Privacy policy

1. Who we are

Kippo Cloud is operated by Kippo, which is the "Data Fiduciary" for the personal data described in this policy.

2. Data we collect

Information you give us

• Account details: name, email address, phone number, and password (stored in encrypted form).
• Billing details: billing address, company name and GSTIN (if provided).
• Service details: the plans you order and the domain names you connect to your hosting.
• Support communications: messages, tickets and any information you share with us.

Information collected automatically

• IP address, browser type, device information and pages visited on our website and client area.
• Login times and account activity, for security and fraud prevention.
• Server logs for your hosting account (such as access, error and mail logs), used to operate and secure our servers.
• Cookies, as described in section 9.

Payment information

Payments are processed by third-party payment gateways. We receive confirmation of payment and limited details such as the transaction ID. We do not store your full card, UPI or net-banking credentials.

3. Data stored on your hosting account

Your websites, databases and emails may contain personal data of your own visitors and customers. For that data, you decide what is collected and why, and you are responsible for complying with applicable data protection law. We only process it to provide the hosting service to you, and we do not access it except where needed for support you request, to keep our servers secure, or where required by law.

4. Why we use your data

We process your personal data on the basis of your consent or for legitimate uses permitted by the DPDP Act, to:

• create and manage your account;
• process orders and payments, and issue invoices, including GST invoices;
• set up, operate and maintain your hosting services;
• provide customer support;
• send service messages such as renewal reminders, invoices, maintenance notices and security alerts;
• detect and prevent fraud, abuse, spam and security incidents;
• comply with legal, tax and accounting obligations and lawful requests from authorities.

We will only send you promotional messages if you have agreed to receive them. You can unsubscribe at any time.

5. Who we share data with

We do not sell your personal data. We share it only as needed with:

• Data-centre and infrastructure providers: who host the servers your services run on.
• Payment gateways: to process your payments.
• Service providers: email delivery, billing software and security providers who process data on our behalf under confidentiality obligations.
• Government and law enforcement authorities: where required by law or a valid legal order, including directions issued by CERT-In.

6. Transfers outside India

Some of our infrastructure and service providers are located outside India. Your data may be transferred to and processed in other countries, in accordance with the DPDP Act and any restrictions notified by the Government of India.

7. How long we keep data

We keep your personal data only as long as needed for the purposes above. Account data is kept while your account is active. Hosting data (website files, databases and emails) is deleted after your service is cancelled or terminated. Invoices and billing records are kept for the period required under tax and accounting laws (generally at least 8 years), and logs are kept as required under applicable CERT-In directions. After that, data is deleted or anonymised.

8. How we protect data

We use reasonable security practices and procedures, as required by the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. These include encrypted connections (HTTPS), encrypted password storage, firewalls and access controls. No system is completely secure, but we work to protect your data and will notify you and the relevant authorities of a personal data breach as required by law.

9. Cookies

We use essential cookies to keep you logged in and to secure the client area. We may also use analytics cookies to understand how our website is used. You can control cookies in your browser settings; blocking essential cookies may stop the client area from working.

10. Your rights

Under the DPDP Act, you have the right to:

• get a summary of the personal data we process about you and how we process it;
• ask us to correct, complete or update your personal data;
• ask us to erase your personal data, unless we must keep it by law;
• withdraw consent at any time (this will not affect processing already done);
• nominate another person to exercise your rights in case of death or incapacity;
• have your grievances addressed by us, and then by the Data Protection Board of India.

To exercise these rights, email us at …. Withdrawing consent or erasing data needed to provide the service may mean we can no longer provide your hosting.

11. Children

Our services are not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. We will post the new version on this page with a new "last updated" date and notify you of significant changes by email or in the client area.

13. Questions and complaints

If you have any questions or complaints about how we handle your personal data, email us at …. We will acknowledge your complaint within 48 hours and aim to resolve it within one month. See also our Terms of service.