Privacy Policy

1. Who we are

Web Dev Heroes Ltd ("we", "us") makes IAM4Hosts and runs iam4hosts.com and the client area. We are the controller of the personal data described in this policy, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Questions or requests about your data: open a ticket or use the contact form in the client area.

2. The licence check the plugin makes

Every installed copy of the plugin, on every control panel and on both the free edition and Premium, contacts our licence server at iam4hosts.com about every six hours, and sooner when an administrator presses Check now. Each check sends:

• the server's IP addresses;
• the server's hostname;
• the control panel type (cPanel & WHM, DirectAdmin or Plesk);
• the plugin version;
• a random one-time value used to protect the answer.

Like any connection over the internet, the check also reveals the public IP address it comes from. We use that connecting address to find the licence for the server. The list of addresses the plugin reports is not stored.

What we store: for each check, the connecting IP address, the hostname, the panel type, the plugin version, the time and the result (licensed or not). If the server has a licence, the latest of these is also kept with the licence so that you and our support team can see when it last checked in.

What is never sent: the names, domains, email addresses, files or any other details of the hosting accounts on your server, or of your customers and resellers. Detection, notices and every other part of the plugin run on your server.

Why: to tell a licensed server from an unlicensed one and switch Premium on or off, to stop licences being shared between servers, and to help when you contact support. For Premium customers this is necessary to provide the licence you bought (performance of a contract). For free installations it is in our legitimate interests, to run and protect our licensing and to know which versions are in use; the data is limited to what a server already shares with any website it connects to, plus its hostname.

A server's IP addresses and hostname can identify a person, for example a sole trader, so we treat them as personal data. To stop the checks, uninstall the plugin.

3. Anonymous weekly statistics

From version 3.1.10, including its beta releases, every installed copy of the plugin also sends a short statistics report to iam4hosts.com once every seven days. It is switched on by default, and nothing is sent until an administrator has accepted the terms. Each report contains only:

• a random install ID, generated by the plugin when it is installed and not based on anything about the server;
• the control panel type and the plugin version;
• three totals: the number of accounts currently listed as inactive, the number of accounts removed, and the disk space freed.

A report never contains an account name, domain, owner, email address, hostname or IP address.

What we store: one row per installation per week with the values above and the time it arrived. There is no IP address in it, and the code that receives the report never reads the address the request came from. Like every request to this website, the request is still recorded in our web server's access logs, which include the connecting IP address (see section 7). Those logs are not linked to the statistics.

Kept apart from the licence check: the statistics are stored separately from the licence check described in section 2, and we never match the two up.

Why: to see how many servers use the plugin, on which panels and versions, and how much it cleans up, so we can decide what to work on and publish overall figures. Because a report identifies no person or server, we do not treat its contents as personal data. Where it could be, our basis is legitimate interests.

Switching it off: an administrator can turn the statistics off at any time in the plugin's Settings. No more reports are sent after that. Reports already received are kept as anonymous totals.

4. Update checks

The plugin also checks for new releases by downloading a small release file from iam4hosts.com. That download sends no information about your server beyond the request itself. Like any request to this website, it is recorded in our web server's access logs with the connecting IP address (see section 7).

5. Your customers' data, on your server

The plugin reads information about the hosting accounts on your server, including domains, DNS results and the email addresses of the resellers who own the accounts, and sends notices using the email settings you choose. All of this happens on your server. We do not receive it, so for that data you are the controller and we are neither its controller nor its processor. You are responsible for telling your customers and resellers about it where the law requires.

6. Buying a licence and the client area

When you create an account or buy a Premium licence at iam4hosts.com/clients, we collect:

• your name, company name, email address, postal address and phone number, if you give it;
• the server IP address and server name you give for each licence;
• your orders, invoices and payments;
• support tickets and messages you send us;
• the IP address and time of your logins to the client area, for security.

We use this to provide and bill for your licences, to send service emails such as invoices, renewal reminders and licence warnings, to provide support, and to meet our legal obligations. The basis is performance of a contract, our legal obligations for accounting records, and our legitimate interest in keeping the client area secure.

Card and other payment details are entered with the payment provider you choose at checkout and processed by them. We do not see or store full card numbers.

We send no marketing emails unless you have agreed to receive them, and you can stop them at any time.

7. This website

iam4hosts.com has no analytics, advertising or tracking. Our web server keeps standard access logs (IP address, time, page requested and browser) for security and to fix problems.

The site loads its fonts from Google Fonts, so your browser connects to Google, which receives your IP address. Google's handling of that data is set out in Google's own privacy policy.

The client area uses cookies that are strictly necessary for logging in, the shopping cart and security. It does not use advertising or tracking cookies.

8. Who we share data with

We share personal data only with providers who help us run the service, under contracts that require them to protect it: our web hosting provider, who hosts this website, the client area and the licence server; our payment providers; and our email delivery provider. We also share it when the law requires us to. We never sell personal data.

Some providers, such as Google, may process data outside the UK. Where they do, we rely on the safeguards UK law requires, such as UK adequacy regulations or the International Data Transfer Agreement.

9. How long we keep it

• Licence check history: 90 days, then deleted automatically.
• The latest check for a licensed server: as long as the licence exists in our client area.
• Weekly statistics: kept as anonymous totals so we can show trends over time. Because they identify no one, there is no fixed deletion date.
• Client account, orders and invoices: while your account is open and then for as long as the law requires us to keep accounting records, normally six years.
• Support tickets: while your account is open, so we have the history if the same problem comes back.
• Web server access logs: a short period, kept by our hosting provider.

10. Security

Licence checks, statistics reports, the client area and this website use HTTPS. Licence answers are digitally signed so that a server can tell a genuine answer from a forged one. Access to our systems is restricted to the people who need it.

11. Your rights

Under UK data protection law you have the right to ask for a copy of your personal data, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on legitimate interests you can object at any time. Some rights have limits; for example we must keep invoices for as long as the law requires.

To use any of these rights, open a ticket or use the contact form in the client area. We will reply within one month.

If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

12. Changes to this policy

We may update this policy, for example when the plugin changes what it sends. The version on this page, with its date, applies. If we change what the plugin sends, we will say so in the release notes.

13. Contact

Web Dev Heroes Ltd. Questions about this policy or your data: open a ticket or use the contact form in the client area. See also our Terms and Conditions.