Privacy Notice
Version 3.2. Published 15 October 2026. This notice describes personal-information processing. It does not obtain consent merely because you visit the site or accept service terms.
1. Who is responsible and how to contact us
IT Nut Hosting is used by two businesses. Reyazul Masud Riham, trading as IT Nut Hosting, operates the Bangladesh sole proprietorship at Tinmatha Railgate, Bogura Sadar, Bogura, 5800, Bangladesh. Nut Digital LLC, organised in Wyoming, USA, also trades as IT Nut Hosting. Its registered-agent and mailing address is 30 N Gould St Ste R, Sheridan, WY 82801, USA. That address is not a customer-support office.
The business supplying your order is responsible for its account, billing and service-administration processing. The Terms of Service explain provider identification and the treatment of existing orders. Both businesses use the central client area and the same Bangladesh support team. The Bangladesh operation also handles website enquiries and support administration. Selecting Stripe does not move support work to the USA. Stripe processes payments; it does not provide your hosting or customer support.
Send privacy enquiries to support@itnuthosting.com, marked “Privacy request”, or open an authenticated client-area ticket. You may also write to the Bangladesh address above, identifying the account and relevant provider if known. We will route a request to the responsible business; you need not resolve our internal allocation before contacting us. Do not send passwords, full card numbers or unnecessary identity documents in an ordinary email.
For personal information in a customer’s website, email, database or application, the customer normally determines the purpose and we process it on the customer’s instructions under the Data Processing Addendum. A customer can itself act for another controller. Visitors to a hosted website should normally contact that website’s operator about its privacy practices. Our independently determined billing, security and legal processing remains subject to this notice.
2. Information we use and why
We receive information from you and your authorised users, through service activity and website interactions, and from payment providers, registrars, fraud/security sources and people reporting a service issue.
| Activity | Information and purpose |
|---|---|
| Account and service administration | Names, organisation, contact details, authorised users, orders, configuration and access records to create accounts, deliver services, communicate and manage renewals |
| Payments and accounting | Billing details, invoice and transaction references, payment status and relevant processor tokens or payment-method details to reconcile payments, issue refunds and maintain records |
| Verification | Identity, business, domain-rights or payment evidence reasonably needed for a specific fraud concern, registry rule or applicable legal requirement |
| Support | Tickets, messages, attachments, service history and relevant diagnostic information to investigate and resolve enquiries |
| Security and abuse | IP addresses, timestamps, login/activity logs, network or application events and relevant reported content to protect systems, investigate misuse and preserve necessary evidence |
| Promotional limits and abuse prevention | To apply per-customer promotional limits and prevent abuse, we compare phone numbers, email addresses, payment payer details (bKash, Nagad or card payer), company and postal address details, device identifiers and network addresses across accounts. We store these comparisons as salted one-way hashes where we can, and we use them only for promotional limits, fraud and security. |
| Website measurement and advertising | Device/browser information, referral and page/event information, identifiers and relevant contact-matching information as explained in the Cookie and Tracking Notice |
| Legal matters | Information relevant to a verified legal request, complaint, dispute, record-preservation duty or defence of a claim |
Providing information reasonably necessary to deliver a service or perform required verification is a condition of that activity. If it is missing, we may be unable to activate the service or complete the requested change. Optional marketing information is separate. We explain a specific document request and permit appropriate redaction where the omitted information is not needed.
Payment providers operate their own payment interfaces and can collect information directly. Our systems receive the information needed to manage the transaction. We do not request a payment PIN, one-time password or full card-security details through support. Some service credentials must remain usable by the relevant service or authorised support process; this notice does not claim every stored secret is irreversibly hashed.
Where EU or UK data-protection law applies, the basis for necessary account delivery is performance of the contract with the individual, or our legitimate interest in serving an organisational customer. Relevant legitimate interests also include service security, fraud prevention, proportionate support administration and legal-claim handling, subject to the required balancing and safeguards. We use consent where applicable law requires it, including for relevant optional tracking or marketing. We rely on a legal obligation only where that obligation qualifies under the applicable law. A Bangladesh or US duty is not automatically an EU or UK statutory basis for processing or overseas disclosure.
3. People and organisations receiving information
We disclose information relevant to the recipient’s actual function. Recipients can include:
- Authorised personnel, including the Bangladesh support operation serving both businesses.
- Infrastructure, network, storage, backup, security and email-delivery providers supporting the purchased service.
- Payment processors and financial institutions involved in your transaction, including Stripe for Stripe payments and the relevant bKash, SSLCommerz or Bangla QR payment participants for those routes.
- The registrar, registry and verification/dispute providers required for a domain transaction. Their independent registration and lawful-disclosure duties can differ from ours.
- Support, collaboration and AI-tool providers used for relevant customer-service work, including Anthropic for Claude-assisted support processing.
- Google and Meta for the measurement and advertising activities described in the Cookie and Tracking Notice.
- Professional advisers, insurers, competent authorities and other parties where a justified legal claim, verified legal duty or lawful business transfer requires it, with appropriate confidentiality and disclosure limits.
