Privacy policy

Last updated 24 October 2026

1. Who is responsible

Nikita Molina Arevalo, C/ Maestro Jose Rodriguez, 18008 Granada, Spain, is the controller for personal data processed by FlakeVPS. Contact: support@flakevps.com

2. What we collect

Account data: your email address and a one-way hash of your password. We never store the password itself.
Server data: the names, sizes, locations, operating systems and IP addresses of your servers. An SSH key you paste is passed to the data center to set up the server and is not stored in our database.
Technical logs: IP address, time and requested address of each visit, used to keep the service secure and to stop abuse.
Billing data: your balance, invoices and payment status. Card and bank details are handled by Stripe and never reach our servers; for a saved card we keep only Stripe's reference and a label such as "Visa ending 4242".
Domain holder data: the name, address, email and phone number you give when registering a domain. We pass it to the registrar and registry and do not keep a copy.
Team data: the email addresses of people you invite, until they accept or the invitation expires.
Mail-port requests: what you tell us in the form, kept as a record of why access was given.
Account emails: password reset links, sent from noreply@flakevps.com through our own mail server. We keep only a hash of each link's secret, for one hour.
Newsletter: only if you opted in, the date you did. It is sent from newsletter@flakevps.com; every issue has an unsubscribe link.

3. Why, and on what legal basis

To provide the service you signed up for (GDPR Art. 6(1)(b)).
To keep the service secure and prevent abuse (Art. 6(1)(f), our legitimate interest).
To keep accounting records required by law (Art. 6(1)(c)).

4. Who else receives data

Hetzner Online GmbH, Gunzenhausen, Germany, runs the data centers that host your servers and our platform. It processes data on our behalf under a data processing agreement.

Stripe Payments Europe Ltd., Dublin, Ireland, processes payments and sends invoices.

Cloudflare, Inc., San Francisco, USA, hosts DNS for game servers and for domains you register with us, and is the registrar for those domains. It receives the domain holder details you enter, which it passes to the registry. Public WHOIS shows them redacted. Transfers to the USA rely on the EU-US Data Privacy Framework and standard contractual clauses.

If you choose a server in the United States or Singapore, the data on that server is stored in that country. We do not sell personal data and do not share it for advertising.

5. Cookies and tracking

We use no analytics and no third-party trackers. One functional cookie, fv_theme, remembers your light or dark choice so the game panel can show the same theme. When you log in, your browser stores a login token in local storage; logging out removes it. Fonts are served from our own servers.

6. How long we keep data

Account and server data: until you delete your account. Deletion removes your login, email, team data, saved card and game panel login at once.
Backups: database backups are kept for 14 days. Deleted accounts are recorded in a separate list of ids (no personal data), which is applied again whenever a backup is restored, so a deleted account never comes back.
Technical logs: as long as needed for security, normally no longer than 30 days.
Invoices and payment records: for the period tax law requires (up to 10 years), without your name or email after you delete your account.

7. Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict its use, or to receive it in a portable format. You can object to processing based on legitimate interest. You can delete your account yourself in the account settings. For the other rights, email support@flakevps.com.

You can also complain to a data protection supervisory authority, in particular in the country where you live. In Spain this is the Agencia Española de Protección de Datos (aepd.es).

8. Security

Connections are encrypted with TLS. Passwords are hashed with Argon2id. Access to customer data is limited by database row level security, and login attempts are rate limited.

Found a vulnerability? Write to security@flakevps.com.