Privacy policy

This policy explains what VorticPanel ("we") collects through this website and the license checks your panel makes, why, and your choices. We collect what we need to sell, check and support licenses, and nothing for advertising. There are no tracking or analytics cookies.

What we collect

• Your account: your name, email address, company if you give one, and a hash of your password (never the password itself).
• Your licenses: each license's key, size, dates and payment status.
• Your panel's check-ins: about once an hour your panel sends its license key, an install ID, its address (domain), its version, how many nodes it has, and the IP address it connects from, which the license is locked to. It also sends one-way hashes that identify the controller and node machines, not the identifiers themselves. For a trial, and when a key is first entered, each identifier (machine ID, board and network cards) is also hashed on its own. The address a trial panel connects from is kept for 90 days, so one network can't start trial after trial.
• Payments: card payments are handled by Stripe. We never see or store card numbers. We keep Stripe's reference for your customer, subscription and invoices, and, for a trial started with a card on file, a fingerprint of the card that Stripe gives us, so the same card can't start another trial.
• Support: your tickets, replies and any files you attach, including tickets sent by email.
• Security records: sign-ins, with the IP address and browser, and a log of changes to accounts and licenses, so we can spot misuse and help when something goes wrong.
• Visits to this website: which public pages are opened, the site that linked to them, and whether the browser is on a phone, tablet or computer, so we know what people read. Visitors are told apart by a code made from the IP address and browser that changes every day; the address itself isn't kept, and what the code is made with is only ever held in memory, so it can't be traced back to the address. Nothing is counted when your browser asks sites not to track it (Do Not Track or Global Privacy Control). Kept for 400 days.

Check-ins carry nothing about your customers or their servers. When your staff send a problem report from the panel, it includes the diagnostics they see before sending: versions, nodes, and the logs of recent failed jobs, which can name servers. Passwords, keys, tokens and email addresses are left out.

Why we use it

• To run your account, sell and renew licenses, and check them when your panel asks.
• To stop licenses being shared and free trials being repeated.
• To answer your support requests, and to email you about your account and licenses: confirmations, receipts, renewals and problems. We don't send marketing email.
• To keep the site secure, and to meet legal and tax obligations.

Who else sees it

• Stripe processes payments, under its own privacy policy.
• Cloudflare Turnstile, when bot protection is on, checks the sign-up, contact and password reset forms, and sign-in after repeated wrong passwords, under Cloudflare's privacy policy.
• Our hosting and email providers store and send data for us, and only on our instructions.
• We share data with authorities only where the law requires it. We don't sell it.

How long we keep it

Account and license records are kept while your account is open, and afterwards for as long as tax and accounting rules require. Support tickets and security records are kept for up to two years. Trial fingerprints are kept to prevent repeat trials. Backups are overwritten within 14 days.

Cookies

We use a cookie to keep you signed in, short-lived ones while you finish signing in with two-factor or confirm your email, and one to show a message after a form. None of them tracks you across other sites.

Your choices

You can see and correct your details under Settings in your account. You can ask us for a copy of your data, or to delete your account and the data we don't have to keep, by opening a ticket or emailing support@vorticpanel.com. Depending on where you live, you may have other rights, such as to object to some uses or to complain to a data protection authority.

Changes

If we change this policy we'll post the new version here, and email account holders about changes that matter.