Privacy Policy

1. Introduction

This Privacy Policy describes how XT HOST ("we," "our," or "us") collects, uses, discloses, and safeguards your personal information when you use our website, hosting services, and related products (collectively, the "Services").

By using our Services, you consent to the practices described in this Privacy Policy. If you do not agree with our policies and practices, please do not use our Services.

2. Information We Collect

2.1 Information You Provide Directly

We collect information you voluntarily provide when you:

• Register an account - Username, email, phone number, password
• Purchase services - Billing address, payment method, domain names
• Contact support - Messages, attachments, communication history
• Update your profile - Additional details, preferences, company info
• Respond to surveys - Feedback, testimonials (with your permission)

2.2 Information Collected Automatically

When you use our Services, we automatically collect:

• Device information - IP address, browser type, OS, device type
• Usage data - Pages viewed, time spent, click patterns
• Log data - Access times, error logs, referring URLs
• Cookies - Session data, preferences, analytics

2.3 Payment Information

We do not store complete payment card details on our servers. Payment information is processed by our PCI-DSS compliant payment processors (bKash, Nagad, Rocket, and card processors). We retain only:

• Last 4 digits of card (for reference)
• Transaction IDs and amounts
• Billing name and address

3. How We Use Your Information

We use your information for the following purposes:

4. Information Sharing

We do NOT sell your personal data to third parties. We may share your information with:

4.1 Service Providers

Trusted partners who help us operate our business:

• Payment processors (bKash, Nagad, Rocket, card networks)
• Domain registrars and registries
• Data center and infrastructure providers
• Email service providers
• Analytics platforms

4.2 Legal Requirements

We may disclose information when required by law, court order, or to:

• Comply with legal obligations
• Protect our rights and property
• Prevent fraud or security threats
• Protect the safety of users and public

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any such change.

5. Cookies & Tracking

We use cookies and similar technologies to enhance your experience:

You can manage cookie preferences in your browser settings. Disabling essential cookies may affect functionality.

6. Data Retention

We retain your personal information for as long as necessary to provide Services and comply with legal obligations:

• Active accounts: While your account is active
• After termination: 30 days for data recovery, then deleted
• Billing records: 7 years (tax/legal requirement)
• Log data: 90 days
• Backups: 30 days rolling

7. Data Security

We implement industry-standard security measures to protect your data:

• Encryption: TLS 1.3 for data in transit, AES-256 for data at rest
• Access Control: Role-based access, 2FA for admin accounts
• Monitoring: 24/7 security monitoring and intrusion detection
• Backups: Encrypted daily backups with offsite replication
• Audits: Regular security audits and penetration testing
• Training: Employee security awareness training

8. Your Privacy Rights

Depending on your location, you may have the following rights:

8.1 For All Users

• Access: Request a copy of your personal data
• Correction: Update inaccurate or incomplete data
• Deletion: Request deletion of your data (subject to legal requirements)
• Portability: Receive your data in a machine-readable format
• Objection: Object to processing for marketing purposes

8.2 GDPR Rights (EU/EEA Users)

• Restriction: Limit how we process your data
• Withdraw Consent: Withdraw consent at any time
• Complaint: Lodge a complaint with supervisory authority
• Automated Decisions: Not be subject to purely automated decisions

8.3 How to Exercise Your Rights

Submit a request via:

• Email: privacy@xtnode.me
• Support Ticket: From your client area
• Contact Form: https://host.rafixt.com/contacts.php

We will respond within 30 days (may extend to 90 days for complex requests).

9. Children's Privacy

Our Services are not intended for children under 13 (or 16 in the EU). We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal data, please contact us immediately.

10. International Data Transfers

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) for EU transfers
• Privacy Shield principles where applicable
• Adequate data protection agreements with all service providers

11. Third-Party Links & Services

Our website may contain links to third-party websites or integrated services (e.g., payment gateways, analytics). This Privacy Policy does not apply to those third parties. We encourage you to review their privacy policies before use.

12. Changes to This Policy

We may update this Privacy Policy periodically. When we make material changes, we will:

• Update the "Last Updated" date at the top
• Send an email notification to registered users
• Display a prominent notice on our website
• Require acknowledgment for significant changes

Your continued use of Services after changes constitutes acceptance.

13. Contact Us

For questions, concerns, or requests regarding this Privacy Policy: