1. Introduction
Galaxy Cloud Solutions LLC ("Company", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our services at galaxycloudsolutions.com. By using our services, you agree to the collection and use of information in accordance with this policy.
2. Information We Collect
2.1 Information You Provide
- Name and contact information (email address, phone number)
- Billing information (processed securely through PayPal and Stripe)
- Account credentials (username, hashed password)
- Support communications and tickets
- Any other information you voluntarily provide to us
2.2 Information Collected Automatically
- IP addresses and connection logs
- Browser type and operating system
- Pages visited, actions taken, and time spent on our website
- Server resource usage associated with your account (CPU, RAM, disk, bandwidth)
- Device identifiers and configuration information
- Referring URLs and traffic sources
- Login history including timestamps and IP addresses for admin and client accounts
- Monthly bandwidth consumption per VM via network interface monitoring
- Outbound network connection rates and destination IP counts
- Disk I/O activity rates per VM
2.3 Automated VM Monitoring Data
As described in our Acceptable Use Policy, we operate automated monitoring systems on all customer VMs. In connection with this monitoring, we may collect and temporarily retain:
- Lists of running process names inside your VM (used solely for AUP enforcement)
- Outbound connection counts and destination IP address ranges
- Network traffic volume and rate data per VM interface
- Disk read/write activity rates
- IP reputation scores from third-party databases (AbuseIPDB)
- SSL certificate status for your assigned subdomain
We record connection metadata — the source, destination, and timing of network connections to and from your VM — for abuse investigation and network security. This data is retained for up to 30 days.
Process names are used exclusively for AUP enforcement and are not shared with third parties except as required by law. This data is retained for a maximum of 90 days.
2.4 Additional Service and Referral Data
When you use additional features of our service, we collect and store the following data associated with your account:
- REST API tokens: A unique API authentication token is generated and stored for your account. This token is used to authenticate programmatic access to your VPS resources. You may regenerate this token at any time.
- SSH IP allowlist: If you configure IP restrictions for SSH access to your VM, we store the IP addresses and CIDR ranges you specify along with optional labels you provide.
- Firewall rules: Custom inbound firewall rules you configure via the client portal are stored and applied to your VM. This includes port numbers, protocols, actions (allow/deny), and source IP addresses.
- Block storage volumes: Metadata about block storage volumes attached to your VM is stored, including volume size, device assignment, label, and pricing information. The contents of your block storage volumes are not accessed or stored by us.
- Anomaly detection baselines: We maintain statistical baselines of your VM's normal resource usage (CPU, RAM, network, disk I/O, system load) calculated from historical Prometheus metrics. These baselines are used exclusively to detect unusual activity that may indicate abuse, compromise, or runaway processes.
- Log aggregation: We collect and retain system logs from our management infrastructure via Loki log aggregation. This includes Nginx access logs, application logs, and monitoring script logs. Customer VM logs are not collected. Aggregated logs are retained for 30 days on a rolling basis.
- Auto-snapshot schedules: If you configure automated snapshot schedules, we store your preferences including frequency (hourly/daily/weekly) and retention count.
If you participate in our referral program, we collect and store:
- Your unique referral code
- The identity of customers who sign up using your referral code
- Referral conversion status and credit history
2.5 Information from Third Parties
- Payment verification information from PayPal and Stripe
- Analytics data from Google Analytics
- Advertising data from Google Ads
2.6 Portal Usage Data
When you use our client portal, we collect and store records of actions you perform including VM control actions (reboot, shutdown, start), snapshot creation, password resets, plan upgrades, OS reinstalls, and dashboard views. This data is associated with your account and used to improve our services, identify feature usage patterns, and provide accurate account history. Portal usage data is retained for the duration of your account plus 90 days after closure.
2.7 Uptime & Performance Data
We track daily uptime status for each customer VM and calculate monthly uptime percentages. This data is used to monitor service quality, generate monthly resource reports sent to customers, and identify VMs experiencing availability issues. Uptime data is retained for 90 days on a rolling basis.
2.8 Identity Verification for Bulk Orders
Orders of five (5) or more VPS instances require identity verification, as described in our Acceptable Use Policy. For these orders we collect a copy of a government-issued photo ID and a selfie of the customer holding that ID. These images are used solely to verify the identity of the person placing the order and to prevent fraud and abuse. They are stored securely with access restricted to the business owner, are never shared with third parties except as required by law, and are retained for as long as the associated service remains active. They are permanently deleted within 90 days of service termination, consistent with Section 7.
