Privacy Policy

1. Controller

The data controller for the Neytom panel and marketing site is Neytom Services SRL (Romania / EU). Contact: [email protected].

Registered office, CUI and trade-register number will appear on invoices and on the Legal/Imprint page once published. We do not invent registry identifiers in this policy.

2. What we process

• Account: email, username, display name, password hash (or Google account ID if you use Google Sign-In), country/geo hints from auth, support tickets.
• Billing: plan, invoices, payment status. Card numbers are handled by Stripe / PayPal — we do not store full PAN.
• Hosting ops: domains, instance metadata, deploy logs, IP addresses used to access the panel, abuse/security signals.
• Marketing (optional): analytics/ads tags only after cookie consent.

3. Purposes and legal bases (GDPR Art. 6)

• Contract — create and operate your hosting/VPS account, billing, support.
• Legitimate interests — security, fraud prevention, service improvement, abuse response.
• Consent — non-essential cookies / marketing tags; Google Sign-In where you choose it.
• Legal obligation — tax/accounting retention where required.

4. Google Sign-In

If you use “Continue with Google”, we receive your Google account ID, email, and display name solely to authenticate you. We do not access Gmail or Drive.

5. Cookies

Essential cookies keep you signed in (host-only session) and secure forms (CSRF). Optional analytics/measurement load only after Accept all. Choice is remembered ~30 days. Change anytime via Cookie settings.

Optional connection summary (approximate region, masked IP, latency) is consent-gated and not used for ads. See system status.

6. Processors / subprocessors

We use service providers as processors or independent controllers as applicable:

• Cloudflare — CDN, DNS, WAF, TLS edge
• Stripe, PayPal — payments
• Google (Sign-In, optional Ads/Analytics after consent)
• Forward Email — transactional/inbound mail routing
• Infrastructure vendors in the EU for compute/storage (Proxmox cluster)

Business customers needing a signed DPA: email [email protected] with subject “DPA request”.

7. Retention

• Account data — while the account is active, then deleted or anonymized within a reasonable period after closure (unless legal holds).
• Billing records — as required by accounting law.
• Security/auth logs — typically weeks to months, longer if investigating abuse.
• Backups/snapshots — per plan limits (default 1 backup + 1 snapshot).

8. International transfers

Primary processing is in the EU. Some processors (e.g. Google, Stripe, Cloudflare) may process data in other regions under SCCs or equivalent safeguards.

9. Your rights

You may request access, rectification, erasure, restriction, portability, and objection where applicable, and withdraw consent for optional cookies. Contact [email protected]. You may lodge a complaint with your local supervisory authority (in Romania: ANSPDCP).

10. Children

Services are intended for adults / business users. We do not knowingly collect data from children under 16.

See also Payment & Service Terms and Acceptable Use Policy.