Privacy and cookies

Last updated 19 October 2026

This explains what personal information VPS GB collects, why, who else handles it, how long we keep it, and your rights. It covers this website, the customer dashboard, and the services you order through it.

Who we are

VPS GB, London, United Kingdom, is responsible for your personal information (the "controller" under UK data protection law). For anything about your data, email [email protected].

What we collect and why

Your account

When you sign up we collect your name, email address, phone number, postal address and country, and a password. We store your password only as a one-way hash, so nobody here can read it. We use these to create and run your account, contact you about it, and invoice you. Legal basis: contract.

When you sign up, these details and the IP address you signed up from are also posted to a staff channel on our Discord server, so a member of our team can review and approve your account. When you place an order, your name, email address and the details of the order are posted there too, so we know to look after it. Legal basis: legitimate interests (checking new accounts and handling orders promptly).

We confirm your email address with a link that expires after 48 hours, and password reset links expire after 1 hour.

Security and abuse prevention

We record the IP address you signed up from, and keep logs of sign-ins and account activity, to protect your account and our systems and to investigate abuse. We limit repeated failed sign-in attempts by IP address. Legal basis: legitimate interests (keeping accounts and services secure).

If you turn on two-step verification we store your authenticator secret, one-way hashes of your backup codes, and the public part of any passkey you register; never anything that could be used to sign in as you on its own. If you tick "remember this device", we store a one-way hash of a random token for 30 days (see cookies). Changing your password, resetting it, or turning two-step verification off forgets every remembered device.

Billing and payments

We keep invoices, payment records and the services each relates to. Card payments are taken by Stripe: you type your card details into Stripe's own form on our page, so your full card number never reaches us. We see only what Stripe tells us, such as the card brand, last four digits and expiry date, so we can show you which card is on file and remind you before it expires. Legal basis: contract, and legal obligation (keeping financial records).

The services you run with us

Websites, servers, files and anything else you put on a service you buy from us are yours. We process them only to provide that service, keep it running and secure, and back it up where your service includes backups. We do not look through them or use them for anything else.

If you order an SSL certificate, the details you enter for it (such as the domain, organisation and contact details) go to our certificate supplier and the certificate authority so they can validate and issue it. Publicly trusted certificates, and the domain names in them, are published in public Certificate Transparency logs by design; this is how certificates work for everyone, not a choice we make.

Support

If you contact us, by email, the "Get help" form in your account, or the contact form on our homepage, we use what you send us to answer you. The "Get help" form also includes, so you don't have to type them: your name, email and phone number from your account, the reference and type of the service you choose, and which browser you are using. It shows you that list before you send. A "Get help" request is saved as a support ticket in your account, with our replies and yours, so you can follow it; tickets are kept while your account exists and deleted with it. A copy also reaches our support inbox by email. We don't use a live chat service. Legal basis: legitimate interests (answering your question), or contract where it is about a service you have with us.

Website analytics

To understand which pages people use, so we can improve the website, we count visits with Umami, which we run ourselves on our own servers in the United Kingdom. No analytics company is involved, nothing is shared with anyone else, and it sets no cookies and stores nothing on your device. It does not follow you around other websites, and we don't use it to find out who you are.

For each page you view on www.vpsgb.co.uk it records: the page's address, without anything after a "?" or "#" in it; the page you came from, if it was one of ours, or just the address of the site you came from, if not; your browser, operating system and type of device; your screen size and language; and your approximate location (country, region and city), worked out from your IP address. It does not record the page's title, what you type, or your IP address itself: the address is used for that location lookup and, mixed with your browser details and a value that changes every month, to make a random code that groups one visitor's page views together. That code cannot be linked from one month to the next.

We don't count visits to our staff-only area, or to pages whose link carries something private, such as a password reset or an unsubscribe link. Legal basis: legitimate interests (understanding how our website is used).

Error reports

If something on our website goes wrong, a report of the technical error goes to GlitchTip, our own error tracking system, on our own servers in the United Kingdom, so we can fix it. A report contains the error and where in our code it happened, the page's address without anything after a "?", the type of request, and, if you are signed in, your account number. It never contains your password, cookies, what you typed into a form, your email address or your IP address; we remove those before a report leaves the web server. Legal basis: legitimate interests (keeping our services working).

Status updates (only if you choose to)

You can turn on status update emails from your account page or /status-updates. If you do, we record that you asked, and email the address on your account when we post a notice on our status page or schedule maintenance. Every email has a link that turns them off without signing in, and you can turn them off from your account at any time. Legal basis: consent.

Linking your Discord account (only if you choose to)

You can link your Discord account from your account page. If you do, we store your Discord user ID so we can give you the roles that match your services on our Discord server. You can unlink it there at any time. Legal basis: consent.

What we don't do

We don't sell your information or use it for advertising, and we don't track you across other websites. Our analytics are our own and stay with us (see website analytics). We don't make decisions with legal or similarly significant effects about you by automated means alone.

Who else handles it

Our hosting platform, billing system, monitoring, logs, website analytics and error reports run on our own infrastructure in the United Kingdom. We use these providers for specific jobs, and they only get what that job needs:

• Cloudflare: every visit to our website passes through Cloudflare's network, which protects it from attacks. Cloudflare also runs the "are you human" check on our sign-in and sign-up forms, and the DNS records we create for your servers' hostnames.
• Google Fonts: our website's typeface is loaded from Google's servers, so your browser connects to Google, which receives your IP address. No cookies are set.
• Stripe: card payments.
• Mailgun, in its EU region: sends our account and service emails, and delivers support and contact-form messages to our support inbox.
• TheSSLStore and the certificate authority it uses: only if you order an SSL certificate.
• Discord: our staff are notified of new sign-ups and orders in a staff channel on Discord (see above for what is included); and, if you link your Discord account, Discord is how we give you roles on our server.

Some of these providers may process data outside the UK. Where they do, we rely on the safeguards available under UK data protection law, such as UK adequacy regulations or the International Data Transfer Agreement or Addendum.

We may also share information where the law requires it, or to protect our customers or our services from fraud or abuse.

How long we keep it

• Your account: for as long as you have it. Ask us to close it and we will delete what we don't need to keep.
• Invoices and payment records: for as long as UK tax law requires, normally six years.
• Activity and security logs: deleted from the website's own database after 36 hours; copies in our monitoring system are kept for a limited period for security and troubleshooting.
• Website analytics: 7 months, then deleted automatically. They contain nothing that identifies you (see above).
• Error reports: 90 days.
• Remembered devices: 30 days, or until you change your password or turn off two-step verification.
• Data on your services: until you delete it or the service ends; backups expire on their own schedule after that.

Your rights

You can ask us for a copy of your personal information, and to correct, delete or restrict it, to object to how we use it, or to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Email [email protected]; we may need to confirm it's you before acting, and we'll reply within one month.

If you're unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Cookies and similar storage

We only store things on your device that are needed for something you've asked for: signing in, staying secure, or remembering a choice you made. We don't use advertising cookies, and our analytics use no cookies and store nothing on your device, so there is no cookie banner to accept or decline.

You can block or delete cookies in your browser settings. If you block the ones we set, you won't be able to sign in.

Changes to this notice

We'll update this page when what we collect or who handles it changes, and change the date at the top.