Last updated: August 5, 2026

Privacy Policy

1. Data we collect

We collect the following categories of personal data:

Account data — name, email address, password (stored hashed, never in plain text), billing address, and phone number when you register for an account.
Payment data — processed directly by our payment provider, Stripe. MustServer does not store full card numbers on its own servers; we retain only the resulting customer/payment method reference.
Service data — domain names, DNS records, VPS/hosting configuration, and mail routing metadata needed to deliver the service you've ordered.
Usage data — IP address, browser type, pages visited, and timestamps, collected automatically via server logs and cookies.
Support data — the content of support tickets, emails, or chat messages you send us.

2. How we use your data

We use personal data to:

Provision, operate, and maintain the services you order;
Process payments and issue invoices;
Respond to support requests and service notifications (maintenance, incidents, renewals);
Detect, prevent, and investigate fraud, abuse, or security incidents;
Comply with legal and regulatory obligations; and
With your consent, send product updates or marketing communications, which you can opt out of at any time.

3. Legal basis for processing

Where applicable data protection law requires a legal basis (including the EU/UK GDPR and Turkey's Law No. 6698 on the Protection of Personal Data, "KVKK"), we rely on: performance of a contract with you, our legitimate interest in operating and securing our services, compliance with a legal obligation, and, where required, your explicit consent.

4. Cookies and similar technologies

We use strictly necessary cookies (e.g. session and CSRF-protection cookies) required for the website and member panel to function, plus a small number of third-party cookies from services like Cloudflare Turnstile, Google Sign-In, and Stripe that only run on the specific pages that use them. We do not use advertising or cross-site tracking cookies. See our full Cookie Policy for the complete list and how to control them.

We do not sell personal data. We share data only with:

Payment processors (Stripe) to process transactions;
Infrastructure and datacenter partners that host the physical servers underlying our Cloud VPS, Hosting, and Mail Gateway services;
Email and support-tooling providers used to communicate with you; and
Law enforcement or regulators where required by a valid legal request.

Every third-party processor is bound by a data processing agreement consistent with this policy.

6. International transfers

Because MustServer operates infrastructure across multiple regions, personal data may be transferred to and processed in countries other than your own. Where required, we rely on appropriate safeguards (such as standard contractual clauses) to protect data transferred internationally.

7. Data retention

We retain account and billing data for as long as your account is active and for a reasonable period afterwards to comply with tax, accounting, and legal obligations. Service data (files, mailboxes, backups) tied to a cancelled service is deleted according to the retention window described in your plan, typically within 30 days of cancellation, unless a longer period is required by law.

8. Your rights

Subject to applicable law, you may have the right to:

Access the personal data we hold about you;
Request correction of inaccurate data;
Request deletion of your data, subject to legal and contractual retention requirements;
Object to or restrict certain processing;
Request a portable copy of your data; and
Withdraw consent at any time where processing is based on consent.

To exercise these rights, contact us using the details in Section 12.

9. Security

We apply industry-standard technical and organizational measures — including encryption in transit, hashed credential storage, access controls, and monitoring — to protect personal data. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security; see our Terms of Service for the limitation of liability that applies to data incidents outside our reasonable control.

10. Children's privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the email address on your account or a notice on our website prior to taking effect. Continued use of our services after changes take effect constitutes acceptance of the revised policy.

12. Contact us

Questions about this Privacy Policy or your personal data can be sent to privacy@mustserver.com.