Abuse Response and Customer Conduct Policy
Version 3.0. Published 7 September 2026. See the Policy Version History for applicability.
1. Reports and verification
Report abuse to abuse@itnuthosting.com with the resource identifier, time, issue and supporting records. For suspected child abuse, report the location and necessary metadata; do not send or download illegal material. Copyright reports also go to abuse@itnuthosting.com, marked “Copyright report”. Send legal requests to support@itnuthosting.com, marked “Legal request”, or to the relevant provider’s address in the Terms. These contact routes do not replace a legally prescribed method for serving proceedings.
We prioritise credible urgency, severity and current harm. An anonymous report is not automatically deprioritised when it identifies an urgent threat. Before attributing a breach, we verify our control of the resource, the relevant service/customer, the evidence and the applicable policy. We distinguish a deliberately abusive operation from a compromised legitimate account where the evidence supports that distinction.
We may contain an urgent threat before completing attribution. Where feasible we preserve a limited record of the basis, timestamps, actions and upstream communications, using access controls and lawful retention. Illegal material is handled only through the applicable authorised process. An active evidence hold can delay deletion without creating customer access or a recovery guarantee.
2. Response and restoration
Active phishing, malware, attacks, serious fraud, credible threats and valid urgent legal orders may receive immediate isolation, takedown or suspension. Other remediable issues ordinarily receive a written notice and a stated cure period, usually 24–72 hours. The actual urgency and any upstream deadline determine the window. We do not promise to keep harmful content available until that period expires.
An authenticated service ticket states the affected resource, factual basis, applicable clause, action, deadline and available next step, subject to lawful confidentiality. An external provider’s allegation alone is not a complete attribution decision. We record the provider action separately from IT Nut action.
Remediation may use a restricted control panel, offline cleanup or a safe export. Payment of a charge does not authorise public restoration of harmful content. Restoration occurs only when the security issue is sufficiently resolved and upstream controls permit it. We do not repeatedly reactivate an unsafe site simply to start a one-hour re-suspension fee cycle.
Verified deliberate fraud, persistent intentional prohibited use or serious threats may result in final termination and refusal of future discretionary service. There is no entitlement to a temporary unsuspension or to purchase reinstatement. We still correct mistaken identity/factual error and comply with legally required review or remedies.
3. Reasonable cost recovery
Where a substantiated customer breach causes incremental response costs, we may seek reasonable itemised recovery under an applicable accepted fee schedule. The following ceilings and rates apply only under an accepted version covering the incident:
| Cost | Basis |
|---|---|
| Ordinary first-incident administration | Documented reasonable cost, capped at BDT 1,000 or USD 8 per affected-service incident |
| Repeated substantiated incident within 90 days | Documented reasonable administration cost, capped at BDT 3,000 or USD 24; not added to the first-tier charge for the same incident |
| Severe incident administration | Documented reasonable administration cost, capped at BDT 5,000 or USD 40; replaces rather than stacks with the other admin tiers |
| Necessary technical remediation | Actual recorded engineering time at BDT 2,000/hour or USD 16/hour in 15-minute increments, only where disclosed and reasonably incurred; no time already covered by the administration item |
| Upstream costs | Actual, evidenced and reasonably attributable third-party charges that are legally recoverable; no markup unless separately agreed |
The same causal incident is not multiplied by the number of messages, domains, employees, reports or temporary status changes. Separate services receive only separately incurred costs. No duplicate recovery is permitted across these charges, indemnity, damages or insurance. BDT prices apply to BDT invoices and USD prices to USD invoices; they are separately stated fixed currency rates. Prices for another invoice currency must be disclosed before acceptance. No arbitrary conversion is imposed after an incident.
We provide an itemisation and the relevant accepted policy version. An allegation later found incorrect does not create a charge; an erroneous charge is reversed. A compromise does not automatically excuse a customer breach, and equally does not establish one without evidence. We may seek legally recoverable serious losses through the proper dispute process; an invoice alone is not a judicial determination. Applicable reasonable-compensation rules prevail.
4. Staff safety and support abuse
Do not direct harassment, discriminatory abuse, threats, stalking or doxxing at our staff. Strong criticism, a negative review, requesting a refund, disputing a charge or contacting an authority is not abuse merely because it is inconvenient or forceful.
An agent may end an abusive interaction and move contact to a single written ticket. Except where urgent safety action is needed, we give a written warning identifying the behaviour and required change. Continued material misconduct may lead to management-only support, service restrictions justified by the actual risk, non-renewal or termination. Credible threats may be referred immediately to the appropriate authorities.
A support-conduct charge is not an automatic punishment. After a documented warning, a separate verified incident may support recovery of reasonable, evidenced incremental handling/security costs, capped at BDT 10,000 or USD 80 for that incident, according to the invoice currency, only where lawfully recoverable under the accepted version. Ordinary support time and the merits of the underlying dispute are excluded. The cap does not guarantee an award of that sum.
One continuous exchange is one incident. A manager not personally targeted checks the original record, attribution, warning, incident boundary and costs. Costs cannot also be billed under section 3. A cost decision may be disputed through the complaint route; safety restrictions can remain while a review occurs. There is always an accessible written channel for the underlying billing/legal matter.
5. Copyright and legal requests
Where the US DMCA procedure is applicable, a takedown notice must identify the work, identify and locate the allegedly infringing material, provide the claimant’s contact details and signature, and include the legally required good-faith and accuracy/authority statements. We assess facial validity and respond expeditiously under the applicable procedure.
A counter-notice has its own requirements: signature; identification and former location of removed material; a statement under penalty of perjury of a good-faith belief in mistake or misidentification; name, address and telephone; consent to the required US federal court jurisdiction, including the statutory rule for persons outside the US; and acceptance of service from the complainant or agent. It is not the takedown notice with a few words substituted.
Where section 512(g) governs, we forward a qualifying counter-notice and follow the statutory restoration process, including the 10–14 US business-day window after receipt, unless a qualifying notice of litigation changes that obligation. An independent lawful/AUP reason for continued restriction is assessed separately and explained where permitted. Repeated substantiated infringement can lead to termination; no universal three-strike entitlement is promised.
This policy does not by itself establish statutory safe-harbour eligibility. Foreign server location alone does not establish or eliminate legal duties.
We authenticate legal requests and assess authority, jurisdiction, scope, urgency and disclosure restrictions. We disclose or preserve information as lawfully required and notify the customer when legally permitted and appropriate. We do not promise that every foreign request requires an MLAT or that a server’s location prevents lawful access elsewhere.
6. Review and complaints
Send factual corrections, disputed fees and relevant evidence to the case ticket or abuse@itnuthosting.com. We aim to provide management review within five business days or explain a justified delay. A response target does not restrict a regulator, court, statutory counter-notice or processor deadline. A final discretionary business decision does not eliminate legally required remedies.