Privacy Policy

1. Who We Are

1.1. Four Seasons Hosting is an assumed name (d/b/a) of Rogue Wave Hosting LLC, a Texas limited liability company (“Rogue Wave Hosting,” “Four Seasons Hosting,” “we,” “us,” or “our”). Rogue Wave Hosting LLC is the data controller for the information described in this policy.

1.2. For privacy questions, requests, or complaints, contact us at privacy@fourseasonshosting.com.

2. Scope

2.1. This policy covers information we collect through www.fourseasonshosting.com, our billing portal, our control panels, our support systems, and the hosting services we provide (the “Services”).

2.2. This policy does not cover content that you or your users store on or transmit through a server you rent from us. You are the controller of that content, and you are responsible for its handling, including any privacy notice your own users require. We process it only as described in Section 6.

2.3. This policy does not cover third-party websites, game servers, mods, plugins, or services you reach through the Services. Those operate under their own privacy policies.

3. Definitions

3.1. “You” or “the client” means the individual or entity that uses, purchases, or registers for the Services.

3.2. “Personal information” means information that identifies, relates to, or can reasonably be linked to an identifiable person. Where the General Data Protection Regulation (“GDPR”) applies, this has the same meaning as “personal data.”

3.3. “Service content” means the files, databases, game worlds, logs, and other data you or your users upload to or generate on a server you rent from us.

4. Information We Collect

4.1. Account information. Your name, email address, billing address, phone number, company name where applicable, and the username and password you set.

4.2. Billing information. Invoices, transaction records, the payment method type, and the last four digits and expiry of a card. We do not store full card numbers. Card and PayPal details are collected and held by our payment processors, not by us.

4.3. Tax and compliance information. VAT or tax identification numbers where required, and any documentation you provide to verify identity or resolve a payment dispute.

4.4. Service data. The services on your account, their configuration, resource usage, and the IP addresses and ports assigned to them.

4.5. Technical and log data. IP addresses, browser type and version, device and operating system information, pages visited, timestamps, referring pages, authentication and panel activity logs, network flow records, and DDoS mitigation logs.

4.6. Support data. The content of support tickets, including attachments and screenshots, and messages you send us through our Discord server or by email.

4.7. Cookies and similar technologies. We use cookies for authentication and session management, security and fraud prevention, and basic analytics. You can block or delete cookies in your browser, but the billing portal and control panels will not work without the ones needed to keep you signed in.

4.8. Service content. We do not routinely access the contents of your servers. Our staff access service content only when you ask us to, when needed to maintain or repair the infrastructure, or when investigating a suspected violation of our Terms of Service or Acceptable Use Policy.

5. How We Use Information

5.1. To create and manage your account, provision and operate your services, and provide support.

5.2. To invoice you, process payments and refunds, apply account credit, and respond to chargebacks and payment disputes.

5.3. To send you service communications, including invoices, renewal and payment reminders, maintenance and incident notices, and changes to our legal terms. You cannot opt out of these while you hold an active service.

5.4. To secure our network and our clients, including detecting and mitigating attacks, investigating abuse reports, preventing fraud, and enforcing our Terms of Service and Acceptable Use Policy.

5.5. To maintain and improve the Services, including capacity planning and diagnosing faults.

5.6. To comply with legal obligations, including tax and accounting requirements, and to respond to valid legal process.

5.7. To send marketing emails about our products and offers, where you have opted in. Every marketing email includes an unsubscribe link, and unsubscribing does not affect the communications in Section 5.3.

5.8. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

6. Legal Bases for Processing

6.1. Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• a. Performance of a contract for creating and running your account, providing and supporting the Services, and billing you;
• b. Legitimate interests for network and account security, abuse and fraud prevention, service improvement, and enforcing our terms. We balance these against your rights and interests;
• c. Legal obligation for tax, accounting, and responses to lawful requests from authorities; and
• d. Consent for optional marketing emails and non-essential cookies. You can withdraw consent at any time, which does not affect processing already carried out.

