Server Surgeon recognizes the importance of protecting the privacy of personal information about our customers. This policy explains what we collect, how we use it, who we share it with, how long we keep it, and the rights you have over it. We collect only what we need to run our Linux server management and backup services, and we do not sell your personal information.
Information We Collect
We collect only what we need to provide and bill our services:
- Account & contact details — name, business name, email address, and phone number you provide when you order or contact us.
- Billing information — billing address and the payment details needed to process your subscription. Card numbers are entered into and stored by our payment processors (see below), not by Server Surgeon.
- Server access credentials — when you ask us to manage or back up a server, you send credentials through the encrypted, sensitive-data fields of our support portal. They are used only to perform the work you request.
- Usage data — standard web analytics (pages viewed, approximate location, device and browser) collected on our website, as described under Cookies and Analytics.
How We Use Your Information
We use this information to set up and deliver server management and backup, to respond to your support tickets, to bill your subscription, to send service and account notices, and to meet our legal and tax obligations. We do not sell your personal information, and we do not use it for third-party advertising.
Service Providers and Sub-Processors
We share personal information only with the providers needed to run the service, each bound to keep it confidential:
- Payment processing — Stripe and PayPal process card and account payments. Your full card details are handled by them under PCI DSS and are not stored by Server Surgeon.
- Billing system — our self-hosted WHMCS client portal (at support.serversurgeon.com) stores your account and invoice records.
- Hosting & infrastructure — our production systems and your off-site backups run in our own locked rack at the PhoenixNAP datacenter in Phoenix, Arizona.
- Website analytics — Google Analytics 4, as described below.
Cookies and Analytics
Our website uses Google Analytics 4 (GA4) to understand how visitors use the site so we can improve it. GA4 sets cookies that collect anonymized usage data such as pages viewed and approximate, IP-derived location; we do not use this data to identify you personally. You can block cookies in your browser, or opt out of Google Analytics with Google’s opt-out browser add-on. Our client portal and order forms also use strictly-necessary cookies to keep you signed in and to process your order.
When you click an “Order” button or place an order, we also record the request’s IP address and approximate, city-level location on our own server to measure interest in our plans and to help detect fraudulent orders. These order-funnel logs are kept for about 90 days and are not used to advertise to you.
Data Retention
We keep account and billing records for as long as your subscription is active, and afterward only as long as needed for legal, tax, and accounting requirements. Server credentials you send us are deleted within 24 hours of the related support ticket being closed — including any login details we send back to you. Off-site backups are retained on your plan’s schedule (7 daily plus 4 weekly recovery points by default) and are removed when you cancel the backup service.
Your Privacy Rights (GDPR)
If you are in the European Economic Area or the United Kingdom, you have the right to access, correct, delete, restrict, or object to our processing of your personal data, and to receive a copy of it in a portable format. We process your data on the legal bases of performing our contract with you, complying with the law, and our legitimate interest in operating and securing the service. To exercise any of these rights, email us at the address below; we respond within the time the law requires. You may also lodge a complaint with your local data-protection authority.
California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information we collect and how we use it, to request access to or deletion of that information, and not to be discriminated against for exercising these rights. We do not sell or share your personal information as those terms are defined under California law. To make a request, contact us at the address below.
International Data Transfers
Server Surgeon is based in the United States, and your information is processed here. Where we receive personal data from the EEA, UK, or other regions, we rely on appropriate safeguards for that transfer and protect the data to the standards described in this policy.
How We Protect Your Information
We maintain administrative, technical, and physical safeguards to protect personal information: encrypted sensitive-data fields for credentials, access limited to the staff who need it, and systems housed in a locked rack at the PhoenixNAP datacenter. No method of transmission or storage is perfectly secure, but we work to protect your information and to limit how long we hold it.
Children’s Privacy
Our services are for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16.
Changes to This Policy
We may update this policy as our practices or the law change. Material changes will be reflected here with a new “Last updated” date above.
Questions about this policy
For privacy-related questions or to exercise your right to access, correct, or delete information we hold about you, email sales at serversurgeon dot com or use our contact form. Our Terms of Service describe the legal agreement between you and Server Surgeon.