Zero-Trust Privacy Framework

Privacy Policy

MikyHost Cloud Technologies Inc. adheres strictly to international data protection regulations, including the European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

GDPR Compliant CCPA Ready 256-Bit TLS 1.3 Zero-Knowledge Storage

Our Fundamental Privacy Promise

We believe privacy is an absolute human right. MikyHost Cloud Technologies Inc. does not sell, rent, monetize, or broker your personal information to third-party ad networks or data brokers. We do not inspect, crawl, or analyze the filesystem contents of your virtual servers, block storage pools, or private databases. Telemetry is collected strictly for billing accuracy, hypervisor stability, and BGP network health.

Table of Contents

Data Protection Officer

Exercising your GDPR rights (Access, Correction, Data Portability, or Erasure)? Contact our designated Data Protection Officer directly.

Contact DPO Office →

1 Scope & Zero-Trust Philosophy

This Privacy Policy applies to personal data collected through our official web portal, customer management console, public APIs, support desks, and B2B billing interfaces.

We operate under a Zero-Trust Security Architecture. Internal networks are treated as untrusted by default, least-privilege role separation is enforced across engineering staff, and all sensitive parameters (including provider tokens, SMTP passwords, and payment tokens) are encrypted at rest using AES-256.

2 Categories of Information Collected

We collect only the minimum information necessary to provision infrastructure, process billing, and safeguard the platform:

Account & Identity Data: Full name, corporate email address, organization name, phone number, and physical billing address.
Authentication Data: Cryptographically hashed passwords (Bcrypt/Argon2), 2FA TOTP secrets, public SSH keys, and session identifiers.
Financial Telemetry: Tax/VAT ID, transaction reference IDs, and payment history (card numbers are tokenized by PCI-DSS Level 1 gateways).

3 Infrastructure Telemetry & Server Logs

When interacting with our control plane or routing traffic across our Anycast fleet, automated edge switches capture operational metadata: source IP and ASN, TLS negotiation parameters, bandwidth consumption, and security rate-limiting triggers.

4 Session Cookies & Bot Defense

We utilize essential functional cookies required for session persistence and CSRF security. We do not use third-party behavioral ad tracking cookies. Bot mitigation services (reCAPTCHA/Turnstile) evaluate non-personally identifiable browser challenge signals.

5 Third-Party Payment Sub-Processors

We partner with certified audited service providers: Stripe & PayPal (PCI-DSS payment processing), AWS & DigitalOcean (upstream hypervisors), Sectigo CA (SSL certification), and DomainNameAPI/Route53 (ICANN domain registration).

6 Data Retention Lifecycle & GDPR Rights

Active accounts are maintained during subscription duration; tax records are preserved for 7 statutory years; rolling server access logs rotate every 30 days. European customers enjoy full GDPR rights (Access, Rectification, and Right to Erasure).

7 Cryptographic Safeguards (AES-256)

Database transport is encrypted via TLS 1.3 sockets, and secrets at rest use AES-256-GCM. Physical datacenter access is governed by biometric access controls, dual-factor vestibules, and 24/7 CCTV surveillance.

8 Data Protection Officer (DPO) Contact

To submit Data Subject Access Requests (DSAR), execute Data Processing Addendums (DPA), or communicate with our DPO office, contact our privacy desk directly via client support tickets.