Privacy Notice

This Privacy Notice explains how Hostactor ("Hostactor", "we") collects and uses personal data when you visit our website and panel, create an account, order or use our services, or contact us. We process personal data in line with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

1. Who is responsible for your data

The personal information controller is Hostactor.

Data Protection Officer: the contact form. Write to our Data Protection Officer about anything in this notice or to use your rights.

• Brand: Hostactor
• Website: hostactor.com

2. What we collect

• Account and contact details: name, e-mail address, mobile number, business name, address, and your password (stored only as a secure hash).
• Business and tax details you give us, such as a business registration number or TIN. A TIN is a government-issued identifier and is treated as sensitive personal information.
• Domain owner details: the name, address, e-mail and phone of the domain owner and contacts, which the registrar and registry require.
• Order, billing and payment records: what you ordered, invoices, payment status, the payment method, payment references you send us (for example a GCash reference number) and refunds. Card details are entered on the payment provider's page; we never receive or store your full card number.
• Service data: your hosting account and domain settings, and the activity needed to run them (for example setup, renewals and support actions).
• Messages: support tickets, e-mails, WhatsApp messages, cancellation requests and reports you send us, and our replies.
• Technical and security data: IP address, browser and device type, sign-in times, security events and logs.
• Cookies and similar technologies: see the Cookie Policy.
• Content you use with AI tools: the prompts and texts you submit, when you use those tools.

We do not intentionally collect other sensitive personal information (such as health, religion or political opinions). Please do not send it to us.

Data inside your services. Websites, stores, mailboxes and databases you host with us may contain personal data of your own customers and visitors. For that data you are the personal information controller and we act as your personal information processor: see the Data Processing Addendum.

3. Why we use it, and on what legal basis

Purpose	Legal basis (Data Privacy Act, sections 12 and 13)
Create and manage your account; take, set up, renew and bill your orders; register and renew domains; provide support	Fulfilling our contract with you, or steps you asked for before entering into it
Keep invoices, payment and tax records; answer lawful requests from authorities	Compliance with a legal obligation; for sensitive personal information such as a TIN, processing provided for by law
Keep the services and your account secure, prevent fraud and abuse, and handle reports about content	Our legitimate interests in running secure and lawful services, which do not override your fundamental rights
Measure and improve our order pages, and advertising where the tools are used	Your consent where the law requires it, otherwise our legitimate interests (see the Cookie Policy)
Send you news and offers	Your consent, which you can withdraw at any time with the unsubscribe link or in your account settings
Establish, exercise or defend legal claims (for example records of accepted terms, cancellation requests and reports)	Our legitimate interests; for sensitive personal information, the protection of lawful rights and interests in legal proceedings

Service e-mails about your orders, payments, renewals and security are part of the service and are not marketing. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Who receives your data

We share personal data only as far as needed for the purposes above, with:

• Hosting and infrastructure providers that run the servers, data centres and storage for our panel and your services, including encrypted off-site backup storage;
• Payment providers: Whop, which processes card and other online payments on its own payment page, and, where you choose a manual method, the bank or e-wallet you pay through (such as GCash);
• E-mail delivery providers that send our service e-mails;
• Domain registrars and registries (for example Namecheap and the registry of each domain ending), which receive the domain owner details as their rules and the rules of ICANN require. Depending on the domain ending and your choices, some details may appear in public registration data (WHOIS / RDAP);
• Cloudflare, only if you turn on Cloudflare protection for your website (your domain and its DNS records);
• AI providers that process the prompts and texts you submit when you use AI tools;
• Analytics and advertising providers (such as Google and Meta), only on our public order pages and only as described in the Cookie Policy. We never send them your name, e-mail, phone number or full domain names;
• Messaging services such as WhatsApp, when you choose to contact us there;
• Professional advisers (such as lawyers and accountants), bound by confidentiality;
• Authorities and courts, when the law requires it, for example under a court order or a lawful request;
• a buyer or successor, if our business is sold or merged, under the same protections.

Our providers process personal data only on our instructions and under contracts that require them to protect it. We do not sell your personal data. Our staff may open your account to help you or to investigate a problem; every such access is recorded.

5. Transfers outside the Philippines

Some of our providers (for example the payment provider, e-mail, domain, Cloudflare, AI and analytics providers) and possibly our servers are located outside the Philippines, so your personal data may be transferred to and stored in other countries. We remain responsible for personal data we transfer, as the Data Privacy Act requires. We use providers that commit by contract to protect the data with a level of protection comparable to Philippine law, and we transfer only what is needed.

6. How long we keep it

• Account data: while your account is open. When you ask us to close it, we delete your personal details, except what we must keep as described below.
• Invoices, payment and order records: for the period required by Philippine tax and accounting rules, even after your account is closed.
• Hosting data: 14 days after a service ends, so you can download it; then it is deleted.
• E-mails we sent you: the content for 30 days, and a record of the sending (address, subject, date, status) for 365 days.
• Logs: the activity log for 730 days, domain search logs for 90 days, and security events for 90 days.
• Backups of our panel: 7 days; data deleted from the panel disappears from backups as they expire.
• Records of accepted terms, cancellation requests, reports and support conversations: while needed to handle the matter and for as long as a legal claim about it may be brought.

After these periods we delete the data or make it anonymous.

7. Your rights

Under the Data Privacy Act you have the right:

• to be informed about how your personal data is processed;
• to access your personal data and get a copy of it;
• to correct inaccurate or incomplete data (you can update most of it in your account settings);
• to object to processing, including to marketing and to processing based on our legitimate interests;
• to have your data erased or blocked when it is no longer needed, was unlawfully obtained or is processed unlawfully;
• to data portability: to get the data you gave us in a commonly used electronic format;
• to be compensated for damages caused by inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorised use of your personal data;
• to withdraw your consent at any time, where we rely on consent;
• to file a complaint with the National Privacy Commission.

To use your rights, write to our Data Protection Officer at the contact form. We may ask you to confirm your identity. We answer within 30 days. Some rights have limits under the law, for example when we must keep records for tax purposes; we will tell you if a limit applies.

If you are not satisfied with our answer, you can file a complaint with the National Privacy Commission (privacy.gov.ph).

8. How we protect your data

We use organisational, physical and technical measures to protect personal data, including encrypted connections (HTTPS), encryption of stored passwords and secrets, two-step verification and access logs for our staff, limited access on a need-to-know basis, monitoring for unauthorised changes, and encrypted backups. No system is completely secure. If a personal data breach occurs that the law requires us to report, we notify the National Privacy Commission and the people affected as the NPC's rules require.

9. Children

Our services are meant for adults and businesses. We do not knowingly collect personal data of children. If you believe a child has given us personal data, contact the contact form and we will delete it.

10. Changes to this notice

We may update this notice. Every version is kept and can be viewed on the legal documents page. We tell you about significant changes by e-mail or in your account.

Version 2 · last updated Nov 8, 2026.