This Privacy Policy explains how AceRDP LLC collects and uses personal information through https://acerdp.io, our RDP/VPS hosting services, support, and optional integrations. Effective date: 12 October 2026.

AceRDP LLC, a Wyoming limited liability company, 1621 Central Avenue, Cheyenne, WY 82001, United States, is the controller of personal information used to administer customer relationships and operate our business. Contact [email protected] for privacy requests and [email protected] for abuse reports. You may also use our ticket system.

This policy provides information; accepting it is not blanket consent to monitoring, marketing, or unrestricted access to your server. Our Terms of Service separately govern service use and deletion deadlines.

• Account and contact information: information you provide during registration, purchases, invoicing, account updates, and support, including your name, username, email address, and billing/contact details where requested.
• Service and billing records: purchases, allocated server IPs, plan and location, service status, renewal settings, account balance, invoices, transaction references, payment status, and payment-dispute records. Payment providers process card or cryptocurrency payment details; we receive the information needed to reconcile transactions and handle support or disputes.
• Website and account activity: website IP addresses, login and action timestamps, browser/device information, authentication and security events, cookie choices, and relevant service-management activity.
• Hosting telemetry: resource and traffic-volume statistics, availability, and service-operation graphs used to maintain infrastructure and investigate resource impact.
• Support and communications: ticket contents, attachments, emails, optional Telegram communications, access permissions you grant, support actions, and access audit records. Do not send credentials or sensitive documents unless needed for the request and through an appropriate channel.
• Abuse information: AbuseIPDB results concerning allocated server IPs, abuse emails and their supporting evidence, traffic-volume indicators, internal risk scores, investigation outcomes, and enforcement history. A report may contain information supplied by a third party; it is not necessarily accurate or attributable to the current customer.
• Website analytics: Microsoft Clarity interaction data, including page visits, clicks, scrolling, session reconstructions, device/browser characteristics, and relevant navigation or conversion events. Sensitive pages and fields are excluded or masked as described below.

Information comes from you, use of our services, payment providers, optional communication services, AbuseIPDB, and people or organizations reporting abuse. We do not intentionally use these sources to collect sensitive personal information unrelated to a legitimate operational purpose.

Where EU/UK GDPR or similar rules apply, the basis depends on the purpose and the information involved:

• Contract performance: creating and administering your account, provisioning hosting, processing orders and balance-funded renewals, communicating about purchased services, and providing requested support. For business representatives who are not personally party to the contract, necessary relationship administration is generally based on legitimate interests instead.
• Legitimate interests: protecting infrastructure and customers, preventing fraud and abuse, investigating reported incidents, maintaining service reliability, administering business relationships, and establishing or defending legal claims. We consider necessity and balance these interests against your rights; this basis does not automatically permit every form of monitoring or automated decision.
• Legal obligations: information necessary for applicable accounting, tax, sanctions, valid legal-process, and other compliance requirements. Where a foreign legal requirement is not itself a qualifying GDPR legal obligation, the lawful basis and any transfer conditions must be assessed separately.
• Consent: optional analytics where consent is required, and promotional communications where consent is required. Certain marketing may be allowed without fresh consent under an applicable existing-customer exception only if its legal conditions are satisfied and an effective opt-out is available.

Account, contact, payment, and security information reasonably needed for a service must be provided to obtain or maintain that service. Refusing optional analytics or marketing does not prevent ordinary hosting use. Additional information requested for an investigation must be relevant and proportionate; we explain any consequences of not providing it.

We combine AbuseIPDB information, abuse reports received by email, and traffic-volume indicators to identify potentially abusive services. These indicators may contribute to an internal abuse score. Their relevance depends on the reported activity, timing, service/IP association, and evidence. High traffic alone does not establish illegality, and third-party reports can be incorrect.

The score may automatically trigger a protective suspension, affecting server access. Upheld violations may also contribute to reinstatement limits and termination under the Terms of Service. Suspension does not establish that the customer committed a crime.

You can open a support ticket to request human review, explain your activity, challenge inaccurate information, and provide supporting evidence. A timely abuse-review ticket pauses the abuse-related deletion process described in the Terms. Review can correct the attribution, score, or enforcement outcome. We explain the material reasons for a restriction and the applicable review route, subject to lawful limits on disclosure. Meaningful information about your case may be requested without disclosing exploitable security thresholds or other people's protected information.

Where applicable law restricts solely automated decisions with legal or similarly significant effects, those restrictions and safeguards apply. General acceptance of this policy is not explicit consent to such decisions. Human review after suspension does not by itself establish that all legal conditions for the original automated decision were met.

Our routine monitoring uses service metadata and resource/traffic-volume statistics. We do not routinely collect destination IP addresses, connection logs, or packet contents from customer VM traffic, or inspect files inside customer VMs for monitoring. This does not mean website/account activity is unlogged, or that independent network operators have no logs under their own responsibilities.

