Privacy & Cookie Policy

BitQate LLC, a Delaware limited liability company based in the United States (“BitQate”, “we”, “us”, “our”), is the data controller responsible for your personal data. You can reach us for all privacy-related matters at:

• •Email: privacy@bitqate.com
• •Support portal: portal.bitqate.com/tickets

Questions or concerns about how we handle personal data can be sent to privacy@bitqate.com, and we will respond directly.

Our services are directed at customers in the United States and Canada.

We collect the following categories of personal data depending on how you interact with us:

Account data

Email address, username, hashed password, and optionally your full name (and whether to show it to workspace members). We also store your account settings: language, timezone, session timeout, and email notification preferences.

Registration and login data

The IP address you registered from, the IP address of your most recent login, and your browser-reported timezone at sign-up. We use these to secure your account and to meet sanctions obligations (see Section 12).

Security data

Authentication logs, session identifiers, two-factor authentication (TOTP) secrets, passkey (WebAuthn) public keys and device names, hashed one-time login and password-reset codes, and a history of IP addresses from which you have successfully logged in. The login IP history is used to detect unfamiliar sign-ins and ask for email verification.

Billing data

Credit balance, transaction and refund history, subscriptions, and invoices. Checkout and payment are handled by Polar, and we never receive or store full card numbers.

Service data

Configurations of the game servers, applications, databases, virtual machines, and websites you create, including names, startup variables, ports, IP allowlists, attached domains, reverse DNS hostnames, backups metadata, Git deployment history (commit SHA, message, author name, build logs), and resource usage.

Network usage data

For each game server, application, database, and virtual machine, the amount of inbound and outbound traffic and its peak rate, measured every minute, plus your network alert settings (spike threshold and whether transfer cap alerts are on). We use it to show you usage charts, send the network alerts you have enabled, apply transfer caps and port speed limits, and detect abuse such as denial-of-service traffic. We record traffic volumes only, never the content of your traffic or who it was exchanged with.

GitHub data

If you connect GitHub, we store your GitHub user ID, username, avatar URL, an encrypted access token, and the repositories and branches you link for deployments.

Workspace data

Workspaces you own or belong to, members, roles, permissions, and invitations. Members of a shared workspace can see your username (or full name if you enable it), and your email address once you accept an invite.

Referral data

Your referral code, which account referred you, and any referral rewards paid.

Campaign data

If you open one of our own campaign links (for example a link we placed on a community wiki, in a post, or in a video), we count that the link was opened, without recording your IP address, browser, or any other identifier. If you then create an account within 30 days, we record on your account which campaign link you came through.

Usage data

When you use the portal, we record the page path, your IP address, your browser user agent, and (if you are signed in) your account. This is stored on our own servers and is not shared with analytics or advertising providers.

Technical data

Your IP address, browser type and version, operating system, and request metadata, collected automatically by our servers and network provider when you access our website or portal.

Communications

Support tickets, replies, and image attachments. We automatically strip location and camera metadata (EXIF, XMP, IPTC) from uploaded images.

We also derive an approximate country and region from your IP address using a GeoIP database hosted on our own servers. No IP address is sent to a third party for this lookup.

Files, databases, websites, and any other data you store on servers, virtual machines, or backups you run with BitQate are your content. For any personal data in that content, you are the controller and we process it only on your instructions to provide the service. We do not inspect or use it for any other purpose.

If our support staff need to access one of your servers or virtual machines to troubleshoot a problem, we will ask for your permission in the portal first, and you can revoke access at any time.

We use personal data only for the following purposes:

We do not use your data for advertising, and we do not sell it. You can opt out of marketing emails at any time (see Section 5).

We send transactional emails needed to run your account, such as login verification codes, security alerts, password resets, billing notices, server expiry warnings, and network usage alerts (traffic spikes and transfer caps). You can turn off some categories of notification email in your account settings, and network alerts for each server, but we will always send emails that are essential to your account’s security.

We also email you account notices when we act on your account, such as a warning after an abuse report, a suspension, or a reinstatement. These go to your account email address, explain the reason, and may include a note from our staff. You cannot opt out of them, and a record of each notice is kept in our administrative audit log (see Section 9).

