Fin
Privacy Policy
Last updated: 14 August 2026
This policy explains what personal data Atomic Host collects, why we collect it, how long we keep it, and what rights you have over it. It covers atomichost.xyz and the account panel.
We do not sell your personal data, and we never have.
Who we are
Atomic Host ("AtomicHost", "we", "us") is a game server hosting service operated as a sole trader based in the United Kingdom. For the purposes of the UK GDPR and the Data Protection Act 2018, we are the data controller for the personal data described here.
- Contact for any privacy or data protection request: [email protected], marked "Data protection"
- General support: open a ticket from your account, or email [email protected]
- Postal address: available on request by emailing the address above
We are not required to appoint a Data Protection Officer, and have not appointed one. Privacy requests are handled by the owner directly.
What we collect, why, and on what legal basis
Account details
Username, email address, first and last name, password (stored hashed - we cannot read it), your chosen language and profile visibility, avatar, account status and balance, and the dates you verified your email, accepted our Terms and confirmed your age.
Why: to create and run your account. Legal basis: Article 6(1)(b), performance of our contract with you.
Billing and address details
Orders, payments, invoices, balance transactions, and - where you provide them or where a purchase requires them - company name, street address, city, region, postcode, country and phone number.
We also record the country your connection appears to come from, which our network provider (Cloudflare) supplies to us automatically when you register. We use it for tax, fraud prevention and to apply country registration restrictions.
Why: to take payment, provide the service you bought, and prevent fraud. Legal basis: Article 6(1)(b) performance of a contract, and Article 6(1)(f) legitimate interests for fraud prevention.
We never see or store your card details. All card payments are handled by Stripe.
Security and technical logs
IP addresses you sign in from, device and browser information (user agent, device name and type), sign-in times, and a log of sensitive account actions such as generating or revoking API keys. If you use our API, we log the requests you make, including the path and originating IP.
Why: to secure accounts, investigate compromises and abuse, and support the service. Legal basis: Article 6(1)(f), our legitimate interest in keeping the service and our users' accounts secure.
If you sign in with Google, Discord, Microsoft or GitHub
We store which provider you used, the email address it gave us, and the profile information that provider returns to us.
Why: so you can sign in without a separate password. Legal basis: Article 6(1)(b), performance of our contract with you.
Support and communications
Support tickets you open, and a record of the emails we have sent you.
Why: to answer you and to keep a record of what was said. Legal basis: Article 6(1)(b) performance of a contract, and Article 6(1)(f) legitimate interests in keeping support records.
Tax and accounting records
Where the law requires us to keep a record of a transaction, we do. Legal basis: Article 6(1)(c), compliance with a legal obligation.
Providing your data is a contractual requirement
You do not have to give us any of this. But the account details and, for a purchase, the billing details, are needed to enter into and perform our contract with you. If you do not provide them we cannot open an account or supply a service.
Who we share it with
We share personal data only with the providers we need to run the service. Each acts under a contract that requires them to protect it.
| Who | What they receive | Why |
|---|---|---|
| Stripe | Payment and billing details | Taking card payments. Stripe is the controller of its own payment data. |
| Cloudflare | Your IP address, request data, country | DNS, CDN, bot and DDoS protection, and the anti-spam challenge on our sign-in and registration forms |
| Our email provider | Your email address and message content | Sending account, billing and support email |
| Our hosting and datacentre providers | Data stored on our servers | Running the panel and your game servers |
| Google, Discord, Microsoft, GitHub | Only what you authorise, if you choose to sign in with them | Optional single sign-on |
We may also disclose personal data where we are legally required to, or to establish, exercise or defend legal claims.
We do not sell or share your personal data for advertising, and we do not pass it to data brokers.
Transfers outside the UK
Some of the providers above, including Stripe and Cloudflare, process data in the United States and other countries outside the UK.
Where data leaves the UK we rely on the safeguards permitted under Article 46 of the UK GDPR - the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or, for US providers certified under it, the UK Extension to the EU-US Data Privacy Framework. You can ask us for details of the safeguards used for any particular provider.
How long we keep it
| Data | Kept for |
|---|---|
| Account, billing and order records | While your account is open. Deleted when you delete your account. |
| Sign-in IP history | 90 days |
| Security and audit logs | IP address and browser details removed after 90 days; the remaining record of the action is deleted after 12 months |
| API request logs | 14 days |
| Support tickets and email history | While your account is open |
When you request account deletion, the request is held for 72 hours so you can cancel it by mistake, and your account is then permanently deleted. Deletion removes your account, addresses, IP and device history, sign-on links, orders, payments and balance history. Identifiers are stripped from the security audit log, which keeps only a record that an action happened.
Cookies
We use a small number of cookies that are strictly necessary to run the site - keeping you signed in (laravel_session), protecting forms against cross-site request forgery (XSRF-TOKEN), telling automated traffic apart from real visitors (__cf_bm, set by Cloudflare), remembering an affiliate referral, and remembering display preferences such as how you last filtered your orders.
These are exempt from consent under regulation 6(4) of the Privacy and Electronic Communications Regulations 2003, because the service cannot work without them.
We do not currently run any analytics or advertising cookies. If we ever turn analytics on, it will not load until you have accepted it in the cookie banner, and rejecting it will remove any analytics cookies already set.
Your rights
Under the UK GDPR you have the right to:
- Access the personal data we hold about you
- Rectify it if it is wrong or incomplete
- Erase it ("right to be forgotten")
- Restrict how we process it
- Object to processing we carry out under legitimate interests
- Data portability - receive your data in a structured, commonly used, machine-readable format
- Withdraw consent at any time, where we rely on consent, without affecting anything done before you withdrew it
Two of these you can exercise yourself, immediately, from Account Settings:
- Download my data gives you a JSON export of your account, addresses, orders, payments, balance transactions, notifications, email history, sign-on links, IP history and devices.
- Delete my account starts the deletion described above.
For anything else, email [email protected] marked "Data protection". We will respond within one month. There is no charge, unless a request is manifestly unfounded or excessive.
Complaining
If you are unhappy with how we have handled your personal data, please tell us first so we can put it right.
You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection:
- Website: https://ico.org.uk/make-a-complaint/
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Automated decision-making
We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you, and we do not profile you.
Children
Our services are not intended for children. You must be at least 16 to open an account, and if you are under 18 you need a parent or guardian's permission. If we learn that we hold personal data belonging to a child below this age, we will delete it. If you believe we hold data about a child, contact [email protected].
How we protect your data
Traffic to the site is encrypted in transit with TLS. Passwords are stored hashed, never in plain text. Two-factor authentication is available on every account and we strongly recommend turning it on. Access to production data is limited to the people who need it to run the service. Payment card data never reaches our systems.
No service can promise perfect security, but if a breach occurs that puts your rights at risk we will notify the ICO within 72 hours and tell you where we are required to.
Changes to this policy
If we make a material change to this policy we will give account holders at least 30 days notice by email and in the panel, in the same way as for our Terms. The date at the top always shows when it was last updated.