1.Introduction
APEX HostMate ("APEX HostMate", "we", "us" or "our") provides managed Oracle APEX hosting, web hosting, cloud VPS, dedicated servers and domain services. This Privacy Policy explains how we collect, use, share and protect personal information when you visit apexhostmate.com, create an account, buy or use our services, or contact us (together, the "Services").
APEX HostMate is responsible, as the data controller, for the personal information described in this Policy. Information that our customers store in the applications, databases, websites and mailboxes they host with us is covered separately in Section 6.
2.Information We Collect
Information you provide to us
- Account & contact data — name, email address, phone number, company name, country and billing address when you create an account or place an order.
- Sign-in data — your password (stored only as a secure one-way hash) and your two-factor authentication settings.
- Sign in with Google — if you choose it, Google shares your name, email address and Google account identifier with us. We never receive your Google password.
- Order & billing data — the services and plans you order, invoices, payment status and transaction references. Card and mobile wallet details are entered on our payment processors' pages; we never see or store full card numbers, security codes or wallet PINs.
- Domain contact data — the registrant details that domain registries require, such as name, organisation, postal address, email address and phone number.
- Communications — messages, support tickets, contact form submissions and any attachments you send us.
Information collected automatically
- Usage & device data — IP address, browser type, device information, pages visited, referring page and timestamps, recorded in our server logs.
- Security data — sign-in times, IP addresses and security events used to protect your account.
- Service data — resource usage, logs and diagnostic data needed to operate and secure your hosting environment.
- Cookies & analytics — as described in Section 4.
3.How We Use Your Information
We use personal information only for the purposes below, each with a legal basis under applicable data protection law:
| Purpose | Legal basis |
|---|
| Create and manage your account; provide, provision and support your services; process orders, invoices and renewals | Performance of a contract |
| Register, transfer and renew domains; issue SSL certificates | Performance of a contract |
| Send service, billing and security notices | Performance of a contract; legitimate interests |
| Protect accounts and systems; detect and prevent fraud, abuse and security incidents | Legitimate interests |
| Understand how our website is used and improve it (Section 4) | Consent in the EEA, UK and Switzerland; legitimate interests elsewhere |
| Send marketing emails, where you have agreed to receive them | Consent, which you can withdraw at any time |
| Keep accounting and tax records; respond to lawful requests | Legal obligation |
We do not sell personal information, we do not use it for advertising, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4.Cookies & Analytics
We use a small number of cookies and similar technologies. We do not use advertising cookies, and advertising storage is turned off for every visitor.
| Name | Purpose | Duration | Type |
|---|
| apexhostmate-session | Keeps you signed in and secures your session | 2 hours of inactivity | Essential |
| XSRF-TOKEN | Protects forms against cross-site request forgery | 2 hours | Essential |
| remember_web_… | Keeps you signed in, only if you choose "Remember me" | Up to 400 days | Essential |
| ahm-cookie-consent (local storage) | Remembers your cookie choice | Until you clear it | Essential |
| ahm_device | Recognises browsers you have signed in with, so we can email you about a sign-in from a new device | 2 years | Essential |
| ahm_ref | Set only when you open a partner’s referral link: remembers which partner referred you, so they can be credited if you create an account. It holds the partner’s code, nothing about you | The Partner Program cookie length (stated on the Partner Program page) | Functional |
| _ga | Google Analytics: distinguishes visitors | 2 years | Analytics |
| _ga_<ID> | Google Analytics: keeps session state | 2 years | Analytics |
Google Analytics and your choice
- EEA, UK and Switzerland — analytics cookies are only set after you click "Accept". Until then, Google may receive limited signals without cookies or identifiers (for example, that a page was viewed), which it uses only for aggregated statistics.
- Other regions — analytics is on by default. You can turn it off at any time with the cookie settings below, or with Google's opt-out browser add-on.
- Changing your choice — open Cookie settings (also in the footer of every page). If you decline, existing Google Analytics cookies are removed from your browser.
Conversion measurement
When you create an account or pay an invoice, we record an aggregated event in Google Analytics: the sign-up method, or the invoice number, amount, currency and plan names. We never send your name, email address, phone number, domain names or payment details to Google Analytics. Google's use of this data is described in the Google Privacy Policy.
