising (ads aimed at you from your activity on other sites and apps). We have not done either in the past 12 months.

4.10 Your Machines’ names in public DNS. Each Machine gets a public name under ssh.sc, our own domain, made from the hostname you choose for it and a short code, and pointing at the Machine’s IP address. Anyone can look up that name and address in public DNS until the Machine is deleted, when we remove the name. Copies kept by others, such as DNS caches and archives, may remain after we remove it. So do not put personal data, such as a person’s name, in a hostname.

4.11 Your CDN zones’ addresses in public DNS. Each CDN zone gets a public address under cdn.sc, our own domain, made from the name you choose for the zone. Anyone can look up that address and download the zone’s files from it until the zone is deleted, when we remove the address. Copies kept by others, such as DNS caches and archives, may remain after we remove it. So do not put personal data, such as a person’s name, in a zone’s name.

5. Where we keep personal data

5.1 We are a US company. Our central servers, which hold our database, files and logs and run the CDN’s control server, are hosted by Lagrange in London, United Kingdom. Our DNS infrastructure is hosted by TierNET in Binghamton, New York, United States. We also keep personal data on the servers in our regions (section 5.2) and with the companies in section 4.3, including Google Workspace for our emails and our mailbox. Those companies may process data in other countries too.

5.2 You choose the region of each Machine, volume, firewall and floating IP address when you create it, and the region does not change afterwards. Our regions are in London, United Kingdom, and in New York and Dallas, United States. A Machine or a volume is kept in its region, with its snapshots and the Content on them. Backups are kept on storage hosted by Lagrange in London, United Kingdom, which may be outside your Machine’s region. Files in CDN zones are stored on our central servers in London and delivered from the CDN’s servers in our regions.

5.3 International transfers. We are a US company. We keep personal data in the United Kingdom and the United States, and the companies in section 4.3 may handle it in other countries too, whose laws may not protect it as the laws where you live do. If you are in the UK or the EEA and want to know how your data is protected when it is sent out of there, or want a copy of a safeguard that applies, write to hello@vps.sc. For personal data in Content, see section 8.5 of our Terms of Service.

6. How long we keep personal data

6.1 How long we keep personal data depends on what it is. Where the table says “no set end date”, we do not delete the data after a fixed time: we keep it for the purposes in section 3.

6.2 When your Account is deleted. Copy what you want to keep first, as section 10.5 of our Terms of Service says. When your Account is deleted, we delete the Machines, volumes, floating IP addresses, firewalls, private networks and CDN zones it holds, with their Content, and the Projects and Organizations only you are in. We delete your profile photo and your SSH public keys, end the links to files made with “Export your data” and delete those files, retrying if a deletion fails. A copy of your photo that is also published as a public file is not deleted with it (section 2.1). We clear your name, email address, postal address, two-step verification, the IP address of your last sign-in and our team’s notes about you, and your password stops working. We keep, for the periods in section 6.1:

• your Account’s Balance, and your invoices, receipts and other billing and usage records with the details on them;
• without your name or email address, the company name and VAT number of your billing details, and the IP address your Account was created from;
• the record of your acceptance of our Terms of Service, your notifications, and the records of your sign-ins, with the IP address, browser and times of each;
• the activity records of your Account, without your name, IP address or browser: they show a deleted account instead;
• the audit records of your Account, which keep the email address and IP address each recorded action came from;
• the invitations sent to your email address, which keep that address (section 6.1);
• the public tickets you opened, and your messages on other public tickets, in a Project that continues without you, shown as from a deleted account.

We delete your other support tickets, and the list of your sessions.

DNS zones are not deleted with your Account: they stay on our DNS servers until you or we delete them. Delete them before you ask us to close your Account, or ask us to delete them too.

6.3 Legal holds and backups. A legal duty, or a binding order to preserve, can make us keep particular records longer than sections 6.1 and 6.2 say. We may also keep the limited records we need for a specific claim, where the law allows it; for Content, section 12.2 sets the limits. A possible claim alone is not a reason to keep Content that we must delete as your processor.

Our central systems are backed up in London on a rolling basis for up to 30 days, so deleted data can remain in those copies until they roll over.

7. How we protect personal data

• Connections to the Services are encrypted (HTTPS).
• We store passwords and backup codes only as hashes, and the root passwords we keep for your Machines (section 2.1) encrypted.
• Every Account must use two-step verification with an authenticator app. We limit repeated sign-in attempts, and we block for a time network addresses that keep failing.
• A sign-in lasts at most 7 days. Changing your password ends your other sessions, and Settings shows your sessions so that you can end any of them.
• Members of our platform team access your Account, your Machines and your Content only as needed to provide, run, secure and support the Services; to prevent or look into abuse, fraud or a breach of our Terms of Service or our Acceptable Use Policy; to comply with the law; or when you ask us to or agree. This is the rule in section 7.1 of our Terms of Service. When they sign in to your Account, it shows as section 4.2 says.
• No system is perfectly secure. If a security incident affects your personal data, we tell you, and the authorities, when the law requires it.