Ordinary support agents can view a server's IP address but do not ordinarily have access to its password, console, or disk. Through the ticket system's Grant Access feature, you can authorize a support agent to see the server username and password to perform requested fixes. Use this feature only when necessary. Ask support to end the authorization when the work is complete and change any credentials disclosed for support where appropriate.

Technical administrators have infrastructure privileges that can enable machine access, and can view operational graphs. Our normal practice is to enter customer machines only for customer-requested assistance with the customer's knowledge. Administrative privileges do not create unrestricted permission to inspect content. Support and administrative access/actions are logged. Any exceptional preservation or access required by valid legal process is handled separately, with lawful limits and notice where permitted.

We use essential technologies for functions such as authentication, security, and remembering choices. Optional analytics are separate. Our cookie banner provides Accept, Reject, and Settings options. Where required, non-essential analytics must remain disabled until valid consent is given. You can change your choices through cookie settings; withdrawing consent must be as easy as giving it. Browser controls are an additional option and may affect essential functionality.

Microsoft Clarity is our website analytics tool and is also used within the customer dashboard. It helps us understand navigation, interactions, and service-purchase flows through statistics, heatmaps, and session reconstructions. This is website interaction tracking, not a recording of activity inside your hosted VM.

Sensitive pages and fields are excluded or masked to reduce collection of credentials, payment details, and private information. Microsoft receives the analytics information processed by Clarity and handles it under the applicable service arrangements and its privacy terms. Cookies and similar identifiers may be used according to your choices and applicable law. Rejecting cookies is not a general authorization for otherwise restricted cookieless personal-data tracking.

See Microsoft's privacy statement at https://privacy.microsoft.com/privacystatement and Clarity cookie information at https://learn.microsoft.com/en-us/clarity/setup-and-installation/clarity-cookies. Details of enabled cookie categories and their lifetimes should be available through cookie settings. We do not describe all service data as anonymous merely because direct names are masked.

We send necessary service communications such as order confirmations, payment information, expiry and security notices, and ticket replies. These are separate from optional promotional messages.

We also send promotional emails, win-back messages, and review requests subject to applicable marketing rules. These emails include an unsubscribe or preference link. A category-specific opt-out stops that category; you can also contact support to object to all direct marketing. We will respect that objection. An opt-out does not prevent necessary service or legal notices.

We may keep a minimal suppression record to ensure that an opted-out address is not inadvertently added back to marketing. Unsubscribing does not close your hosting account or delete records needed for other lawful purposes. We do not treat accepting the Terms or Privacy Policy as automatic marketing consent.

We disclose only information reasonably necessary for the relevant purpose, subject to applicable contractual and legal protections. Recipient categories include:

• Payment providers: Stripe for card transactions and Cryptomus for cryptocurrency transactions, receiving the information needed to process your selected payment method and handle compliance or disputes. Their own privacy notices explain processing for their independent purposes. We do not store full card numbers or card security codes on our systems; this does not mean no transaction or billing records are stored.
• Infrastructure, network, and communications providers: organizations supporting connectivity, datacenter operations, email delivery, and business communications. Self-hosting our website and service systems does not eliminate all third-party processing or physical infrastructure providers.
• Analytics: Microsoft for Clarity, subject to applicable consent and service arrangements.
• Security and abuse services: AbuseIPDB receives queried IP addresses and processes relevant reputation information. Reporting parties or affected providers may receive a proportionate response needed to resolve an incident; we do not routinely disclose customer identities to every complainant.
• Internal operational alerts: Discord alerts contain the relevant ticket ID and username. These are customer-related identifiers even without an email or full name. Access is restricted to the operational audience requiring the alert.
• Optional Telegram use: Telegram receives information you send or exchange through the optional integration, including identifiers and communications needed for its operation. Choosing not to use Telegram does not require giving up ordinary website support. Telegram processes data under its own terms.
• Professional advisers, competent authorities, and lawful successors: where necessary for advice, legal claims, valid legal process, or a business transfer, with confidentiality and disclosure safeguards as applicable.

We do not sell or rent customer personal information. We do not interpret this statement as a claim that all analytics configurations fall outside every jurisdiction's definition of “sale” or “sharing”; applicable statutory controls must be respected. Contact us for information about providers relevant to a specific processing activity.

AceRDP is a US company. Data may be processed in the United States, United Kingdom, and European Economic Area, according to hosting location, administration, and the providers used, and elsewhere where a relevant provider processes it. Selecting a VM location does not guarantee that account information, support, analytics, or administrative access remains exclusively in that location.

Where transfer rules apply, a transfer requires an applicable lawful mechanism, such as a relevant adequacy decision or contractual safeguards with any necessary additional measures. Adequacy applies only where the recipient and processing are actually covered; a US address alone does not establish adequate protection. Exceptional transfer derogations are not a substitute for safeguards for routine transfers.

