Privacy Policy

This Privacy Policy explains what personal data PowerDedi collects when you visit our website, create an account, order and pay for servers, open a support ticket, request a quote or send us a report; why we collect it; how long we keep it; and what rights you have. We collect only what we need to run the service: an email address is enough to open an account.

1. Who we are

PowerDedi provides bare-metal dedicated servers paid in cryptocurrency. The controller of your personal data, meaning the party that decides why and how it is used, is the operator of PowerDedi identified on your invoices. For any question about this policy or your personal data, open a support ticket from your client area or, without an account or an active server, use our abuse and legal notice form.

This policy covers our website, your account, payments, support and abuse handling. It does not cover the data you store or process on your own servers. For that data, you decide what is collected and how it is used, and you are responsible for complying with the privacy laws that apply to it.

2. What we collect and why

The table below lists the personal data we process, why we use it, the legal basis we rely on where the law requires one (for example, the GDPR in the European Union or the UK GDPR), and how long we keep it.

Data	Purpose	Legal basis	Retention
Account data: your email address; your password, stored only as a one-way hash (Argon2id); if you turn on two-factor authentication, its secret, stored encrypted; optionally a name, billing details and SSH public keys	Create and secure your account; issue invoices; show service, security and abuse notices in your client area	Contract	Life of the account + up to 12 months
Security records: for each sign-in, session and security event, a shortened IP address (first three IPv4 blocks, or first 48 bits of IPv6), the country reported by our network provider and the browser family	Show you where your account is signed in; detect and stop account takeover; answer security questions	Legitimate interests	Sessions: until they expire or you sign them out; security events: 13 months
Billing records: invoices, amounts, currencies and networks, deposit addresses, transaction hashes, balance history	Process payments, credit your balance, handle refunds, keep accounting records	Contract; legal obligation	As long as required by law
Service data: servers ordered, configuration, location, IP addresses, reverse DNS records	Provide, operate and support your servers; protect the network	Contract; legitimate interests	Life of the account + up to 12 months
Support tickets, payment reports and custom quote requests (with the email address you give for the quote), including any details you choose to add	Answer your questions and requests; keep a record of them	Contract; legitimate interests	Up to 24 months
Abuse reports: the report and its evidence, the reporter’s contact details, our correspondence about the case	Investigate and stop abuse; act on repeated violations; meet legal obligations	Legitimate interests; legal obligation	Up to 24 months
Web server logs: IP address, date and time, page requested, browser user agent	Deliver the website, keep it secure, diagnose errors	Legitimate interests	Up to 30 days

Contract means we need the data to provide the service you ordered, or to answer a request you made before ordering. Legal obligation means a law requires us to keep or disclose it. Legitimate interests means we need it to operate and protect the service, our network and other people, and we have weighed that need against your rights. We use personal data only for the purposes listed here.

3. What we do not collect

No card or bank data. We accept cryptocurrency only, so there is nothing of the kind to collect.
No identity documents. We do not run identity checks (KYC).
No phone number required. If you choose to include one in a message, we use it only to answer that message.
No marketing trackers. No analytics or advertising cookies, no tracking pixels and no advertising profiles.
No access to the contents of your servers, as explained in section 6.

4. Cookies

We use only strictly necessary cookies, for session and security purposes. They keep you signed in to your account, protect forms against misuse and, through Cloudflare, help separate real visitors from malicious automated traffic. They are not used for analytics or advertising and do not follow you across other websites.

__Host-pd_s: keeps you signed in. It holds a random token; we store only a fingerprint of it. It lasts 30 days if you choose “Keep me signed in”, otherwise until you close the browser.
pd_ref: set only when you open a link from our affiliate program. It holds the affiliate’s code for 60 days so the referral can be attributed if you create an account, and is deleted when you do.
Cloudflare security cookies, such as those of the Turnstile check shown when you sign in or create an account: they help tell people from bots.

The public website sets no tracking cookies. You can block or delete cookies in your browser settings, but you will not be able to stay signed in to your account without its session cookie.

If we introduce a feature that needs another kind of cookie, we will update this policy before it is used and ask for your consent where the law requires it.

5. Blockchain data is public

When you pay in cryptocurrency, your transaction is recorded on a public blockchain. For most currencies we accept, anyone can see the sending and receiving addresses, the amount, the time and the transaction hash. These records are permanent: neither we nor anyone else can change or delete them.

Each payment has its own deposit address, and we do not publish which addresses belong to which customer. Blockchain analysis can still sometimes link addresses to each other or to a service such as ours, and the exchange or wallet you pay from may keep its own records about you. Those records are outside our control.

