Privacy Policy

This Privacy Policy explains how Zilonet ("we", "us", or "our") collects, uses, shares, and protects personal information when you use our websites, domain registration, web hosting, business email, SSL, and related services (the "Services"). It also explains the rights you have over your information and how we respond to lawful requests from government and law-enforcement authorities. Please read it alongside our Terms & Conditions and Acceptable Use Policy.

1. Who we are

Zilonet operates the Services and is the controller responsible for your personal information. If you have any questions about this policy or your data, contact us using the details in the "Contact us" section below.

2. Information we collect

We collect the following categories of information so we can provide, secure, and bill for the Services, comply with our legal obligations, and support investigations into fraud, abuse, and unlawful activity:

• Account & identity data: name, organisation, email address, telephone number, postal address, country, and the username and (hashed) password for your account.
• Registrant (WHOIS) data: the registrant contact details required to register or transfer domain names, which may be published or shared with registries and ICANN as required by domain policies.
• Billing & payment data: invoices, order history, account balance and transactions, and payment references (including crypto payment identifiers from our payment processor). We do not store full card numbers.
• Service data: the domains, hosting accounts, email services, certificates, and other products associated with your account, and the identifiers (such as domain names and usernames) needed to operate them.
• Technical & device data: your IP address, the raw browser User-Agent string, and the browser, operating system, and device type we derive from it; dates and times of key actions; and session and cookie identifiers. We parse device information on our servers only — we do not run client-side device fingerprinting.
• Activity & connection logs: a record of security-relevant events — account registration, logins and failed login attempts, logout, changes to your email/password/two-factor settings, orders, payments, and service provisioning — each with the IP address, device information, and timestamp.
• Support communications: the content of support tickets, messages, and any attachments you send us.

3. How and why we use your information

We use your information to: create and manage your account; provide, maintain, and renew the Services; process orders, payments, and refunds; communicate with you about your account and support requests; secure our platform and prevent, detect, and investigate fraud, abuse, and violations of our policies or the law; and comply with our legal and regulatory obligations. Depending on your location, our lawful bases for processing include performance of our contract with you, our legitimate interests (such as security, fraud prevention, and network protection), compliance with legal obligations, and, where required, your consent.

4. Cookies & sessions

We use strictly necessary cookies and session identifiers to keep you signed in, remember your preferences, secure forms, and protect against abuse. These are required for the Services to function and are not used for third-party advertising.

5. How we share information

We do not sell your personal information. We share it only as needed to run the Services and meet our obligations:

• Domain registries and ICANN, for domain registration, transfer, and WHOIS/RDAP requirements;
• Infrastructure and service providers that help us deliver the Services (for example, our registrar/DNS, hosting control-panel, email, and payment partners), under contractual confidentiality and data-protection terms;
• Professional advisers, auditors, and authorities where required to establish, exercise, or defend legal claims; and
• Government, regulatory, and law-enforcement bodies in response to lawful requests, as described in the next section.

6. Legal requests & law enforcement

We cooperate with valid, legally binding requests from law-enforcement and government authorities. We require appropriate legal process and disclose only the information we are lawfully obliged to provide, applying the following general standards:

• Basic subscriber information (such as name, organisation, email, phone, address, country, account creation date, and the services held) may be disclosed in response to a valid subpoena, administrative or court order, or an equivalent lawful request in the relevant jurisdiction.
• Non-content records (such as connection and activity logs — IP addresses, device information, and timestamps for registration, logins, and transactions, and payment references) generally require a court order or an equivalent legal instrument.
• Content (such as the contents of hosted files, email mailboxes, or support messages) is disclosed only where required by a search warrant or an equivalent order that meets the applicable legal standard.

Preservation: on receipt of a valid preservation or emergency request, we can place an account under a legal hold so that its records are retained beyond our normal retention periods while the matter is resolved.

Emergency disclosure: where we believe in good faith that there is an imminent risk of death or serious physical harm, we may disclose information to the appropriate authorities without prior legal process, to the extent permitted by law.

International requests: requests from authorities outside our governing jurisdiction should be made through mutual legal assistance treaties (MLATs), letters rogatory, or other recognised channels. We review every request for validity, scope, and proportionality, narrow or reject overbroad or unlawful requests, and, unless legally prohibited (for example, by a court-ordered gag or where notice would harm an investigation), we endeavour to notify affected customers so they may seek to challenge the request.

Law-enforcement requests and Abuse reports should be directed to: abuse@zilonet.com.

7. International data transfers

Our providers may process information in countries other than your own. Where we transfer personal information across borders, we rely on appropriate safeguards (such as standard contractual clauses or an adequacy decision) as required by applicable law.

8. Data retention

We keep personal information only for as long as necessary for the purposes described in this policy or as required by law. In particular, connection and activity logs are retained for up to six (6) months and then deleted, except where a longer period is required to comply with a legal obligation or to honour a preservation/legal-hold request. Account, billing, and registrant records are kept for the life of your account and for any additional period required by tax, accounting, and domain-registry obligations. The IP address recorded at sign-up may be retained for the life of the account for security and fraud-prevention purposes.

9. Your rights

Depending on where you live, you may have the right to access, correct, or delete your personal information; to restrict or object to certain processing; to request portability of your data; and to withdraw consent where processing is based on consent. You may also have the right to lodge a complaint with your local data-protection authority. To exercise any of these rights, contact us using the details below. Some information may be retained where we have an overriding legal obligation or legitimate ground to keep it.

10. Security

We use technical and organisational measures — including encryption in transit, hashed passwords, optional two-factor authentication and passkeys, and access controls — to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Children

The Services are not directed to children, and you must be at least 18 years old (or the age of majority in your jurisdiction) to use them. We do not knowingly collect personal information from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with a revised "Last updated" date, and your continued use of the Services after the changes take effect constitutes acceptance of the updated policy.

13. Contact us

For privacy questions or to exercise your rights, contact:

• Privacy: support@zilonet.com
• Legal / law enforcement / Abuse: abuse@zilonet.com