As a customer, you may also receive occasional emails about BitQate products, features, and offers. Every such email includes an unsubscribe link, and you can opt out at any time from your email preferences. When you unsubscribe, we keep your email address on a suppression list so we do not email you again.

We use cookies and browser storage that are needed for the site and portal to function or that remember choices you make, plus one campaign cookie that is only set if you open one of our campaign links:

session

A secure, HttpOnly cookie that keeps you signed in to the portal. Expires after the inactivity timeout you choose, or when you log out.

sidebar_state

A cookie that remembers whether the portal sidebar is expanded. Expires after 7 days.

bq_campaign

Set only when you open one of our campaign links. It holds the name of that link and nothing else, so that if you sign up we know which campaign brought you. Expires after 30 days, or is removed when you create an account.

Local storage

Your theme, language, selected workspace, and display preferences, stored only in your browser.

All of these are first-party cookies: they are set and read only by bitqate.com and are never shared with advertising or analytics providers. We do not use cookies for advertising or cross-site tracking. The bq_campaign cookie is not needed for anything to work, so you can block or delete it in your browser without affecting the site or portal.

We engage the following third parties, who handle personal data on our behalf or as independent controllers for their own services:

Cloudflare

Provides our content delivery network, DNS, and DDoS protection. All traffic to our website, portal, and API passes through Cloudflare, which processes technical data such as IP addresses and request metadata. Cloudflare also operates an automated CSAM Scanning Tool that hashes cached images and compares them against databases of known child sexual abuse material; if a match is found, the affected URL is blocked and we are notified. Privacy policy: cloudflare.com/privacypolicy.

Polar

Our payment provider and merchant of record. We share your account email address with Polar when you start a checkout. Polar collects your payment card and billing details directly and processes them under its own privacy policy. Privacy policy: polar.sh/legal/privacy.

Let's Encrypt

Issues free TLS certificates for websites you host with us. When you add a domain, the domain name is sent to Let's Encrypt, and like all publicly trusted certificates, it is published in public Certificate Transparency logs. Privacy policy: letsencrypt.org/privacy.

GitHub

Only if you connect your GitHub account. We access the repositories you choose and create deployment webhooks on them using the permissions you grant. Privacy policy: docs.github.com/site-policy/privacy-policies.

We send all email from our own mail server, so your email address and the emails we send you are not shared with a third-party email delivery provider.

Some pages load content directly from third-party services, which receive your IP address and browser details when they do:

• •The portal login page loads a background image from Unsplash.
• •Our status page loads fonts from Google Fonts.
• •Minecraft server tools in the portal search and load mods, plugins, and player avatars from Modrinth, Spiget (SpigotMC), and mc-heads.net when you use them.

We do not sell your personal data to third parties. We do not share your data with advertisers or data brokers. We may disclose data where required by law or to protect our rights, users, or services.

BitQate is based in the United States. The content of your servers is stored in the data center location you choose. If you use BitQate from outside the US, your account data may be transferred to and processed in the US, where data protection laws may differ from those in your country.

We retain personal data only as long as necessary for the purpose it was collected or as required by law:

Account data

Retained while your account is active. If you request deletion, we delete your personal data within 30 days of a verified request (see Section 10), except where we must retain certain records for longer to meet a legal obligation.

Billing records

Retained for 7 years to comply with tax and accounting obligations.

Network usage data

Per-minute traffic samples are deleted automatically after 48 hours. Hourly and monthly totals are deleted automatically after about 13 months.

One-time codes and tokens

Login verification codes, password-reset tokens, and pending two-factor setup data are deleted automatically shortly after they expire, typically within minutes.

Usage data and logs

Portal usage data and application logs are deleted automatically after 90 days.

Campaign data

Campaign link opens are anonymous counts and are kept for as long as we run the campaign reports. The campaign link recorded on your account is kept while your account is active and deleted with it.

Support communications

Retained for as long as necessary to maintain service continuity and resolve recurring issues, typically around 3 years. Image attachments are deleted automatically after 14 days.

Git deployments

We keep the 20 most recent deployments (including build logs) per server and delete older ones automatically.

Server content and backups

Deleted when you delete the server or backup, or when the server is removed after expiring without renewal.

