Privacy Policy

1. Scope

This Privacy Policy explains how Codexvert ("we", "us"), operated as a sole proprietorship in India, collects, uses, stores, and protects personal data when you use codexvert.com, our client area at codexvert.com/ca, and all services including Nested Virtualization Enabled Shared VPS, Minecraft/Game Hosting, Mail Hosting, cPanel, and Web Hosting. We comply with the Digital Personal Data Protection Act, 2023, the DPDP Rules, 2025, the Information Technology Act, 2000, and CERT-In Directions 2022.

2. Eligibility and Minor Guardian Exception

Account ownership is generally restricted to individuals who have attained 18 years of age. For Minecraft / Game Hosting and Web Hosting only, individuals aged 13 to 17 may open an account provided verified parental or legal guardian consent is obtained. Such consent requires guardian email verification, submission of government-issued identity proof of the guardian, and a declaration whereby the guardian assumes full legal and financial liability for all activity under the account. The guardian receives all billing, abuse, and suspension notices. Accounts owned by minors are flagged as "Minor-Owned – Guardian: [email]" and are restricted from ordering VPS, Mail Hosting, cPanel reseller services, and any Nested Virtualization addon. Upon attaining 18 years, ownership must be re-verified through KYC. Players or end-users who merely join a customer's game server and do not hold client-area access may be under 18; the billing owner remains fully responsible for their conduct.

3. Data We Collect

4. How We Use Data

• To create, provision, manage, and support services, including applying the default 20% resource throttle for nested virtualization (80% vCPU/RAM cap) and restoring full allocation upon Performance Unlock purchase.
• To process payments, manage transferable non-forfeitable 12-month credits, and enforce the 24-hour post-closure transfer window with block during active Critical abuse investigations.
• To enforce quantified fair use (greater than 85% for greater than 6 hours per day across 3+ days with steal greater than 10% or iowait greater than 20%) and to operate DDoS mitigation via Cloudflare Magic Transit where mitigation is included in uptime.
• To detect, investigate, and prevent abuse, including cryptomining detection via host-level MSR and scheduler heuristics even inside nested guests, and CSAM detection via metadata and hash matching as legitimate interest.
• To comply with legal obligations, including preservation hierarchy: court or law enforcement preservation under IT Act §67C, CrPC §91, BNSS §94-95, POCSO (90-180 days hold pausing deletion), Critical abuse evidence hold (90 days minimum), DPDP erasure requests, and standard billing termination (7 days).
• To send service notifications (invoices, renewal reminders, suspension within 7-day termination window, credit expiry warnings at 30 days, 7 days, 24 hours). Marketing only with consent, opt-out anytime.

5. Legal Bases

• Performance of contract: processing necessary to provide ordered services, including provisioning and authenticated implementation confirmation via 2-hour email link and 2FA.
• Legal obligation: tax records, preservation orders, CrPC/BNSS/POCSO compliance, CERT-In 6-hour incident reporting.
• Legitimate interests: security, abuse prevention, fair-use enforcement, credit anti-laundering checks, scanning of traffic metadata and cryptographic abuse hashes, balanced against rights.
• Consent: marketing, guardian consent for 13-17, and optional Performance Unlock purchase.

6. Sharing and Processors – Public and Confidential With Audit Dates

We do not sell personal data. Sharing occurs only as described here and in the Subprocessor List & Vendor Policy.

Confidential Infrastructure Partners (colocation, transit, control panels such as VirtFusion, Pterodactyl, cPanel and mail platforms) remain confidential by name per contractual confidentiality, but their last security review dates are published for accountability: Colocation Facility audit 2026-07-15, Transit Partner audit 2026-07-12, Control Panel Partners audit 2026-07-20. All are bound by data protection annexes and annual review.

7. Data Retention and Preservation Hierarchy

• Account and Service Data: Retained while account active and for 7 days after termination, then permanently deleted unless overridden by preservation hierarchy.
• Preservation Hierarchy (Binding Order): (1) Court order or law enforcement preservation under IT Act §67C, CrPC §91, BNSS §94-95, POCSO Act – 90 to 180 days hold pausing deletion timer; (2) Critical abuse evidence hold (CSAM, phishing, malware C2, mining) – minimum 90 days preserved for law enforcement handover; (3) DPDP Act erasure or data principal request – honored unless overridden by Priority 1 or 2 with written reason; (4) Standard billing or cancellation termination – 7 days. Chargeback with Critical flag within last 30 days auto-escalates to Priority 2 to prevent deletion of forensic evidence.
• Billing and Credit Records: Retained per Indian tax law; credit transfer logs retained per 12-month expiry and 24-hour post-closure window rules.
• Security and Abuse Logs: Retained as needed for active investigations, then purged unless Priority 1 or 2 applies.
• Suspension Window: Upon insufficient credits, immediate suspension occurs, termination within 7 days, client area billing remains accessible, unsuspension possible by paying invoice before termination.

8. Credits, Billing, and Suspension Transparency

Account credits are transferable between accounts owned by the same legal entity or natural person, non-forfeitable on billing termination or voluntary cancellation, and expire 12 months from grant. Transfer allowed up to 24 hours after closure request via authenticated Paymenter ticket. Transfers are blocked if source account had active Critical abuse investigation within last 7 days until closed, preventing credit laundering. Expiry warnings sent at 30 days, 7 days, 24 hours. Where total data loss is caused solely by Codexvert infrastructure failure, you may elect cash refund equivalent to 6 months or credits equivalent to 12 months.

9. Data Breach Notification

If a personal data breach likely results in risk to your rights, we notify affected customers within 72 hours of becoming aware. Designated incidents are reported to CERT-In / MeitY within 6 hours per CERT-In Directions 2022. We also notify the Data Protection Board of India per DPDP Act. Emergency lawful disclosures without prior customer notice are logged and customer notification follows within 72 hours unless prohibited by explicit gag order bearing court docket number, consistent with Law Enforcement Guidelines.

10. Your Rights

• Access your personal data.
• Correct inaccurate or incomplete data.
• Erase data subject to preservation hierarchy and legal retention obligations.
• Withdraw consent where processing based on consent, including guardian consent for minor-owned accounts, with note that withdrawal may require account closure for restricted products.
• Grievance redressal via support@codexvert.com, with escalation to Data Protection Board of India where unsatisfied.

11. Cross-Border Transfers and DDoS Protection

Primary service data processed within India. Cloudflare edge may route traffic through global PoPs for DDoS mitigation; such mitigated DDoS is included in uptime per SLA (excluded only if greater than 500 Gbps or origin IP leak). Razorpay processes payments per its own policies. Transfers outside India made with appropriate safeguards under DPDP Act.

12. Contact and Backups Disclosure

VirtFusion and Pterodactyl snapshots operate on the same local physical node and do not constitute off-site backups. Paymenter panel displays in-panel warning: "Snapshot is not an off-site backup – it may be lost on node failure. Maintain independent off-site backups." Codexvert maintains weekly off-site backups of its control-plane only, not customer content.