6.2. In relation to service content, we act as a processor on your behalf and process it only on your instructions, except where the law requires otherwise. If you need a data processing agreement, contact us at privacy@fourseasonshosting.com.

7. How We Share Information

7.1. We do not sell your personal information. We share it only as described below.

7.2. Service providers. We use third parties to run our business, and they process your information only on our instructions and only as needed to provide their service to us. The categories we use, and representative providers, are:

• a. Billing and client management: WHMCS;
• b. Payment processing: Paypal, Stripe;
• c. Infrastructure, data centers, and network transit partners in the regions where we operate;
• d. Network security and DDoS mitigation;
• e. Transactional and marketing email delivery;
• f. Support ticketing and communications, including Discord where you contact us there;
• g. Domain registration, where you register a domain through us; and
• h. Documentation and website hosting.

7.3. Each of these providers has its own privacy policy. Where you interact with a provider directly, such as a payment processor or Discord, a request to delete data held by them may need to go to them as well as to us.

7.4. Domain registration. Domain registries and registrars require registrant contact details and may publish or disclose them under ICANN policy or the rules of the relevant registry. We pass on only what the registration requires.

7.5. Legal and safety disclosures. We may disclose information where we reasonably believe it is required by law or valid legal process, or where it is necessary to investigate suspected fraud or abuse, protect our rights or property, or protect the safety of any person. Child sexual abuse material is reported to law enforcement and to the National Center for Missing & Exploited Children.

7.6. Abuse complaints. When we receive an abuse or copyright complaint about a service on your account, we may pass your response to the complainant, and may share limited account information where required by law or by our upstream providers.

7.7. Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a materially different privacy policy.

8. Law Enforcement and Legal Requests

8.1. Requests for client data from law enforcement must be supported by a subpoena, court order, warrant, or equivalent legal process valid in the relevant jurisdiction, and should be sent to legal@fourseasonshosting.com.

8.2. We review each request and disclose only what the request requires and the law compels.

8.3. Where we are legally permitted to do so, we will notify the affected client before disclosing their data, unless doing so would risk harm to a person or obstruct an investigation.

8.4. Access to client data by our staff is limited to those who need it for their role, is logged, and is governed by confidentiality obligations.

9. International Transfers

9.1. We operate infrastructure in the United States, Canada, Germany, and Belgium. Our billing and support systems are operated from the United States, so your account and support information is processed there regardless of which region your servers run in.

9.2. Where you choose a server location, your service content is stored in that region unless you move it.

9.3. Where we transfer personal data out of the European Economic Area or the United Kingdom, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism. You can request a copy of the safeguards we use by writing to privacy@fourseasonshosting.com.

10. Data Retention

10.1. Account and billing records. Kept for the life of your account and for 7 years after it closes, to meet tax, accounting, and audit obligations.

10.2. Service content. Deleted according to our Terms of Service. A terminated service and its backups are deleted permanently and cannot be recovered. Where a service is suspended or terminated for suspected illegal activity or abuse, we may retain its data for up to 365 days.

10.3. Support tickets. Kept for 3 years after the ticket is closed.

10.4. Security, authentication, and network logs. Kept for up to 12 months, except where a specific record is retained longer as part of an active abuse, fraud, or legal investigation.

10.5. Marketing records. Kept until you unsubscribe, plus a minimal suppression record so that we do not contact you again.

10.6. Fraud and abuse records. Where an account was terminated for fraud, chargeback abuse, or a serious violation of our terms, we keep a minimal record of the account identifiers indefinitely so that we can enforce Section 9.4 of our Terms of Service.

10.7. Where a longer period is required by law or a legal hold, we keep the affected records for as long as that requires.

11. Your Rights

11.1. Depending on where you live, you may have the right to:

• a. Access the personal information we hold about you and receive a copy of it;
• b. Correct inaccurate or incomplete information;
• c. Delete your information, subject to the exceptions in Section 12.6;
• d. Receive your information in a portable, machine-readable format, or have it sent to another provider where technically feasible;
• e. Object to or restrict processing based on our legitimate interests;
• f. Withdraw consent for marketing or non-essential cookies at any time; and
• g. Not be discriminated against for exercising any of these rights.

