Privacy Policy & Cookies

ALTIUS HOST LLC | Last Updated: October 9, 2026

1. Introduction

ALTIUS HOST LLC (“Company”, “we”, “us”) respects your privacy and is committed to protecting your personal data. This policy explains how we handle data across all the markets we serve, and is written to meet the standards of the principal data protection frameworks that may apply to our clients, including the EU and UK General Data Protection Regulation, United States state privacy legislation, and comparable regimes elsewhere. The Company operates under the jurisdiction of New Mexico, USA.

This policy covers data we hold about you as our client — account and billing information. Where you host websites or applications with us that contain personal data belonging to your customers or users, you are the controller of that data and we act as your processor; that relationship is governed by our Data Processing Agreement.

2. Data Collection and Usage

We collect essential administrative and billing information exclusively to facilitate our services. This includes:

• Account Data: Name, email address, physical billing address, and corporate details (including VAT identification numbers) provided during registration in our automated billing portal.
• Operational Data & Billing Compliance: Server logs, IP addresses, and diagnostic data required for technical support, security auditing, and location determination. Location data is used to establish whether a client is located in an EU member state or in the United Kingdom, since VAT is charged only to clients located there (including B2C VAT calculation and validation of VAT identification numbers for B2B reverse charge).
• Fraud Prevention Data: During registration and checkout, we perform automated risk screening on the information you provide (including IP address, geolocation, and email attributes) in order to prevent fraudulent orders and abuse of our infrastructure. This screening is carried out using MaxMind minFraud (MaxMind, Inc., United States).
• Bot Protection Data: Our login and registration forms are protected by hCaptcha (Intuition Machines, Inc., United States), which receives your IP address, browser and device characteristics, and interaction data in order to distinguish human visitors from automated traffic.

We do not collect sensitive personal data beyond what is strictly required for billing and service provisioning.

Whether you must provide data. Account and billing data marked as required in our registration and order forms is necessary to enter into and perform our contract with you, and certain billing data is required by tax law. If you do not provide it, we cannot open your account or provide the services. Providing any other data is voluntary.

3. Legal Bases for Processing

Where the GDPR, UK GDPR, or an equivalent framework requiring a stated legal basis applies to you, we rely on the following:

4. Data Protection and Security

We employ enterprise-grade security measures to protect your data against unauthorized access, alteration, or destruction, including multi-factor authentication on all administrative interfaces, perimeter firewalling and intrusion detection, real-time malware scanning, and encryption of all data in transit. A full description of our technical and organisational measures, including the limits of what we provide, is set out in Section 5 of our Data Processing Agreement. Your payment information is securely transmitted and processed through highly encrypted, PCI-compliant third-party payment gateways. ALTIUS HOST LLC does not store raw credit card numbers on our infrastructure. While our corporate entity is based in the USA, your hosted website data resides strictly on our European infrastructure, currently in Germany and Finland.

5. Information Sharing and Third Parties

We will never sell, rent, or trade your personal information to third parties for marketing purposes. Data is only shared under the following strict conditions:

• Service Provisioning: With trusted third parties — including our client portal and billing platform provider (WHMCS Ltd, United States), our domain registrar (Namecheap), our data centre provider (Hetzner, Germany and Finland), our banking partner, and our certified payment processor — to the extent absolutely necessary to fulfil your service requests.
• Security and Fraud Prevention: With MaxMind, Inc. (fraud risk scoring) and Intuition Machines, Inc. (hCaptcha bot protection), both United States entities, to the extent necessary to protect our platform and our clients against fraudulent orders and automated abuse.
• Email Delivery: With SMTP2GO Ltd (New Zealand, with delivery infrastructure in several regions), which transmits the transactional email we send you — order confirmations, invoices, payment reminders, support ticket notifications, and system notices. SMTP2GO receives your email address and the content of those messages solely in order to deliver them.
• Our Website: With Cloudflare, Inc. (United States), which provides DNS, content delivery, and security for altius.host and therefore processes the IP address and request metadata of visitors to our website; with Cybot A/S (Denmark), which operates the Cookiebot consent platform and records your cookie consent choices; and, where you consent to analytics cookies, with Google LLC (United States), which provides the Google Analytics measurement used through Site Kit. Analytics data is collected only after consent and is not used to identify you personally.
• Administration Tools: With Anthropic, PBC (United States), whose AI assistant our staff use to review configuration, security, and log data for our website and systems, and with WebPros International GmbH (Switzerland) and its group affiliates, whose monitoring dashboard our staff use to monitor and administer the server that hosts our website. The data handled through these tools may include the IP addresses and request metadata of visitors to our website.
• Legal Compliance: When legally mandated by valid law enforcement requests or court orders within our operating jurisdictions.
• Integrations You Choose: Where you connect your account to third-party tools yourself — for example an AI assistant or agent, or the cPanel MCP connection activated through your own WebPros account — those providers receive data from you directly and process it under their own terms. We do not share your data with them, and they are not our sub-processors.

A current list of the sub-processors used in the delivery of hosting services is maintained in our Data Processing Agreement.

6. International Transfers

Your hosted content — the websites, databases, email, and applications you host with us — is stored exclusively within the European Economic Area, currently on infrastructure in Germany and Finland. A current and forward-looking list of the data centre providers we use is maintained in our Data Processing Agreement.

Your account, billing, and support data is stored in the United States. Our client portal, billing system, and support ticketing platform are operated by WHMCS Ltd on infrastructure located in Houston, Texas. This means your name, contact and billing details, invoices, and support correspondence are stored and processed in the United States. Our payment processor and banking provider are likewise United States entities.

