Privacy policy

SrvDaddy Holdings LLC is the data controller for personal data described in this policy. Our registered address is Bhowra Uper Bazar, Dhanbad, JH 828302, IN. Our privacy contact is hello@srvdaddy.com and it is read by a member of the engineering team, not an outsourced desk.

Full card numbers never touch our systems. Payments are processed by a PCI DSS Level 1 provider that returns a token to us; we can charge the token and see the last four digits, and that is all.

• Contract: account, billing and support data are needed to provide the service you bought.
• Legitimate interests: technical logs for security and abuse prevention, and aggregate product analytics. We have balanced these against your interests and documented the assessment.
• Legal obligation: invoice retention, tax records, and responding to a valid legal order.
• Consent: marketing email only. It is opt-in, unticked by default, and one click to leave.

This marketing site sets no cookies until you sign in. There is no consent banner because there is nothing to consent to — we do not run Google Analytics, advertising pixels, session recorders, or third-party tag managers.

• Analytics are self-hosted, aggregate, and identify nobody. We store a daily count of page views per URL, referrer host, and country. No cookie, no fingerprint, no cross-site identifier.
• Signing in sets one strictly necessary session cookie, plus one preference cookie if you change a panel setting that needs remembering.
• We honour Global Privacy Control and Do Not Track headers, though as above there is not much for them to switch off.

We have never sold personal data, we do not share it for cross-context behavioural advertising, and we do not disclose it to data brokers. The only third parties who process personal data on our behalf are these:

Each processor is bound by a written data processing agreement, is assessed before we onboard them, and is reassessed annually. The current list with names is available to any customer who asks.

You choose the region your data is hosted in at signup and can migrate it later. We do not silently move hosted content between continents.

Where account or support data moves out of the EEA or UK, we rely on the European Commission's Standard Contractual Clauses together with the UK Addendum, plus a transfer impact assessment for each recipient. Copies are available on request.

Wherever you live, you can exercise all of the following. We do not gate any of them behind proof of residency, and we never charge a fee.

• Access — get a copy of your personal data, machine-readable, within 30 days.
• Rectification — correct anything wrong, mostly self-service in the panel.
• Erasure — delete your account and its data. Statutory invoice records are the only exception, and we will tell you exactly what those are.
• Portability — export hosted content and account data at any time without asking.
• Objection and restriction — object to processing based on legitimate interests, or ask us to pause it while a dispute is resolved.
• Withdraw consent — unsubscribe from marketing at any time, with no effect on your service.
• Complain — to us first, and to your supervisory authority if we have not fixed it. We will tell you which authority applies rather than making you look it up.

• Encryption in transit (TLS 1.3, HSTS preloaded) and at rest (AES-256 on all storage and backups).
• Least-privilege access with hardware-key two-factor for every employee, reviewed quarterly.
• Every production access event is logged to an append-only store that engineers cannot edit.
• Annual third-party penetration test, plus a paid bug bounty. We do not threaten researchers, and we credit them in the advisory unless asked not to.
• SOC 2 Type II and ISO 27001 audited; reports available under NDA.

If a breach affects your personal data we will tell you directly within 72 hours of confirming it, describe what we know and what we do not yet know, and publish a post-mortem. We will not wait until the investigation is tidy before telling you.

Our services are for adults and businesses. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, write to us and we will delete it.

Material changes are emailed 30 days ahead with a summary of what changed and why. Every previous version stays available at a permanent URL, so you can check what the policy said on the day you signed up.