When you pay through Paddle, the checkout is provided by Paddle and may use Paddle's own cookies, as described in Paddle's privacy notice.
5.How We Share Information
We do not sell or rent personal information. We share it only as follows:
- Paddle — Paddle.com Market Limited is the Merchant of Record for international payments made by card, PayPal, Apple Pay, Google Pay and the other methods shown at checkout. Paddle processes your payment and billing details as an independent controller under its own privacy notice.
- PayStation — processes payments made in Bangladesh with bKash, Nagad, Rocket and other mobile financial services, internet banking and cards. We share only what is needed to complete the payment, such as the amount, the invoice reference and the contact details you enter at checkout.
- Google — for Google Analytics (Section 4) and, if you choose it, Sign in with Google.
- Domain registrars, registries & certificate authorities — to register, transfer and renew domains and to issue SSL certificates. Registries may publish domain contact data in public WHOIS/RDAP directories under their own policies; we apply WHOIS privacy where the registry allows it.
- Data center operators — the operators of the facilities in Germany, Finland, the United States, Singapore and Bangladesh where our servers run. They provide the facilities and hardware and do not use your information for their own purposes.
- Legal & safety — where required by law or legal process, or to protect the rights, property or safety of APEX HostMate, our customers or others.
- Business transfers — in connection with a merger, acquisition or sale of assets, subject to this Policy.
We send and receive email through our own mail servers.
6.Data You Host With Us
Our customers store their own content with us, including Oracle APEX applications, databases, websites, files and mailboxes, which may contain personal information about their users. For that content, the customer is the data controller and APEX HostMate acts as a processor on the customer's behalf.
- We access hosted content only to provide, support and secure the services, at the customer's request, or where required by law.
- Hosted content stays in the data center location selected for the service.
- Customers are responsible for having a lawful basis for the data they host, for informing their own users, and for any sector-specific rules that apply to them.
- If you are a user of one of our customers' applications or websites, please contact that customer directly. If you contact us instead, we will refer your request to them.
7.Data Retention
- Account data — for as long as your account is active. After an account is closed, we delete or anonymise it within 90 days, except where we must keep it for the reasons below.
- Invoices & payment records — for as long as tax and accounting laws require.
- Support communications — for as long as your account is active, then deleted with your account data.
- Server & security logs — up to 12 months.
- Backups — APEX hosting plans are backed up daily and each backup is kept for 7 days. After a service ends, its data is removed from live systems and the remaining copies expire with the 7-day backup cycle.
- Analytics data — up to 14 months in Google Analytics.
- Your cookie choice — stored in your browser until you clear it.
8.Data Security
We use administrative, technical and physical safeguards designed to protect your information, including TLS encryption in transit, securely hashed passwords, optional two-factor authentication for client accounts, access to production systems restricted to authorised staff, firewalls, DDoS protection and regular backups.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please keep your account credentials confidential. If a personal data breach affects you, we will notify you and the relevant authorities where the law requires it.
9.Your Privacy Rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you and receive a copy;
- Correct inaccurate or incomplete information;
- Have your information deleted;
- Object to or restrict certain processing, including processing based on legitimate interests;
- Receive your information in a portable format;
- Withdraw consent at any time, without affecting processing that took place before;
- Lodge a complaint with your local data protection authority.
To exercise these rights, email privacy@apexhostmate.com. We may need to verify your identity first, and we will respond within 30 days. Exercising your rights is free of charge. You can update most account details yourself in the client area.
10.International Data Transfers
APEX HostMate is based in Bangladesh and operates data centers in Germany, Finland, the United States, Singapore and Bangladesh. Hosted content stays in the location you choose for your service. Account, billing and support information is handled by our team and systems, which may involve transferring it to countries other than your own, including from the EEA or UK to Bangladesh. Where applicable law requires it, we put appropriate safeguards in place for these transfers.
11.Children's Privacy
Our Services are not directed to individuals under the age of 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.
12.Changes to This Policy
We may update this Privacy Policy from time to time. We will post the revised version on this page and update the "Last updated" date above. Where changes are material, we will notify you by email or through the client area before they take effect.
