This policy covers spacebarhost.com and the services sold on it by Sysfo Software Solutions Pvt Ltd, trading as SpaceBar Hosting, registered at 609, 6th Floor, Millennium Place, Lucknow, Uttar Pradesh, 110008, India. We are the data fiduciary for the information described here.
1. What we collect
When you buy something: your name, email address, phone number and billing address; your organisation name and GSTIN if you give one; and, for a domain name, the registrant details the registry requires.
When you pay: the amount, the date, the gateway's transaction reference and whether it succeeded. Not your card number. See clause 3.
When you use the service: the server logs a hosting account generates — IP addresses, request times, error records — kept so that we can find faults and investigate abuse.
When you contact us: the content of your tickets and emails, and our replies.
When you browse this site: standard web server logs. Nothing else. This site carries no analytics, no advertising pixels and no tracking scripts of any kind.
2. Why we have it, and on what basis
- To provide what you bought — set up the account, register the domain, issue the certificate, answer the ticket. This is the performance of our contract with you.
- To bill you and to tell you about your service — invoices, renewal reminders, maintenance notices, security warnings. These are service messages; they are not marketing and you cannot unsubscribe from them while you hold a service, because they are how we tell you your site is about to go off.
- To keep the platform safe — investigating abuse, blocking attacks, preventing fraud. This is our legitimate interest, and yours.
- To meet legal obligations — tax invoices, accounting records, and responses to a lawful order.
We send marketing email only if you have asked for it, and every marketing message carries a working unsubscribe link.
3. Payment details never reach our servers
When you pay, the card, UPI or net-banking details are entered on the payment gateway's own page, which is PCI-DSS compliant, and they go straight to the gateway. We never see them, and we never store them. What comes back to us is a transaction reference, the amount, and a success or failure.
Because of that, we hold no standing instruction against your card. Nothing is charged automatically — a renewal happens when you pay a renewal invoice, and not before.
4. Who else sees your information
We share only what a third party needs to do its part of the job, and never for money:
- Domain registries and registrars — registrant details, because a registration cannot exist without them. Some registries publish parts of them in WHOIS; most now redact personal data by default.
- Certificate authorities — the details needed to validate and issue an SSL certificate. A certificate's subject details are public by design and appear in the Certificate Transparency logs.
- Payment gateways — the amount and the order reference, so a payment can be taken and a refund made.
- Control panel and software vendors — what a licence requires.
- Email, SMS and WhatsApp providers — your address or number, so a notification about your service can be delivered.
- Data centres and network providers — who host the servers your service runs on.
- Our accountants, auditors and legal advisers, under a duty of confidence.
- A court, a regulator or a law-enforcement authority, where we are lawfully required to.
We do not sell your personal information, and we do not share it with advertisers.
Some of these providers operate outside India. Where information is transferred abroad we take reasonable steps to see that it is protected to a comparable standard.
5. Cookies
This site sets one cookie:
- sbh_cur — the currency you chose to read prices in, so the page does not switch back to rupees on the next click. It holds a three-letter currency code and nothing else.
Your basket, and your client-area sign-in if you have one, are kept in your
own browser's local storage under the keys sbh.cart.v1,
sbh.coupon.v1 and sbh.session.v1. They stay on
your device and are sent to us only when you act on them. Clearing your
browser data clears them. A control-panel password typed during checkout is
deliberately never written to storage at all — it is sent once, with
the order, and forgotten.
The only third party contacted when a page loads is Google Fonts, which serves the typefaces. There are no advertising or analytics cookies to consent to, which is why this site shows you no cookie banner.
6. How long we keep it
- Invoices, payments and tax records — eight years, as the Companies Act and the tax rules require. We cannot delete these on request.
- Account and contact details — while you hold a service with us, and then as long as the financial records above require.
- Website files, databases and email on a hosting account — deleted about 30 days after the service is terminated or expires. Backups age out on their own cycle after that.
- Support tickets — three years, so that the history of a recurring problem is still there.
- Server and access logs — normally 90 days, longer where a specific abuse or security investigation needs them.
7. Your rights
Under the Digital Personal Data Protection Act, 2023, you may ask us to:
- tell you what personal data of yours we hold and who we have shared it with;
- correct anything inaccurate or incomplete;
- erase data we no longer have a lawful reason to keep;
- withdraw a consent you gave — though withdrawing consent we rely on to run a service means we can no longer run it;
- nominate someone to exercise these rights if you die or become incapable.
Write to the address in clause 10 from the email address on your account. We answer within 30 days. Most of it you can do yourself in the client area, which is faster.
8. How we protect it
The site and the client area are served over TLS. Passwords are stored hashed, never in a form we can read back. Administrative access is limited to the staff whose job needs it. Servers are patched, monitored and backed up as described in the Terms of Service.
No system is perfectly secure. If a breach affects your personal data we will tell you and the Data Protection Board as the Act requires, with what happened and what to do about it.
9. Children
These services are sold to adults. We do not knowingly collect the personal data of anyone under 18. If you believe a child has given us data, tell us and we will remove it.
10. Contact and grievances
For anything about this policy, or to exercise a right under clause 7, contact our Grievance Officer:
If you are not satisfied with how we have dealt with a complaint, you may take it to the Data Protection Board of India.
11. Changes
We may update this policy. The current version is always the one on this page, with the date it was last changed at the top. Where a change materially affects how we use your information, we tell you by email before it takes effect.