11.2. We do not use your personal information for automated decision-making that produces legal or similarly significant effects.

11.3. If you are in the EEA or the UK, you may lodge a complaint with your local supervisory authority. If you are in Texas, you may contact the Office of the Texas Attorney General.

12. Making a Request

12.1. Send requests to privacy@fourseasonshosting.com from the email address on your account, or open a ticket from inside your account.

12.2. We will verify your identity before acting on a request. Verification is usually satisfied by confirming control of the account email. Where a request covers sensitive information or the account email is not accessible, we may ask for additional proof, such as matching billing details or government-issued photo identification. We use identity documents only to verify the request and delete them afterward.

12.3. We respond within 30 days. Where a request is complex or you have made several, we may extend this by a further 30 days and will tell you before doing so.

12.4. Requests are free. We may charge a reasonable fee, or decline, only where a request is manifestly unfounded or excessive, particularly if it is repetitive. We will tell you the reason and the fee before doing any work.

12.5. An authorized agent may submit a request on your behalf with written authorization that we can verify.

12.6. We may decline all or part of a deletion request where we need to keep the information to complete a transaction, comply with a legal obligation, retain financial records under Section 10.1, or detect and prevent fraud and abuse under Section 10.6. If we decline, we will tell you why.

12.7. Deleting your account information ends your Services. Requesting deletion is not the same as cancelling a service, and it does not refund an active subscription. See our Terms of Service for cancellation.

12.8. If you are an end user of a server run by one of our clients, your request should go to that client, not to us. We will forward it to them where we can identify the service.

13. Appeals

13.1. If we decline your request, you may appeal by replying to our decision, or by writing to privacy@fourseasonshosting.com with “Appeal” in the subject line, within 45 days of our response.

13.2. We will review the appeal and give you a written decision, with reasons, within 45 days.

13.3. If we deny your appeal, we will tell you how to complain to your supervisory authority or state attorney general.

14. Security

14.1. We use technical and organizational measures to protect your information, including encryption in transit, access controls and role-based permissions for staff, network monitoring, and logging of administrative access.

14.2. No system is completely secure. We cannot guarantee the security of information you transmit to us, and you are responsible for keeping your account credentials secure and for the security of the software you run on your servers.

15. Data Breaches

15.1. If we become aware of a breach affecting your personal information, we will notify the relevant supervisory authority without undue delay and within 72 hours where the GDPR requires it, and we will notify affected clients without undue delay where the breach is likely to result in a risk to their rights.

15.2. Our notice will describe what we know at the time: the nature of the breach, the categories of information involved, the likely consequences, and the steps we are taking. We will follow up as the investigation develops.

15.3. Where a client’s own service is compromised, we may suspend it to prevent further unauthorized access until the cause has been identified and resolved.

15.4. Where we act as a processor of your service content, we will notify you without undue delay so that you can meet your own notification obligations.

16. Children

16.1. The Services are sold to businesses and adults. You must be at least 18, or the age of majority where you live, to hold an account, and we do not knowingly collect personal information from children.

16.2. Our clients may operate game servers whose players include children. We do not control those servers, and we are not responsible for what happens on them. If you run such a server, you are the controller of your players’ data and are responsible for complying with the laws that apply to it, including COPPA and the GDPR provisions on children.

16.3. If you believe a child has given us personal information, contact privacy@fourseasonshosting.com and we will delete it.

17. Changes to This Policy

17.1. We may update this policy.

17.2. For material changes, we will notify you by email to the address on your account or through the Website at least 14 days before they take effect, unless the change is required to take effect sooner by law.

18. Contact Us

18.1. Privacy questions, requests, and complaints: privacy@fourseasonshosting.com

18.2. General support: through the support ticket system in your account