Privacy Policy

This Privacy Policy applies to the Anested Cloud website, the customer dashboard, our APIs, and every service we sell — Cloud VPS, Web Hosting, Managed Databases (MySQL, PostgreSQL, MongoDB), Nest Storage and file serving, AI Chatbots, Web Analytics and DNS management (together, the “Services”).

It covers your personal data as our customer. Data belonging to your own users (visitors to sites you host, records in your databases, files in your storage) is your content — we process it only on your behalf, as described in Section 8.

The entity responsible for your personal data is Anested Cloud (part of the Anested group), 5th Floor, Maurya Lok, Near Dak Bunglow Chowk, Patna 800001, Bihar, India. You can reach us at support@anested.com.

• To create and administer your account, authenticate logins (including Google sign-in and OTP verification), and secure access to the dashboard and APIs.
• To provision, operate, meter and bill the Services you purchase — creating servers, sites, databases, storage buckets, chatbots and analytics sites, and generating invoices.
• To process payments, autopay mandates, renewals and refunds through our payment gateway, and to detect and prevent payment fraud (using the payment IP/device data described above).
• To send essential service communications — OTPs, invoices and receipts, renewal and expiry reminders, suspension warnings, security alerts and incident notices.
• To respond to your support requests and abuse reports.
• To monitor infrastructure health, investigate abuse of our Acceptable Use Policy, and protect the platform, other customers and third parties.
• To comply with legal obligations, including tax and accounting record-keeping.
• To improve the platform using aggregated, de-identified usage statistics that do not identify you.

• Contract — most processing is necessary to deliver the Services you purchased under our Terms of Service.
• Legitimate interests — securing the platform, preventing fraud and abuse, and keeping operational logs.
• Legal obligation — retaining invoices and tax records, and responding to lawful orders.
• Consent — optional communications (if any) and any processing where the law requires consent; you may withdraw consent at any time without affecting prior processing.

We process personal data in accordance with applicable Indian law, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, to the extent applicable.

• Essential cookies / tokens — we use authentication tokens (and local storage) to keep you signed in to the dashboard. These are strictly necessary; the platform cannot work without them.
• We do not use third-party advertising cookies or cross-site tracking pixels on our website.
• Third parties embedded at specific moments (e.g. the Razorpay checkout window, Google sign-in) may set their own cookies under their own policies while you interact with them.
• You can clear cookies from your browser at any time; you will simply be signed out.

• All payments are processed by Razorpay Software Pvt. Ltd. Your card/UPI/netbanking credentials are entered directly into Razorpay's PCI-DSS-compliant checkout and never touch our servers.
• We receive and store only transaction metadata: order ID, payment ID, amount, currency, payment method label (e.g. “UPI”, “card ending 1234”), mandate/subscription IDs for autopay, and refund IDs.
• For recurring services, an autopay mandate is registered with the gateway; you can view its status on the invoice page and it is cancelled automatically when the related service is refunded or terminated.
• The IP address and device string captured at payment time are used solely for fraud prevention and dispute resolution, and are visible to you on your own invoice detail page.

Everything you run or store on the Services — files on your VPS, website code, database records, storage objects, chatbot knowledge bases — is your content. For that data we act as a processor/intermediary on your behalf:

• We access your content only when strictly necessary: to execute actions you request (e.g. deploying a site, restoring access), to investigate a specific, evidenced abuse complaint or security incident, or when legally compelled.
• Automated systems may inspect resource usage patterns (CPU, network volume, connection counts) — not the substance of your data — to detect attacks and abuse.
• Our staff are bound by confidentiality obligations and access is logged.
• You are the controller of personal data belonging to your own users. You are responsible for having a lawful basis, your own privacy policy, and any consents required to process their data on our infrastructure.

We share personal data only in these situations:

• Service providers — the processors listed in Section 10, strictly to operate the platform.
• Legal compliance — courts, law enforcement and government authorities where required by applicable law or a valid legal order (see Section 18).
• Protection of rights — where necessary to protect the safety, rights or property of Anested Cloud, our customers or the public (e.g. reporting an active attack).
• Business transfers — if Anested Cloud is involved in a merger, acquisition or asset sale, data may transfer to the successor entity under this same policy; we will notify you of any such change.

We never sell, rent or trade your personal data.

We rely on a small number of infrastructure and service providers, each processing only what is needed for its role:

• Razorpay — payment processing, autopay mandates and refunds.
• Google — optional Google sign-in (we receive your email and display name only).
• Cloud infrastructure providers — the data centres and virtual machines on which our platform, your servers and databases run.
• Managed database hosting — our own control-plane database is hosted on a managed cloud database service.
• Email delivery provider — sending OTPs, invoices and service notifications to your registered email.

