Privacy Policy

Company

PEEPSICK LIMITED (trading as thiswww)

Company number

17503047, registered in England and Wales

Registered office

71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

Contact

[email protected]

Phone

+44 7403 473 228

We are the controller of your personal data under the UK GDPR and the Data Protection Act 2018. Where the EU GDPR applies to you, we also follow it. Customers in Turkey are additionally covered by the KVKK Information Notice (Turkish version of this site).

• Account data: email address, display name, a salted password hash, preferred language, account role and status.
• Order and domain data: domain name, term, price, payment status, and the registrant (WHOIS) contact you enter at checkout: name, company, email, phone, postal address and country. This contact is stored on our server and sent to the registrar.
• Payment data: card payments are processed by Stripe. We receive the payment status and references but never your full card number.
• Service requests: what you submit when asking for hosting or VPS.
• Backup metadata: file names, sizes, types, timestamps, device names and sync status. File contents are end-to-end encrypted on your device; we cannot read them.
• Technical and security data: IP address, browser/user agent and audit-log entries for sign-ins and account actions.
• Messages you send us by email.

• To provide the Service: create your account, register domains, process orders, run Cloud Backup (contract).
• To take payments and prevent fraud (contract and legitimate interests).
• To keep the Service secure, investigate abuse and keep audit records (legitimate interests).
• To meet legal, tax and accounting duties, including registry and ICANN requirements (legal obligation).
• To answer your questions and give support (contract and legitimate interests).

We do not sell personal data and we do not use it for advertising or profiling. We do not run analytics or advertising trackers.

• Domain registrar reseller (domainnameapi.com / Atak Domain, Turkey) and the registry operating the extension you choose: the registrant (WHOIS) contact is transmitted to them to register and manage the domain. WHOIS privacy or redaction is applied by default where the registry and registrar support it.
• Stripe (payment processor): processes card payments and fraud checks.
• Hosting and storage provider: servers, database and object storage that run the Service. Backup files they hold are already encrypted.
• Authorities, when we are legally required to disclose data.

Registrar data is transferred to Turkey, and payment data is processed by Stripe in the United States and other countries. Where this is a restricted transfer under UK or EU GDPR we rely on adequacy regulations or decisions, the UK International Data Transfer Addendum / standard contractual clauses, or another lawful safeguard, and on the necessity of the transfer to perform your contract.

Cloud Backup files are encrypted in your browser or app with keys that never leave your device. We cannot decrypt, scan or recover them. The recovery key is generated locally and only a verifier derived from it is stored on our server. If you lose your recovery key, encrypted contents cannot be restored.

We keep account data while your account exists. Order and invoice records are kept for as long as accounting and tax law require. Registry-required registrant data is kept as long as the domain is registered and for the period the registrar requires afterwards. Security logs are kept for a limited period. When you delete your account we remove or anonymise data that we no longer need.

Under the UK GDPR (and the EU GDPR where it applies) you may have the right to access, correct, delete or export your data, object to or restrict processing, and withdraw consent where we rely on it. To exercise a right, write to [email protected]. We may need to verify your identity first. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or to the data-protection authority of your country.

We use TLS, hashed passwords, access controls and end-to-end encryption for backup contents. No system is perfectly secure, so please use a strong, unique password and protect your recovery key.

See the Cookie Notice. We only use strictly necessary storage.

We will update the date above when this policy changes. Significant changes are announced in the Service.