This policy applies to the xingwangvps.com website and services operated by Xingwang VPS LLC (“we”, “us”; 1919 Morrie Ave, Cheyenne, WY 82001, USA). It explains what we collect, how we use and protect it, who we share it with, and your rights.
1. What we collect
- Account: email, the name you give us, your password (stored only as a salted hash), company details you provide, and identity or business verification documents only if we ask for them.
- Billing: orders, invoices, payment amounts and payment references. Payments are handled by the payment provider (such as PayPal) or your bank; we do not receive or store full card numbers.
- Sign-in & security: the IP address and browser user agent of each sign-in session (kept with the session, which expires after 30 days); failed sign-in counters per email (to slow down password guessing); records of administrative actions on your account.
- Service & usage data: instance status, your instance’s IP, traffic byte counts, connection counts, timestamps and resource usage — for billing, capacity planning and operations.
- Connection records (abuse prevention): for network services we record who connected, from which network and when, and how many bytes were transferred — not what was accessed. Source IP addresses are deleted after 14 days (only the network/region label is kept), and the records are deleted after 90 days.
- Content: we do not inspect or decrypt your traffic, and we do not access the data inside your instance unless you ask us for help or the law requires it.
- Website usage: pages visited, referrer and device/browser information collected by our analytics tools (see section 8). When you sign up we store, with your account, the site you first came from, the first page you landed on, and the invite code you used, if any — to understand where sign-ups come from.
- Communications: what you send us by email, ticket or Telegram.
2. How we use it
- Provide, run, bill and manage your services; send account and service notices.
- Keep the service secure, troubleshoot, prevent abuse and fraud; meet legal obligations.
- Understand how the website is used so we can improve it; attribute sign-ups to referrals.
3. Who we share it with
We share only what each provider needs to do its job:
- Cloudflare — hosting of the website and control panel, database, inbound email routing.
- Resend — sending account and service emails.
- Google Analytics (Google) and Microsoft Clarity (Microsoft) — website analytics; Clarity records sessions (see the masking note in section 8).
- PayPal — when you choose to pay with PayPal.
- ipinfo.io — looking up the network/region label for IP addresses in connection records.
- Telegram — if you choose to contact us there, Telegram processes those messages.
- Legal requirements — disclosure to authorities to the extent lawfully required.
We do not sell your personal information, and we do not use it for cross-context behavioral advertising.
4. Where data is processed
Our servers are in the United States. Our service providers may process data in the United States and other countries where they operate.
5. Retention
- Account data: while your account is active; deleted or anonymized within 30 days after you ask us to delete it, except records we must keep by law.
- Billing and payment records: at least 7 years, for tax and accounting.
- Sign-in sessions (including IP and browser information): 30 days.
- Connection records: source IPs 14 days, records 90 days.
- Service and usage data: while you use the Service and as long as needed for billing disputes.
- Communications: as long as needed to resolve the matter and keep records.
- Analytics data: per the retention settings of Google Analytics and Microsoft Clarity.
6. Security
We encrypt sensitive data at rest (e.g., instance connection credentials) and apply access controls, auditing, and rate limiting. No system is perfectly secure, but we continuously harden.
7. Your rights
- You may request access to, correction of or deletion of your personal information, or object to certain processing. Email support@xingwangvps.com; we reply within 30 days and may first verify your identity.
- California residents: we do not sell or share personal information for cross-context behavioral advertising; you have the right to know and to delete the information we hold about you, and we will not discriminate against you for exercising these rights.
- You can block or clear analytics cookies in your browser, or use Google’s Analytics opt-out browser add-on.
8. Cookies & analytics
- Sign-in session — keeps you signed in; necessary.
- Signed-in hint — records only whether you are signed in, to show the right header link; 30 days; no personal data.
- Language preference — remembers English or Chinese.
- Sign-up source — the site you first came from and your first landing page; 30 days; saved to your account at sign-up.
- Invite code — saved when you arrive through an invite link; 7 days.
- Google Analytics and Microsoft Clarity — analytics cookies. Clarity records sessions (replays and heatmaps) to improve usability; one-time passwords, instance connection details and SSH commands are masked before upload.
We do not use third-party ad tracking.
9. Children
The Service is intended for people aged 18 or older and is not directed to children; we do not knowingly collect children’s personal information.
10. Changes & contact
This policy may be updated and posted here; we will notify you of material changes by email or in the dashboard. For privacy requests, email support@xingwangvps.com or write to Xingwang VPS LLC, 1919 Morrie Ave, Cheyenne, WY 82001, USA.