You can help: keep your password, your authenticator app, your backup codes and your SSH keys safe, and write to hello@vps.sc straight away if you think someone else has used your Account.

8. Your rights and how to use them

8.1 See, correct, export or delete your data

• See and correct. In the Workspace you can change your name, default region, photo and password, manage your two-step verification, and see and end your sessions. Billing shows your billing details, and you can edit them there. Only our platform team can change the email address you sign in with: write to us from that address. You can ask us for a copy of everything else we hold about you.
• Export. You can ask us at hello@vps.sc for a copy of your personal data in a machine-readable file. You can also use “Export your data” in Settings: it makes a copy of your Account’s data in one file and emails a link to it to your sign-in address. The link works for up to 7 days. We then delete the live export copy through scheduled cleanup, retrying failed deletions. This export covers Account records, not the disks or workloads of your Machines; section 10.5 of our Terms of Service says how to copy your Content. The file leaves out passwords, two-step secrets, backup codes and our team’s internal notes. If a part of your data is very large, that part of the file may be shortened, and the file says so. For a complete copy, write to hello@vps.sc.
• Delete. To close your Account, open a support ticket in the Workspace or write to hello@vps.sc from your Account’s email address. Closing your Account deletes your personal data as section 6.2 says, which also says what we keep. If things you made are in a Project other people are in, they may pass to an Owner, Admin or Member of that Project, or be deleted, before your Account is deleted; we still answer your request within the time section 8.4 gives, and tell you of any limit the law sets and when the deletion happens. We carry out a deletion the law requires without undue delay. To leave a Project but keep your Account, ask an Owner or Admin of the Project to remove you.
• Emails. Every email we send is about your Account or the Services, such as invoices, security notices and alerts. We send no marketing emails, so there is nothing to unsubscribe from: you receive these emails while you have an Account.

8.2 If you are in the UK or the EEA

Where the UK GDPR or the EU General Data Protection Regulation (GDPR) applies to the processing, your rights under that law include:

• access your personal data and get a copy of it;
• have inaccurate data corrected and incomplete data completed;
• have your data erased when there is no good reason for us to keep it;
• restrict how we use your data, for example while we look into a complaint about its accuracy;
• receive the data you gave us in a machine-readable file, and have it sent to another company where that is possible;
• object to our use of your data where we rely on legitimate interests; we then stop, unless we have compelling grounds to continue or need the data for legal claims;
• withdraw your consent where we rely on it, at any time and without affecting what we did before;
• not be subject to a decision based only on automated processing that significantly affects you, except as the law allows, and to have a person review such a decision (section 3);
• complain to a data protection authority, in the country where you live or work or where you think the law was broken. In the UK, this is the Information Commissioner’s Office (ico.org.uk). You can also come to us first at hello@vps.sc.

8.3 If you live in California or another US state with a privacy law

This section applies to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), or another US state privacy law applies to us.

What we collect. The categories we collect through the features you use are below (including collection in the past 12 months where those features were used), from the sources in section 2 and for the purposes in section 3. We disclose each category for business purposes only to the recipients in section 4, and we keep it as section 6 describes.

We use sensitive personal information only to let you sign in and to keep your Account secure, and never to infer anything about you. We do not sell personal information or share it for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing personal information of anyone under 16.

Your rights. Depending on where you live, you can ask us to:

• tell you what personal information we have collected about you, where it came from, why we use it and who we disclose it to, and give you a copy of it in a portable format;
• delete the personal information we collected from you;
• correct inaccurate personal information;
• stop selling or sharing your personal information, or using it for targeted advertising. We do neither, so there is nothing to opt out of;
• opt out of profiling that produces legal or similarly significant effects. The only decisions we make by automated means are the billing decisions in section 3; if you think one is wrong, write to hello@vps.sc and a person will look at it;
• limit the use of your sensitive personal information. We already use it only for the purposes the law allows.

We will not discriminate against you for using these rights: we will not refuse you the Services, charge you a different price or give you a different level of service because you used them.

Appeals. If we decline your request, you can appeal by replying to our answer. If we deny your appeal, you can contact the attorney general of your state.

Authorized agents. Someone you authorize can make a request for you. We may ask them for proof that you authorized them, and ask you to confirm your identity with us directly.

8.4 How we handle requests and complaints

• Make a request by writing to hello@vps.sc, preferably from the email address you sign in with, or by calling +1 (347) 837-7382.
• To protect your data, we check that a request comes from you, for example by writing back to your sign-in address. We use the information you give us for this only to check your request.
• We answer within 1 month under UK and EU law, and within 45 days under US state laws. Where the law allows a longer period for a complex request, we tell you if we need it.
• Requests are free. Where the law allows, we may refuse a request that is clearly unfounded or excessive, or charge a reasonable fee for it.
• Some rights have limits. For example, we keep the records the law requires us to keep, such as invoices, and we tell you when a limit applies to your request.
• If you complain to us about how we handle your personal data, we confirm within 30 days that we have received your complaint, look into it, and tell you what we found.

