Privacy Policy

LowCostDedi, the operator of lowcostdedi.com, is responsible for the personal data described here. You can reach us at any time through our contact form.

• Account: your email, your password stored only as an Argon2id hash, an optional name and company, and — if you turn it on — your two-factor secret, stored encrypted.
• Sessions and security: for each sign-in, a salted non-reversible hash of your IP address, your country as reported by our CDN and your browser’s user agent, so you can review and close your sessions; plus a log of security events (sign-ins, password and two-factor changes).
• Payments: each top-up’s amount, cryptocurrency, deposit address and transaction ID, and your balance history. Payments are processed through our payment orchestrator; we never handle card numbers.
• Servers and messages: the servers you order (plan, location, operating system, optional hostname and notes) and the messages you send us.

We do not access the data stored on your server, except at your request for support or where the law requires it.

To process your order and deliver your server (performance of a contract), to answer your messages, to prevent fraud and abuse (legitimate interests), and to keep accounting records (legal obligation).

Our website does not use advertising or analytics cookies. When you sign in we set one strictly necessary session cookie, and a short-lived cookie to show confirmation messages. Cloudflare Turnstile checks that sign-ups and sign-ins come from a human, and our CDN may set strictly necessary cookies to protect the site against bots and attacks.

Only with providers that help us run the service: our CDN and security provider (Cloudflare, including Turnstile), data-center operators, our payment orchestrator and the payment networks it uses, and our email provider — each bound by confidentiality and data-protection terms. We never sell your data. Some providers may process data outside your country, with appropriate safeguards.

Order, top-up and balance records are kept for as long as accounting and tax law requires. Expired sessions are deleted automatically. Contact messages are kept for up to 24 months. Rate-limiting counters based on hashed IPs expire within one hour.

Depending on where you live, you can ask to access, correct, delete, restrict or export your data, and object to some uses of it. Send your request through our contact form; you can also complain to your data-protection authority.

Traffic is encrypted with TLS, access to our systems is restricted, and IP addresses are hashed before storage. If we change this policy, we update the date at the top of this page and notify customers of material changes by email.