Legal
Privacy policy
We collect what is needed to sell you a server, bill you for it and keep the network safe. Not more. This policy says exactly what that is.
1. Who is responsible for your data
FLOW DIGITAL – FZCO, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates, is the controller of the personal data described here. Privacy questions go to legal@flowvds.com.
2. What we collect
Account data. Name, organisation, email address, postal address, phone number and, for companies, tax registration details. Needed to form a contract and to issue a valid invoice.
Billing data. Invoices, payments, refunds and the last four digits and expiry of a card. Full card numbers are handled by our payment processors and never reach our systems.
Service data. Server identifiers, IP addresses assigned to you, plan, location and provisioning history.
Technical logs. Panel authentication events, API calls, support tickets, and network flow metadata retained for security and troubleshooting.
Website data. Aggregate page-level statistics. This site sets no advertising cookies and embeds no third-party trackers.
We do not read, index or analyse the contents of your server. What you store on your server is yours, and we access it only if you ask us to as part of a support request or if we are legally compelled to.
3. Why we process it
- To perform the contract — provisioning, support, billing and account administration.
- To comply with legal obligations — tax and accounting records, and responses to lawful requests from competent authorities.
- For legitimate interests — fraud prevention, abuse handling, network security and capacity planning.
- With consent — product announcements you have opted into, which you can leave at any time without affecting your service.
4. Who we share it with
Payment processors, to take payment. Data centre and network operators, where an server ID or IP address must be shared to resolve a fault or an abuse report. Accountants and auditors, under confidentiality. Competent authorities, where a valid legal order requires it.
We do not sell personal data and we do not share it with advertisers or data brokers. There is no circumstance in which that changes.
5. International transfers
We are based in the United Arab Emirates and operate infrastructure in 40 countries. Account and billing data is held on our systems in the UAE and the European Union. Service and network data may be processed in the country hosting your server, which is a country you chose.
6. How long we keep it
- Account and billing records: for the life of the account and then for the period required by UAE tax and company law.
- Server and provisioning records: two years after the server is terminated.
- Authentication and API logs: twelve months.
- Network flow metadata: ninety days, unless retained longer for a specific security investigation.
- Support tickets: three years.
- Server disk contents and backups: deleted on termination, subject to the retention window in the terms of service.
7. Your rights
You may ask for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it where we are not required to keep it, object to processing based on legitimate interests, or ask for your data in a portable format.
Write to legal@flowvds.com from the address on the account. We respond within thirty days. If you are in a jurisdiction with its own data protection authority, you retain the right to complain to it.
8. Security
Panel access supports two-factor authentication and scoped API tokens. Administrative access to our systems is restricted, individually attributed and logged. Data in transit is encrypted. Backups are held on separate storage from the hypervisor they protect.
No provider can promise that a breach is impossible. If one occurs and affects your personal data, we will tell you what happened, what was affected and what we are doing about it, without waiting until the story is comfortable.
9. Cookies
This website uses a single functional cookie to remember your session if you sign in, and aggregate page statistics that do not identify you. No advertising, profiling or cross-site tracking cookies are set, and there is nothing here for a consent banner to ask about.
Questions about this document go to legal@flowvds.com.