Privacy Policy

1. What We Collect

When you place an order, we collect the following information:

• Contact information: Full name, email address, phone number (optional)
• Location data: Country (for billing purposes)
• Payment information: Payment method and transaction reference ID. We do not store credit card numbers — payments are handled by third-party processors (PayPal, crypto wallets, Wise)
• Service preferences: Chosen plan, operating system, billing period
• Communication handles: Telegram or Discord username (optional, for support)
• Notes: Any additional information you voluntarily provide with your order

When you visit this website, standard server access logs may record your IP address, browser type, referring URL, and pages visited. These logs are not shared with third parties and are rotated regularly.

If you create a customer dashboard account, we also store your hashed password. Passwords are never stored in plaintext.

2. How We Use Your Data

We use the data we collect solely for:

• Provisioning and managing your VPS service
• Sending service-related emails (credentials, expiry warnings, renewal notices)
• Responding to your support requests
• Investigating and responding to abuse reports where your VPS is involved
• Complying with valid legal requests from law enforcement

We do not use your data for marketing, advertising, analytics, or any purpose beyond what is listed above.

3. Data Storage

Your data is stored in a MySQL database on our server located at host IP 147.135.215.238. This database is accessible only to our administrative team and is not exposed to the internet.

We do not use third-party databases, cloud storage services, or analytics platforms to store your personal data. No data is stored with Google, AWS, or similar providers.

4. Data Retention

We retain your customer record for as long as your VPS account is active. After permanent deletion of your VPS (due to expiry + grace period, or your request), your personal data is retained in our logs for up to 90 days for abuse investigation purposes, after which it is purged.

Abuse reports are retained for up to 12 months regardless of VPS status, as required for legal compliance.

5. Who Has Access

Your data is accessible only to NATBox operators. We do not share, sell, rent, or disclose your personal information to any third party, except:

• Law enforcement: When compelled by a valid legal order, warrant, or court request from a jurisdiction with authority over us
• CSAM reporting: Reports of child sexual abuse material are forwarded to NCMEC and relevant authorities as required by law
• Abuse escalation: In the case of severe abuse (active DDoS campaigns, malware distribution), we may share relevant IP and timing data with affected parties or upstream providers

6. Cookies & Tracking

This website does not use tracking cookies, advertising cookies, or third-party analytics scripts. We do not use Google Analytics, Facebook Pixel, or any similar technology.

We use a single session cookie for the customer dashboard login. This cookie contains no personal data beyond a session token, and expires when you close your browser or log out.

7. Email Communications

We send the following automated emails:

• Order acknowledgment (upon order submission)
• Payment link (when we send payment instructions)
• Welcome email with VPS credentials (upon provisioning)
• Expiry warning (3 days before expiry)
• Suspension notice (upon expiry)
• Deletion notice (after grace period)
• Support ticket replies
• Abuse report acknowledgment

We do not send promotional emails or newsletters. You will only receive emails directly related to your service or support requests.

8. VPS Content

We do not actively monitor, scan, or access the contents of your VPS. Your container is yours. We access VPS infrastructure only when:

• Responding to a verified abuse report involving your server
• Required by a valid legal order
• Performing infrastructure maintenance that does not involve accessing your data

9. Your Rights

You have the right to:

• Access: Request a copy of the data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data (subject to legal retention requirements)
• Portability: Request your data in a structured, machine-readable format

To exercise any of these rights, contact us at natboxiomail@gmail.com. We will respond within 30 days.

10. Security

We take reasonable measures to protect your data:

• Database stored only on our secured, firewall-protected server
• Database access restricted to local connections only (no remote DB access)
• Admin panel protected by strong password authentication
• Passwords stored as bcrypt hashes — never in plaintext
• SSH key authentication for server access
• VPS root passwords transmitted once via email and cleared from our records after provisioning
• HTTPS enforced on all pages

No method of transmission or storage is 100% secure. We cannot guarantee absolute security but will notify affected customers of any confirmed data breach within 72 hours of discovery.

11. Children

Our services are not directed at individuals under the age of 18. We do not knowingly collect data from minors. If you believe a minor has submitted an order, contact us immediately at natboxiomail@gmail.com and we will delete the information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised date. We will notify active customers of material changes by email. Continued use of our services after changes constitutes acceptance of the updated policy.

13. Contact

For privacy questions, data requests, or to exercise your rights:

• Email: natboxiomail@gmail.com
• Telegram: @natboxio