Contact support for the destinations and mechanism applicable to your data, or to request information or a copy of applicable safeguards, with necessary confidentiality redactions. This policy does not itself create a transfer mechanism or assert that AceRDP is certified under a data privacy framework.

Website IP-address records are retained for 180 days and then automatically deleted. Separately obtained IP information may remain in a relevant invoice, ticket, abuse report, access record, or legal-preservation record under the criteria below; this is distinct from retaining routine website IP logs.

• Account and service administration: retained while needed to operate the account and address outstanding purchases, balances, disputes, and closure requests. After closure, information no longer needed for another lawful purpose should be removed or de-identified.
• Billing and transaction records: retained for applicable tax/accounting requirements and payment-dispute or legal-claim periods. The applicable requirement depends on the record and governing law; not every record has the same deadline.
• Support tickets and access records: retained for resolving requests, documenting authorized access, investigating security incidents, and relevant claim periods, taking into account sensitivity and whether the issue remains open.
• Abuse reports and enforcement history: retained for investigation, preventing repeated abuse, handling appeals, and relevant legal claims or preservation duties. Retention must remain necessary and proportionate; enforcement history is not an unrestricted justification to retain every attachment forever.
• Marketing preferences: retained while relevant to your subscriptions and as a minimal suppression record to respect opt-outs.
• Analytics: retained according to the Clarity configuration and applicable Microsoft service retention, with choices and relevant details available through cookie settings or on request. The 180-day website IP-log period is not a promise that all providers use that retention period.

For an expired VM, the Terms specify suspension followed by deletion after three days if not renewed. Abuse-related deletion, review holds, and limited retrieval windows follow the separate rules in those Terms. Deleting a VM is not the same as deleting an account or all business records. Legal preservation may delay deletion of relevant evidence and does not promise customer recovery of deleted services.

For records without a fixed period stated here, the criteria are the ongoing purpose, applicable statutory requirement, unresolved issue, relevant limitation period, and sensitivity of the information. You can ask us about retention of a particular record or request erasure subject to applicable exceptions. These criteria do not authorize indiscriminate permanent retention.

We use technical and organizational measures appropriate to the information and risks, including access restrictions, logged administrative access, and protected connections to our website and management systems. Payment providers secure payment processing within their own systems. No system can guarantee absolute security.

Website encryption is not a guarantee that every connection made by customer-controlled software or every file stored in a VM is encrypted. You remain responsible for securing your guest systems, credentials, software, and communications. If a personal-data breach occurs, we assess and provide notifications required by applicable law. We do not promise a single universal deadline where different legal duties apply.

Depending on applicable law and the processing involved, you may request access and a copy of your data; correction; erasure; restriction; portability of qualifying data; and information about recipients and transfer safeguards. You may withdraw consent without affecting the lawfulness of earlier consent-based processing.

Right to object: you may object to processing based on legitimate interests on grounds relating to your situation. We must assess that objection under applicable law. You may object to direct marketing at any time, including associated profiling, and we will stop using your information for that purpose.

You can request human intervention, explain your position, and contest automated abuse decisions as described above and as required by applicable law. Rights are subject to lawful conditions and exceptions; we may need to retain records for a legal duty or protect someone else's rights.

Send requests to [email protected] or open a ticket. We may verify identity proportionately, preferably through existing account controls, rather than collecting unnecessary documents. Where GDPR applies, we ordinarily respond within one month, with a permitted extension of up to two further months for complexity or number of requests and timely explanation. Other applicable legal deadlines take precedence. Requests are normally free, subject only to exceptions allowed by law. We do not retaliate against you for exercising applicable privacy rights.

You may complain to a competent data-protection authority without first contacting us. In the EEA, this can be the authority where you live, work, or believe an infringement occurred. UK complaints may be submitted to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/. Other local complaint rights remain available.

For information you place in a VM on behalf of other people, you generally determine its purposes and means. AceRDP may act as a processor for the hosting operation, while remaining a controller for its own account, billing, security, and legal-compliance purposes. These roles depend on the actual activity, not just contractual labels.

Provide required notices and lawful instructions, and ensure any required data-processing agreement and transfer safeguards are in place. This Privacy Policy alone is not an Article 28 data-processing agreement. Requests concerning another customer's hosted content should normally go to that customer; we assist as required by our role and applicable law.

Accounts are restricted to people aged 18 or older. We do not routinely verify age. If we learn that an ineligible minor has supplied account information, we assess appropriate restriction and deletion, subject to legal record-retention needs. Contact support if you believe this has occurred.

We update this policy when our processing changes and show the effective date on this page. Material changes will be communicated appropriately before new processing begins where required. An update does not retroactively create consent or remove existing rights. New consent is obtained where legally required.

AceRDP LLC — 1621 Central Avenue, Cheyenne, WY 82001, United States.

Privacy, account, and support requests: [email protected]. Abuse reports: [email protected]. Website: https://acerdp.io.