2.9 Automated Email Communications
We send automated emails as part of our service including onboarding sequences (day 1, 3, 7, 14), payment reminders (sent as an invoice becomes overdue), bandwidth and resource alerts, monthly resource reports, upgrade recommendations, suspension notices, and re-engagement emails. A full description of automated communications is available in Section 8b of our Terms of Service. These communications are sent to the email address associated with your account.
3. How We Use Your Information
- Provision and manage your hosting services
- Process payments and send invoices (including automated PDF invoice generation)
- Communicate with you about your account and services
- Send automated service emails including welcome emails, follow-up emails, bandwidth warnings, suspension notices, and re-engagement emails
- Provide customer support
- Detect and prevent abuse, fraud, and policy violations via automated monitoring
- Monitor and enforce compliance with our Acceptable Use Policy including automated suspension
- Track and enforce monthly bandwidth limits per your plan
- Generate monthly business metrics reports (aggregate, anonymized internally)
- Administer our referral program including tracking conversions and issuing credits
- Send maintenance and downtime notifications
- Improve our website and services
- Send service-related announcements and updates
- Comply with legal obligations
- Respond to law enforcement requests
4. Cookies and Tracking Technologies
Our website uses cookies and similar tracking technologies. We use:
- Essential cookies — required for our website and client portal to function, including session management and authentication
- Analytics cookies — Google Analytics to understand how visitors use our website (you can opt out at tools.google.com/dlpage/gaoptout)
- Advertising cookies — Google Ads to measure the effectiveness of our advertising campaigns
- Referral and source cookie — if you arrive through a referral link or a link that tells us where you came from, we remember that for up to 90 days and save it with your account when you sign up, so referrals are credited and we can see which places bring us customers. We don't share it.
Most browsers allow you to control cookies through their settings. Disabling essential cookies may affect the functionality of our services.
5. Data Sharing
We do not sell your personal information. We may share your information with:
- Payment processors — PayPal and Stripe to process transactions
- Cloudflare — DNS, content delivery, and DDoS protection; traffic to our website passes through Cloudflare's network
- Tawk.to — live chat on our website; messages you send through the chat widget and basic visitor information are processed by Tawk.to
- Analytics providers — Google Analytics and Google Ads for website analytics and advertising measurement
- Law enforcement — when required by valid legal process including subpoenas, court orders, or search warrants
- Service providers — third parties who assist us in operating our business, under confidentiality agreements
- Business transfers — in connection with a merger, acquisition, or sale of assets
6. International Data Transfers
Galaxy Cloud Solutions LLC is based in the United States. If you access our services from outside the United States, your information may be transferred to, stored, and processed in the United States. By using our services, you consent to the transfer of your information to the United States, which may have different data protection laws than your country of residence.
7. Data Retention
We retain your account information while your account is active. The contents of your VM are permanently deleted shortly after termination as described in our Terms of Service (within 7 days). Account and billing records are retained for up to 90 days after termination for legal and billing purposes, then deleted. We may retain certain information longer if required by law or for legitimate business purposes.
8. Data Security
We implement reasonable technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encrypted communications (SSL/TLS), hashed passwords, and access controls. However, no method of internet transmission or electronic storage is 100% secure, and we cannot guarantee absolute security.
8a. Automated Decision-Making
We use automated systems to make enforcement decisions including VM suspension. These decisions are made based on objective thresholds described in our Acceptable Use Policy and Terms of Service (e.g., bandwidth usage exceeding 100% of plan allocation, prohibited processes detected, network traffic exceeding defined limits). You will receive an email notification for every automated suspension explaining the specific trigger and how to resolve it.
If you believe an automated suspension was made in error, please contact us at [email protected] for manual review. We will review and respond within 24 hours.
9. Your Rights
You have the following rights regarding your personal information:
- Access — request a copy of the personal information we hold about you
- Correction — request correction of inaccurate or incomplete information
- Deletion — request deletion of your personal information, subject to legal retention requirements
- Opt-out — opt out of non-essential communications at any time
- Data portability — request your data in a portable format
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
10. California Residents (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete your personal information, and the right to opt out of the sale of your personal information. We do not sell personal information. To exercise your CCPA rights, contact us at [email protected].
11. Children's Privacy
Our services are not directed at individuals under 18 years of age. We do not knowingly collect personal information from minors. If we become aware that we have collected information from a minor, we will delete it promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a prominent notice on our website at least 14 days before the changes take effect. Continued use of our services after notification constitutes acceptance of the updated policy.
13. Contact Us
Privacy questions or requests: [email protected]
Galaxy Cloud Solutions LLC | Valley City, North Dakota | galaxycloudsolutions.com