Monero (XMR) works differently. By design, it conceals the sender, the recipient and the amount of each transaction: the payment is recorded on the Monero blockchain, but these details are not publicly visible. We still keep our own record of the payment and its transaction hash, as for any other payment. Our article on choosing between Bitcoin, Ethereum, Monero, USDT and Solana compares the options.

6. The contents of your servers

We never access the contents of your servers, such as files, databases, applications or the operating system, except when you ask us to, for support, or when we are legally compelled to by a valid order from a competent authority. We do not monitor, scan or copy the data you store on your servers.

Like any network operator, our routers and DDoS mitigation systems automatically process technical traffic information, such as IP addresses, ports and packet rates, to route traffic and filter attacks. This does not give us access to the data stored on your servers. When a server ends, its disks are securely wiped, as described in our Terms of Service.

We never sell or rent personal data, and we do not share it for advertising. We share it only as follows:

Cloudflare delivers and protects our website. It processes visitors’ connection data, including IP addresses, to serve pages and block attacks.
Our cryptocurrency payment processor generates deposit addresses and detects payments. It receives the data needed to process each payment, such as the amount, currency, network, deposit address and transaction details.
Data-center partners host our hardware in carrier-neutral facilities. They do not receive customer personal data, except where needed to handle an abuse case.
Customers concerned by an abuse report. When we forward an abuse report or infringement notice to the customer responsible for the server involved, it may include the information the reporter provided.
Authorities, only on a valid order from a competent authority. We check each request, disclose only what the order requires, and notify the affected customer when the law allows.

If the operation of PowerDedi is transferred to another entity, for example through a merger or the sale of the business, personal data may be transferred to the new operator, which must continue to protect it as described in this policy.

8. International processing

Our infrastructure, service providers and data-center partners operate in several countries, so your personal data may be processed outside your country of residence, including in countries whose data protection laws differ from yours. Where the law requires it, we protect these transfers with appropriate safeguards, such as standard contractual clauses. Data you store on a server stays in the location you chose when ordering it.

9. How long we keep data

Account and service data: for the life of your account, plus up to 12 months.
Billing records: as long as required by law, for example by accounting and tax rules.
Support and contact messages: up to 24 months.
Abuse reports: up to 24 months.
Web server logs with IP addresses: up to 30 days.

We may keep specific data longer when the law requires it or when we need it to establish or defend a legal claim. At the end of the retention period, we delete the data. Data stored on your servers is not kept: when a server ends, its disks are securely wiped, at the end of the paid period after a cancellation, or 7 days after suspension for non-payment. Transactions recorded on public blockchains cannot be deleted by anyone.

10. Security

Encryption in transit. Our website and client panel are served over HTTPS (TLS) only.
Hashed passwords. Passwords are stored only as hashes produced by a dedicated password-hashing algorithm, never in readable form.
Least-privilege access. Staff and systems can reach personal data only when their task requires it.
Management interfaces. IPMI interfaces are never exposed to the public internet.
Less data to protect. We hold no card data, bank data or identity documents, and each invoice uses its own deposit address.
Protected website. Cloudflare shields our website from attacks.

No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will inform you and the competent authorities as the law requires.

11. Your rights

Depending on where you live, you have some or all of the following rights:

Access: obtain a copy of the personal data we hold about you.
Rectification: have inaccurate or incomplete data corrected.
Erasure: have your data deleted.
Restriction: have the processing of your data limited in certain cases, for example while we check a disputed request.
Portability: receive your data in a structured, machine-readable format.
Objection: object to processing based on our legitimate interests.
Complaint: lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work.

Most rights are self-service in your client area: Profile & billing → Your data downloads a complete copy of your account data (access and portability), the same page corrects your details (rectification), and Close account deletes it (erasure). For any other request, open a support ticket from your client area or, if you have no account or no active server, use our abuse and legal notice form and choose “Law enforcement or other legal request”. We answer within 30 days. Requests made from your signed-in account are authenticated by it; we never ask for identity documents.

Some limits apply. We must keep billing records for as long as the law requires. Erasing your account data also ends any servers still active on it. Nobody can erase transactions recorded on public blockchains.

Some actions are automated under our Terms of Service, such as suspending a server when an invoice remains unpaid after the grace period, or filtering attack traffic. You can ask for any such action to be reviewed by a person.

12. Children

Our services are not directed to anyone under 18, and you must be at least 18 to open an account. We do not knowingly collect personal data from children. If you believe a child has given us personal data, tell us through our abuse and legal notice form and we will delete it.

13. Changes to this policy

We may update this policy when our services, providers or legal obligations change. The date at the top of this page shows the current version. If a change materially affects how we use your personal data, we will inform account holders with a notice in the client area and on our website before it takes effect.