Privacy Policy

1. Who We Are

Winter Storm Systems LLC ("we", "us") operates winterstormsystems.com and winterstormhosting.com and provides hosting services. We are the data controller for the personal data described in this policy, meaning we decide what is collected and why. This policy explains what we collect, why, who we share it with, and the choices you have. It applies to our website, client area, and services.

You can contact us about anything in this policy, including a request to exercise any of the rights in section 8, at [email protected] or through a support ticket in your client area.

2. Data We Collect

Account data — name, email address, password (stored only as a salted hash), and optionally company, phone, and billing address.

Order & billing data — the services you purchase, invoices, transactions, applied credit and promo codes. We never store card numbers: payments are processed by Stripe and PayPal, and only gateway tokens plus display metadata (card brand, last four digits, expiry) are kept for saved payment methods.

Service data — configuration you provide at order time (hostnames, domains, chosen options) and identifiers needed to manage your service on our control panels.

Support data — tickets, replies, and files you attach to them.

Technical data — IP addresses on registration, login, and orders (security and fraud prevention), session cookies, and activity logs of account actions (logins, orders, service changes).

3. How We Use Your Data

• To provide, bill, and support the services you order (contract performance);
• to secure accounts — login rate limiting, two-factor authentication, session protection (legitimate interest);
• to screen orders for fraud, using order velocity, email domain, and account age signals (legitimate interest);
• to send transactional email: invoices, payment results, service and ticket notifications, quotes;
• to send occasional service announcements to customers (you can ignore these; they relate to services you hold);
• to comply with legal, tax, and accounting obligations.

We do not sell your personal data, and we do not use it for third-party advertising.

4. Third Parties We Share Data With

We share only what each provider needs to do its job:

• Stripe / PayPal — payment processing (name, email, amount; card data goes directly to them, never through us);
• Control panels (e.g. our game/VPS/web hosting panels) — your name and email, to create the panel account tied to your service;
• Cloudflare Turnstile — bot protection on forms (your IP and a browser challenge; no account data);
• Have I Been Pwned — at registration we check passwords against known breaches using k-anonymity: only the first 5 characters of a hash are transmitted, never your password or email;
• Error monitoring (Sentry) — technical error reports which may include your IP and the page you were on;
• AbuseIPDB — when enabled, we check your IP address against a known-abuse database as a fraud signal when you place an order (your IP only, no account data);
• VirusTotal — when enabled, files you attach to support tickets are screened for malware by their SHA-256 hash; the file's contents are never uploaded, only the hash;
• Email delivery — our SMTP provider processes the emails we send you.

Each provider processes data under its own privacy terms. We do not share data with any other third parties except where required by law.

5. Cookies

We use a single essential session cookie to keep you signed in. It is HttpOnly, restricted to same-site requests, and marked Secure over HTTPS. We do not use advertising or cross-site tracking cookies.

6. Data Retention

Account and billing records are kept while your account is active and thereafter as long as required for tax and accounting purposes. Service data is deleted when a service is terminated (see the Terms of Service regarding backups). Activity and email logs are rotated automatically. You may request deletion of your account; we will delete or anonymize personal data that we are not legally required to retain.

7. Security

Passwords are stored using modern one-way hashing; payment credentials never touch our servers; administrative access is role-restricted and logged; forms are protected against cross-site request forgery; and login endpoints are rate-limited. No system is perfectly secure — if we become aware of a breach affecting your data, we will notify you without undue delay.

8. Your Rights

Depending on your jurisdiction (e.g. GDPR, CCPA), you may have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing. You can update most account data directly in your profile. For anything else, contact us and we will respond within the timelines required by applicable law.

9. Children

Our services are not directed at children and may not be used by anyone under 18 (see Terms of Service). We do not knowingly collect data from children.

10. Changes & Contact

We may update this policy; material changes will be announced on our website or by email, and the date above always reflects the current version. Privacy questions or requests: [email protected] or a support ticket from your client area.