Privacy Policy

1. Who We Are

LeyndHost is a trading name of DataPasa Limited. DataPasa Limited (“we”, “us”, “our”) is the data controller responsible for your personal data.

This policy covers our website at https://leynd.host, the customer panel at https://my.leynd.host and the Services described in our Terms of Service.

2. Data We Collect

We collect only what we need to run the Services:

• Account data: your email address and your password. The password is stored only as a salted hash and is never stored in readable form. Each account is also given an 8 digit account number.
• Invoices: the amount, the coin and network you paid with, and the payment reference and transaction id returned by Cryptomus, our payment processor.
• Support tickets: the messages you write to us and our replies.
• Sign in records: the IP address and browser user agent of each sign in to your account, kept for 14 days for security and then deleted.
• Server metrics: technical measurements of your servers, such as CPU use and traffic volume, kept while the server exists so we can show them in the panel and keep the network healthy, and deleted together with the server.
• IP assignment records: which IP address was assigned to which server, linked to your account number (see Section 4).
• Domain registrant data: only if you order a domain. The registry requires the registrant’s name, postal address, phone number and email address. You enter these when you order the domain.

3. Data We Do Not Collect

• We do not ask for your name, phone number, postal address or identity documents when you sign up or pay. The only exceptions are domain orders (Section 2) and the narrow legal cases described in Section 11 of our Terms of Service.
• We do not collect device fingerprints.
• We run no analytics, no advertising and no third party tracking scripts on the website or the panel.
• We set no advertising or tracking cookies. The only cookies we use are listed in Section 10.

4. Your Server Traffic

We do not log the contents of your server traffic or the connections your server makes.

We keep a record of which IP address was assigned to which server, linked to the account number, for 90 days after the address is released. We need this to handle abuse reports about an address, including reports that arrive after a server has been deleted.

Automated external checks

Some countries block whole IP ranges when a server on them imitates a well known third party website. To protect our IP ranges, and so every customer on them, an automated scanner connects to the public ports of customer servers and inspects only the TLS handshake, specifically the server name (SNI) presented. It looks for servers masquerading as third party sites, for example VLESS Reality configured with someone else’s domain. The scanner does not read the contents of your traffic.

A server detected in this way may be stopped after a warning, as described in our Acceptable Use Policy and Terms of Service. Our lawful basis is legitimate interests: keeping our network reachable for all customers.

5. How We Use Your Data

6. Support Tickets

The text of support tickets may be processed by an AI language model provider, OpenRouter, Inc., to help our staff draft replies and to filter spam and abusive messages. Staff review every reply before it is sent. Do not put passwords or other secrets in a ticket.

Alerts about new tickets and payments are sent to our staff through Telegram. They contain the ticket subject or invoice ids. They never contain passwords.

7. Who We Share Data With

We never sell your personal data. The outside parties that receive it are:

Requests from authorities

We disclose data to authorities only where UK law requires it and only in response to a valid legal process. We notify you of such a request unless the law forbids it. Because we hold little data, there is little we can disclose.

8. International Transfers

Some of the recipients above are located outside the United Kingdom. Where we transfer personal data abroad, we rely on adequacy regulations made by the UK government, or on the UK International Data Transfer Agreement, or on the UK Addendum to the EU Standard Contractual Clauses.

9. How Long We Keep Data

When a server is deleted, its disk is wiped before the storage is reused. We keep no backups of customer servers.

10. Cookies

We use only strictly necessary cookies:

• Session: keeps you signed in to the panel.
• Language: remembers the language you chose.
• Referral code: set when you arrive through a referral link, so the referral can be credited. It lasts 30 days.

We set no analytics, advertising or tracking cookies. Cloudflare Turnstile may process technical data in your browser to check that you are not a bot when you sign up or sign in.

11. Security

• Passwords are stored only as salted hashes.
• You can protect your account with optional two factor authentication: an authenticator app, passkeys and recovery codes.
• All connections to our website and panel are encrypted with TLS.

12. Your Rights

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you have the right to:

• Access: get a copy of the personal data we hold about you.
• Rectification: have inaccurate or incomplete data corrected.
• Erasure: have your data deleted where we have no lawful reason to keep it.
• Portability: receive your data in a structured, machine readable format.
• Objection: object to processing based on legitimate interests.
• Restriction: ask us to limit processing in certain circumstances.

To exercise any of these rights, email [email protected] from the email address of your account, with “data protection” in the subject line. Writing from the account email lets us confirm the request is yours without asking for anything else. We respond within one month.

Some records cannot be erased on request, such as invoices we are legally required to keep. In that case we tell you what we keep and why.

13. Right to Complain

If you are unhappy with how we handle your personal data, you have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection. You can contact the ICO at ico.org.uk or by calling 0303 123 1113. Quote our registration reference ZC223060. We would appreciate the chance to address your concern first.

14. Changes and Contact

We may update this Privacy Policy from time to time. The date at the top of this page shows the latest revision. We will notify you of material changes by email to your account address.

For any question about this policy or your personal data, contact [email protected].