These recipients are not all processors of hosted customer data. A payment processor or registrar may act independently for its own legal purposes. The service-specific subprocessor record under the DPA identifies parties authorised to process hosted data on your behalf. Ask support for the record relevant to your purchased service, including the legal entity, function and processing locations.
AI tools can assist with classifying enquiries, summarising account or service history and preparing responses. Relevant ticket text, attachments, service context and examples from support records may be processed through those tools. AI output can be inaccurate. Request staff review of a disputed answer or account decision through a ticket. Do not include unrelated sensitive personal information in a request. We do not represent all AI-provider accounts as having identical retention or model-training terms, or claim that turning off local session saving prevents every provider-side record. A customer needing restricted support-data handling should arrange it before submitting restricted material.
Billing and security automation can suspend overdue services or restrict activity in response to payment or risk signals. The Terms explain the ordinary non-payment schedule. Contact support for review of a suspected error. Applicable rights concerning a decision made solely by automated means remain available; this notice does not waive them.
4. Countries and transfers
The primary hosting region is described in your order. Support access from Bangladesh applies to both businesses. Payment processing, registrars, infrastructure suppliers, backups, collaboration and AI tools may involve the USA or other countries as relevant to that service. Buying a server in one country does not mean every support session or data copy stays there.
If your data requires a particular residency restriction, processing agreement or international-transfer safeguard, contact us before sending it so the service can be assessed and the required arrangement completed. Where law requires a transfer instrument, assessment or additional safeguard, those requirements must be satisfied for the actual parties, data and destinations. Accepting general Terms is not a universal transfer authorisation. We do not claim that standard contractual clauses or another transfer instrument have been executed for every customer merely by publishing this notice. You may request information about the safeguards applicable to your processing and, where required, a copy with justified confidential information protected.
5. Retention and deletion
Retention depends on the record and its purpose. We use the following criteria; these are not promises that all systems erase information on the same fixed day:
| Record | Retention criteria |
|---|---|
| Account and contacts | Active service administration, followed by the period necessary to resolve closure, maintain necessary transaction evidence and handle applicable claims or duties |
| Invoices and transactions | The applicable accounting, tax, audit and claim requirements for the business and transaction; necessary financial records may remain after account closure |
| Verification material | The specific verification, fraud, registry or legal need; retain only the necessary evidence and avoid keeping an entire document where a smaller record suffices |
| Support and diagnostics | The enquiry, related service history, recurring-issue investigation and justified service-quality or claim needs; attachments and ticket text can have different deletion cycles |
| Security and abuse records | Detection and investigation needs, repeated-risk assessment and any relevant legal or dispute hold, with access limited to the purpose |
| Hosted content and backup copies | The purchased service, lawful termination/deletion point, applicable DPA instructions and backup rotation described in the Service Scope and Backup Policy |
| Marketing and choices | The relevant activity or permission, with a limited suppression or preference record retained where necessary to respect an objection or withdrawal |
| Contract and notice evidence | The applicable transaction, claim and legal-record requirements, including proof of the terms and notices applicable to the order |
When the justified retention need ends, information should be erased or anonymised through the relevant system process. A necessary legal hold may extend retention with restricted use. Production deletion, expiry of backup copies and retention of accounting or dispute records are separate. Deleting an account does not by itself remove information already lawfully received by an independent payment provider or registrar. We can explain the retention assessment relevant to a specific request.
6. Security and incidents
We use measures appropriate to the service and risk, including access restrictions and authentication, protected administrative connections, account separation and relevant logging. Backup coverage depends on the purchased service. We do not promise absolute security or universal encryption of every stored backup. You must secure the credentials and software you control; our own security responsibilities remain ours.
We assess reported incidents, take appropriate containment action and make customer, individual and authority notifications according to our role and the applicable legal trigger and deadline. Information may be supplied in phases. We do not postpone an awareness-based notification requirement until every forensic detail is confirmed.
7. Choices, rights and complaints
Depending on the applicable law, you may request access, correction, erasure, restriction, portability, an explanation or review of relevant automated decisions, or object to processing. You may withdraw consent for future processing based on that consent, without changing the lawfulness of earlier processing. An objection to direct marketing is respected; necessary service and security communications can continue.
Use the privacy contact in section 1. We authenticate proportionately and respond within the applicable legal period. The usual EU/UK response period is one month; where an extension is lawfully necessary, we explain it within that period. Rights have legal conditions, but we will explain a refusal and the available complaint route. A customer need not buy a backup subscription to exercise a data right that law requires us to provide without that charge.
You may complain to the authority or court competent under the law applicable to your information. EU individuals can approach their competent supervisory authority; UK individuals can contact the Information Commissioner’s Office. Bangladesh complaints and remedies remain available under applicable, commenced law. Our internal review is not a condition on protecting a statutory deadline or contacting an authority.
Direct service contracts require adult contractual capacity. This does not mean hosted content can never include children’s information. The customer must ensure its collection and instructions are lawful; we address reports of inappropriate collection under the applicable rules.
Material changes to information practices receive the notice and, where required, choices or consent required by law. A contract amendment does not silently authorise an incompatible new purpose. See the Policy Version History for previous notices and transition information.