Each provider is bound by its own security and privacy commitments; we choose providers with industry-standard safeguards and share the minimum data necessary.

• Account data is retained for as long as your account is active.
• Service data lifecycle: when a paid service expires it is suspended with data retained; if not renewed within 30 days, the service and all its data are permanently deleted (as described in the Terms of Service). Deleted service data cannot be recovered.
• When a refund is approved, everything purchased under that invoice is permanently deleted at the time of approval.
• Invoices, payment records and tax-relevant data are retained for the period required by Indian tax and accounting law (generally up to 8 years), even after account closure.
• Operational and security logs are retained for a limited period appropriate to security investigation needs, then rotated out.
• If you close your account, we delete or de-identify your personal data within a reasonable period, except records we must keep by law or need to resolve disputes.

• Encryption in transit: dashboard, APIs and service endpoints are served over TLS (HTTPS).
• Passwords are stored only as salted hashes; server and database credentials are generated per-resource and shown to you at creation.
• Tenant isolation: every VPS, database project and hosting site runs in its own isolated environment, separated from other customers at the kernel/network level.
• Access controls: administrative access to production systems is restricted, authenticated and logged; audit logs record administrative actions.
• Payment isolation: card data is handled exclusively by our PCI-DSS-compliant payment gateway.
• No system is 100% secure. In the event of a data breach affecting your personal data, we will notify you and the relevant authorities as required by applicable law, without undue delay.

Subject to applicable law, you have the right to:

• Access — ask for a copy of the personal data we hold about you. Much of it is already visible in your dashboard (profile, invoices, resources).
• Correction — update inaccurate account details, either in the dashboard or by writing to us.
• Erasure — request deletion of your account and personal data, subject to the legal-retention exceptions in Section 11. Note that deleting your account deletes all your services and data.
• Portability — your content is always yours: you can export databases, download files and copy site code at any time while a service is active.
• Objection — object to processing based on legitimate interests; we will stop unless we have compelling grounds.
• Complaint — lodge a complaint with the relevant data protection authority if you believe we have mishandled your data. We would appreciate the chance to resolve it directly first.

To exercise any right, email support@anested.com from your registered address. We may need to verify your identity before acting, and we respond within the timelines required by applicable law.

• Transactional emails — OTPs, invoices, payment confirmations, renewal/expiry reminders, suspension and deletion warnings, refund updates and security notices are essential to the service and cannot be opted out of while you hold an account.
• Marketing or product-announcement emails, if we ever send them, will always include a working unsubscribe link, and unsubscribing never affects transactional emails.
• Keep your registered email deliverable — critical notices (e.g. the 30-day deletion warning) are sent there, and missing them does not extend any deadline.

• Our Web Analytics product is designed to be privacy-friendly for your site visitors: it collects aggregate metrics (page views, referrers, UTM parameters, custom events) without third-party advertising cookies or cross-site profiles.
• Analytics data collected from your sites belongs to your account; it is not shared with other customers and never sold.
• You remain responsible for your own legal obligations to your visitors (notices, consents where required by the laws that apply to you).
• Similarly, conversations your users have with your AI chatbots are stored under your account for your review and are processed only to operate the bot.

The Services are intended for adults. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.

• Our infrastructure is primarily hosted in data centres located in India.
• Some processors (e.g. email delivery, sign-in providers) may process limited data outside India; where that happens, we ensure the transfer is protected by appropriate safeguards consistent with applicable law.
• The physical location of your own service (e.g. VPS region) is shown at purchase where a choice is available.

• We disclose customer data to government or law-enforcement authorities only in response to a valid legal demand (court order, statutory notice, or equivalent) addressed to us, after reviewing it for legal sufficiency.
• Where legally permitted, we will notify you of a demand concerning your account before complying, so you may challenge it.
• We may voluntarily report content or activity when we in good faith believe it involves imminent danger to life, child exploitation, or terrorism.

We may update this Privacy Policy from time to time. The “Last updated” date above reflects the latest revision. Material changes will be announced via the platform or email at least 7 days before taking effect where reasonably practicable. Continued use of the Services after the effective date constitutes acceptance of the revised policy.

For any privacy question, data request, or grievance under applicable Indian law:

• Email: support@anested.com (subject line “Privacy” helps us route it faster).
• Address: Grievance Officer, Anested Cloud, 5th Floor, Maurya Lok, Near Dak Bunglow Chowk, Patna 800001, Bihar, India.

See also our Terms of Service and Terminology guide.