Recognized login IPs

A login location stays recognized for 90 days after you last sign in from it and is then deleted automatically. You can view and revoke individual trusted IPs or clear all recognized locations at any time, and they are deleted when your account is deleted.

Email suppression list

If you unsubscribe or an email bounces, we keep your email address on a suppression list for as long as needed to honour that choice.

Administrative audit logs

Records of staff actions on accounts, including account notices we send you (which may include your username, email, and the notice and any staff note), are kept for accountability and security.

Where a retention period above is a target rather than an automatic deletion, you can always request deletion sooner under your erasure right in Section 10.

Wherever you live, you can ask us to do any of the following. We will respond to verified requests within 30 days, or tell you within that time if we need longer.

Access

Request a copy of the personal data we hold about you.

Correction

Request correction of inaccurate or incomplete data.

Deletion

Request deletion of your account and personal data, except records we must keep by law.

Restriction

Request we restrict processing while a dispute is resolved.

Portability

Receive a copy of your data in a structured, machine-readable format.

Objection

Object to how we use your data. You can opt out of marketing emails at any time, and we will always stop.

Complaints

If you are unhappy with how we handled your data, contact us first and we will try to resolve it. You can also contact the privacy or consumer protection authority where you live; in Canada, this is the Office of the Privacy Commissioner of Canada (priv.gc.ca), or in Quebec, the Commission d’accès à l’information (cai.gouv.qc.ca).

You can update your profile, notification and marketing email preferences, trusted login locations, passkeys, and connected GitHub account yourself in the portal. To exercise any other right, email privacy@bitqate.com with your account email and the right you wish to exercise. We may ask for verification before processing your request.

If you live in a US state with a consumer privacy law, such as California, Colorado, Connecticut, Virginia, or Texas, you have the following rights over your personal information, subject to the exceptions in those laws:

• •Know and access the categories and specific pieces of personal information we hold about you.
• •Correct inaccurate personal information.
• •Delete personal information we collected from you.
• •Receive a portable copy of your personal information.
• •Opt out of the sale or sharing of personal information, targeted advertising, and profiling.
• •Not be discriminated against for exercising any of these rights.

We collect the categories of personal information described in Section 2, from you, from your browser or device, and from GitHub if you connect it, for the purposes in Section 4. We disclose it only to the service providers in Section 7. We do not sell your personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects, and have not done so in the past 12 months. Because we do not sell or share personal information, there is nothing to opt out of, but we also treat a Global Privacy Control signal as a valid opt-out request.

To make a request, email privacy@bitqate.com. We will verify your identity by confirming control of your account email, and you may use an authorized agent with your written permission. If we decline your request, you can appeal by replying to our decision, and if your appeal is denied you can contact your state attorney general.

To comply with sanctions and export control laws, sign-ups are automatically blocked when your IP address, its approximate location, or your browser-reported timezone indicates a restricted jurisdiction. If you believe you were blocked in error, contact us and a person will review the decision.

Otherwise, we do not use fully automated decision-making (including profiling) that produces legal or similarly significant effects on you. Abuse detection heuristics may flag accounts for human review, but no account action is taken without manual oversight.

We implement technical and organisational measures to protect your personal data, including:

• •Passwords and one-time codes stored using one-way cryptographic hashes.
• •Sensitive credentials such as GitHub access tokens and virtual machine passwords encrypted at rest.
• •Optional two-factor authentication and passkeys, plus email verification for logins from unrecognized locations.
• •Transport Layer Security (TLS/HTTPS) for all data in transit.
• •Access controls limiting which team members can access user data, with additional verification for sensitive staff actions.
• •Audit logging for administrative actions.

No method of transmission over the internet or electronic storage is completely secure. In the event of a personal data breach likely to result in a high risk to your rights, we will notify you without undue delay, as required by applicable law.

BitQate is not intended for children. You must be at least 18 years old, or have verifiable parental or guardian consent, to create an account. We do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy to reflect changes in our practices or applicable law. Where the changes are material, we will notify registered users by email at least 14 days before the new policy takes effect. The “Last updated” date at the top of this page always reflects the most recent revision.

For any questions about this policy or to exercise your rights:

• •Email: privacy@bitqate.com
• •Support tickets: portal.bitqate.com/tickets
• •X (Twitter): @bitqate
• •GitHub: github.com/BitQate