Where this involves a transfer of personal data from the EEA or the United Kingdom, it is carried out under the European Commission’s Standard Contractual Clauses, together with supplementary measures including encryption of all data in transit, multi-factor authentication on administrative access, access logging, and minimisation of the data transferred. Administrative and support access may also take place from outside the EEA under the same safeguards.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which we collected it:

• Account and profile data: For as long as your account exists with us. Where you wish your account record to be closed and erased after your services end, you may request this at any time under Section 8, subject to the billing-record exception below.
• Hosted content data: Thirty (30) days after termination in a suspended state, after which it is permanently deleted. Backup archives operate on a rolling seven (7) day rotation, so no backup copy of terminated data persists beyond that window.
• Billing, invoicing, and tax records: Retained for the period required by applicable accounting and tax law, which may extend to seven (7) years. These records cannot be erased on request while that obligation subsists.
• Support correspondence: Tickets are closed automatically after seventy-two (72) hours of inactivity and are retained for as long as your account record exists, so that support history remains available to you and to our technical team.
• System and module logs: Operational logs generated by our billing and provisioning systems are pruned automatically after thirty (30) days. Server access and security logs are retained for up to twelve (12) months, unless retained longer in connection with an active security investigation.

8. Your Rights

Data protection rights differ between countries, and the rights available to you depend on the law of your place of residence. Depending on your location, you may have the right to: access the personal data we hold about you; request correction of inaccurate data; request erasure; restrict or object to processing; receive your data in a portable format; withdraw consent at any time where processing is based on consent; and lodge a complaint with a supervisory authority.

How to exercise your rights. Send your request to [email protected], or use the contact form at altius.host/contact-noc. We will acknowledge your request and respond within thirty (30) days. Where a request is complex or where we receive several requests from you, we may extend this period by a further two months and will inform you of the extension and the reason for it within the initial thirty days.

We may request reasonable information to verify your identity before acting on a request. No fee applies unless a request is manifestly unfounded or excessive.

Certain rights are subject to limitation — for example, we cannot erase billing records that we are legally required to retain, and we cannot act on requests relating to data held on behalf of another controller (see Section 1).

Supervisory authority. If you believe we have not handled your data lawfully, and the law of your country provides for a supervisory or data protection authority, you have the right to lodge a complaint with that authority — ordinarily the one in your country of residence, place of work, or the place where the alleged infringement occurred.

9. Automated Decision-Making and Fraud Screening

During the order and registration process we apply automated risk-scoring to the information supplied (including IP address, geolocation, email attributes, and order characteristics) in order to detect fraudulent orders and prevent abuse of our infrastructure. A high risk score may cause an order to be held for manual review or declined.

This processing is carried out using MaxMind minFraud, on the basis of our legitimate interest in preventing fraud and protecting our network. No order is refused solely on the basis of automated processing without the possibility of human review. If your order is declined and you believe this to be in error, you may contact us at [email protected] to request human review, to express your point of view, and to contest the decision.

10. Children’s Data

Our services are directed at businesses and adults. We do not knowingly collect personal data from children under the age of sixteen (16). If we become aware that we have collected such data without appropriate consent, we will delete it without undue delay. Where you host content directed at children, you remain responsible as controller for the lawfulness of that processing.

11. Rights of United States Residents

Residents of California and other US states with comprehensive privacy legislation may have the right to know what personal information is collected, to request deletion or correction, to obtain a portable copy, and to opt out of the sale or sharing of personal information and of targeted advertising.

ALTIUS HOST LLC does not sell or share personal information, and does not process personal information for cross-context behavioural advertising. We will not discriminate against you for exercising any privacy right. Requests may be submitted to [email protected] using the same process described in Section 8, and an authorised agent may submit a request on your behalf with proof of authorisation.

We do not currently respond to browser “Do Not Track” signals, as no common standard for them has been established. Where a recognised opt-out preference signal is received, we honour it in respect of non-essential cookies.

12. Cookies and Consent Management

Our public website and our client portal are separate environments and are treated differently.

Public website (altius.host). The website uses essential cookies required for its basic operation and security, including cookies set by Cloudflare to distinguish legitimate visitors from automated traffic. For non-essential cookies — principally Google Analytics, which we use through the Site Kit plugin to measure how the website is used — we rely on Cookiebot, an enterprise-grade Consent Management Platform operated by Cybot A/S, so that such cookies are set only after you give consent. If you do not consent, no analytics cookies are set and no measurement data is collected. You have full control over your preferences and can change your cookie consent settings at any time through the consent interface on the site.

A detailed cookie declaration — automatically generated and maintained by Cookiebot, listing every cookie in use together with its purpose, provider, and retention period — is published on our Cookie Policy page.

Client portal and billing infrastructure. Our billing, support, and server management portal operates on a separate, isolated subdomain. It carries no analytics, advertising, or behavioural tracking scripts of any kind, and no consent management platform is deployed there.

The portal sets only strictly necessary systemic storage — cookies required for authentication, session integrity, and protection against cross-site request forgery during transactions. Under the GDPR and the ePrivacy Directive, storage of this kind is exempt from the prior consent requirement, as it is strictly necessary to deliver the service you have requested.

The portal’s login and registration forms are additionally protected by hCaptcha, which may set its own cookies or use browser storage in order to distinguish human visitors from automated traffic. This is a security measure rather than a tracking or advertising technology, and is likewise relied upon as strictly necessary to protect the service and its users against automated abuse and credential-stuffing attacks.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or in applicable law. Material changes will be notified to active clients by email at least thirty (30) days before taking effect. The “Last Updated” date above reflects the most recent revision.

14. Contact

Data Protection Contact

ALTIUS HOST LLC

8206 Louisiana Blvd NE, Ste A #9372

Albuquerque, NM 87113, United States

Email: [email protected]