9. Cookies and browser storage

9.1 The Workspace uses no cookies or similar tools for analytics or advertising, and it loads nothing from other companies’ servers: its pages, fonts and images all come from us.

9.2 The Workspace keeps a few things in your browser so that it works:

You can remove all of it at any time by clearing your browser’s stored data for vps.sc.

9.3 Because we do not track you across sites and do not sell or share personal information, a Do Not Track or Global Privacy Control signal from your browser has nothing to switch off.

10. Phone app

We do not offer a phone app at present.

11. Children

The Services are not for anyone under 18 (section 1.5 of our Terms of Service): you must be at least 18 to open or use an Account. We do not knowingly open Accounts for children. If we learn that an Account holder is under 18, we close the Account and handle its data as sections 6 and 8 explain. Customers’ Content may contain children’s data; we handle it on the customer’s instructions, as section 12 explains. If you believe a child has an Account, or have a concern about children’s data, write to hello@vps.sc.

12. Data you keep on your Machines (your Content)

12.1 You decide what Content you keep on the Services, and you control it. Your Content may include personal data about other people, such as the users of a website or app you run on a Machine. For that personal data, you or the organization you act for decide how it is used, and we act on your behalf: in UK and EU law we are your processor (or your subprocessor, where you act for someone else), and under US state privacy laws your service provider. Section 8 of our Terms of Service sets out what we do with it and our commitments.

12.2 For hosting, backups, support and the other things we do with Content on your instructions, we are your processor or subprocessor, and we do not use it for our own purposes. We access it only as needed to provide, run, secure and support the Services; to prevent or look into abuse, fraud or a breach of our Terms of Service or our Acceptable Use Policy; to comply with the law; or when you ask us to or agree. We do not sell Content or use it for advertising.

Separately, where the law allows it and only as far as strictly needed, we may handle limited records or evidence for our own purposes: to look into a specific report or incident of abuse, fraud or a breach of our rules; to explain or review what we did about it; to meet a binding duty to report or preserve; or to establish, exercise or defend a specific legal claim. For that limited handling we decide why and how it is done, so we are its controller. That does not make us the controller of the rest of your Content, and we do not reuse it. We keep the evidence, and the people who can reach it, to what the purpose needs, and we use the legal bases in section 3 and keep it as section 6 says. A clause in a contract, or a possible future claim, is not enough on its own. Sensitive data, such as health data or data about crimes, needs the extra conditions and safeguards the law sets; legitimate interests alone are not enough for it.

12.3 To run your Machines, our systems:

• read how full a Machine’s disks are, about every 15 minutes while it runs, and its network settings, through the QEMU guest agent inside the Machine, and use that agent to run the commands that set up the floating IP addresses you attach to it;
• check every 60 seconds whether each Machine answers on the network;
• copy a Machine’s whole disk when you or your backup schedule take a backup or a snapshot, and its memory too when a snapshot is taken while it runs;
• place the root password you set, or the one we generate, and the SSH keys you choose on a Machine when it next starts;
• show a Machine’s screen in the browser console to you and your team and, when it is needed, to our platform team.

12.4 Files you put in a CDN zone are public: anyone with their address can download them, and each zone’s address under cdn.sc is public too (section 4.11). The CDN counts traffic in 5-minute totals from log lines that do not include visitors’ IP addresses. To send each visitor to the nearest of its servers, the CDN’s own name servers look at where the visitor’s lookup of a CDN address comes from: the IP address of the visitor’s DNS resolver or, when the resolver passes it on, the first part of the visitor’s own IP address, usually enough to show their network but not their device. They look that address up in a copy of the DB-IP City Lite database kept on our own servers, which gives its rough location, and answer with the address of the nearest server. No address is sent to another company for this, and the name servers keep no record of the address, the location found for it or the lookup (section 6.1). DNS records you publish through the Services are public by nature.

12.5 Section 8 of our Terms of Service sets out our commitments for personal data in your Content, as your processor, and the companies we use are listed in section 4.3.

12.6 For personal data in Content that we host on a customer’s instructions, contact that customer: they decide how it is used. If you contact us instead, we pass your request on where we can identify them. For limited evidence we handle independently as described in section 12.2, you can exercise your rights directly with us through section 8.

13. Changes to this policy

We may change this policy, for example when the Services or the law change. We publish each new version with its “Last updated” date. If a change materially affects you, we tell you by email to your Account’s email address at least 30 days before it takes effect.

14. Contact us

For questions, requests or complaints about privacy:

• Email: hello@vps.sc
• Phone: +1 (347) 837-7382
• Post:

VPS.SC is a trade name of Jooule LLC,
a New York limited liability company.
41 State Street, Suite 112
Albany, NY 12207 · United States