Privacy Policy.
Learn how Command Server Hosting collects, protects, processes, and retains your personal information across all hosting systems and client portals.
Regulatory Compliance
This Privacy Policy describes the personal data protection practices of Aimless Creations (trading as Command Server Hosting) across commandservers.com, client billing systems, server control panels, daemon systems, APIs, and customer support channels in accordance with the EU GDPR, UK GDPR, and US privacy statutes.
1. Scope and Legal Controller Identification
01This Privacy Policy governs the processing of personal data collected through commandservers.com, associated client billing systems, server control panels (including Pterodactyl daemon systems), APIs, and official communication channels.
The designated Data Controller responsible for your personal data is Aimless Creations, an unincorporated entity organized in Alabama, USA, operating the commercial trade name Command Server Hosting.
CSH processes personal information in accordance with applicable data privacy statutes, including the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“EU GDPR”), the UK Data Protection Act 2018 and UK GDPR (“UK GDPR”), the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), and relevant US state-level privacy frameworks.
2. Categories of Personal Data Collected
02We collect the minimum information necessary to execute hosting services, preserve infrastructure security, and satisfy accounting mandates:
First name, last name, client username, and Discord User Snowflake ID.
Email address, billing address, postal code, and country of residence.
Payment confirmation IDs, transaction records, last four digits of the payment method, and expiration date. Raw credit/debit card numbers and CVV codes are tokenized and processed exclusively by PCI-DSS Level 1 compliant payment processors (Stripe, Inc. and PayPal Holdings, Inc.); CSH never stores unencrypted card numbers on its servers.
Public IPv4/IPv6 addresses, browser user-agent headers, hardware signatures, operating system specifications, network ISP/ASN details, API access tokens, and daemon audit logs.
Container resource metrics (CPU, RAM, disk I/O), authentication attempts, network port mappings, and technical support communications.
3. Legal Bases for Processing Under GDPR / UK GDPR
03Pursuant to Article 6 of the EU/UK GDPR, personal data is processed under the following lawful grounds:
Processing necessary to provision, maintain, and support purchased server instances, authenticate users, and process recurring invoices.
Processing necessary to satisfy statutory corporate accounting requirements, tax filings, and anti-fraud mandates under applicable state and federal laws.
Processing necessary to defend multi-tenant nodes against distributed denial-of-service (DDoS) attacks, detect intrusion attempts, maintain network stability, and enforce our Terms of Service.
Processing based on explicit, affirmative opt-in consent for optional notifications, promotional emails, or community events. Consent may be withdrawn at any time.
4. Third-Party Disclosures & Sub-Processors
04CSH does not sell, lease, or monetize your Personal Data. Data disclosures are restricted to operational sub-processors bound by formal Data Processing Agreements (DPAs):
- Upstream Infrastructure & Bare-Metal Hosting: Contabo GmbH (Aschheim/Munich, Germany), providing parent bare-metal servers, hypervisor environments, network IP transit, and data center facilities across both EU and US locations.
- Payment Gateways: Stripe, Inc. and PayPal Holdings, Inc. (secure payment execution, risk scoring, fraud prevention).
- Communication & Ticketing: Discord Inc. (automated support alerts, bot dispatches, and client ticket channels).
- Law Enforcement Disclosures: Personal data will only be disclosed to judicial or government authorities upon receipt of a legally binding subpoena, warrant, or court order from an authority of competent jurisdiction.
5. International Data Transfers
05Aimless Creations / Command Server Hosting is based in Alabama, USA, and utilizes infrastructure provided by Contabo GmbH across both the United States and the European Union.
For users residing in the EEA, the UK, or Switzerland whose data is processed on US-based nodes or billing systems, transfers are protected via the European Commission’s Standard Contractual Clauses (SCCs) (Decision (EU) 2021/914) and the UK International Data Transfer Addendum.
For server instances deployed within Contabo GmbH's European data centers, data remains subject to EU-standard technical and organizational security measures under Contabo's native GDPR compliance architecture.
All data in transit is encrypted using modern TLS 1.3 encryption, and administrative access to host nodes is restricted via hardware MFA and isolated containerization.
6. Data Retention Schedules
06User profile details and configuration files are retained for the duration of the active service relationship.
Upon termination or cancellation, virtual containers, databases, and snapshots are permanently deleted within 24 to 72 hours.
Transaction receipts, tax records, and invoice logs are retained for seven years to comply with statutory accounting laws.
IP access logs and daemon connection records are retained for up to 90 days for forensic network analysis before being purged.
7. Data Subject Rights (EEA, UK, and Qualifying Jurisdictions)
07Subject to statutory conditions, users located in the EEA, the UK, or jurisdictions with comprehensive privacy frameworks hold the following rights:
- Right of Access (Art. 15 GDPR): Request a copy of the personal information CSH maintains about you.
- Right to Rectification (Art. 16 GDPR): Request the correction of inaccurate or incomplete personal records.
- Right to Erasure (Art. 17 GDPR): Request the deletion of personal data where continued retention is not required by law or contract.
- Right to Restriction of Processing (Art. 18 GDPR): Request the restriction of data processing while a dispute is investigated.
- Right to Data Portability (Art. 20 GDPR): Request personal data provided to CSH in a structured, commonly used, machine-readable format.
- Right to Object (Art. 21 GDPR): Object to data processing based on legitimate interests.
- Supervisory Authority Recourse: You have the right to lodge a formal complaint with your local Data Protection Authority (e.g., the German BfDI/State Data Protection Commissioners, the UK Information Commissioner's Office, or the Irish DPC).
To exercise these rights, submit a verified request to [email protected]. Requests will be addressed within thirty (30) days without charge, except where requests are manifestly unfounded or repetitive.
8. Cookies and Tracking
08CSH utilizes essential session authentication cookies strictly necessary to maintain authenticated login states across our billing system and server panels. Under the EU ePrivacy Directive and UK PECR, these functional cookies do not require prior consent.
CSH does not deploy third-party advertising pixels, cross-site trackers, or commercial profiling scripts. Any future implementation of non-essential analytics will require prior, affirmative opt-in consent via an integrated consent manager.
9. Protection of Minors
09CSH services are strictly restricted to individuals aged thirteen (13) and older (or sixteen (16) where mandated by EEA member state law). We do not knowingly collect personal information from individuals below these threshold ages. Accounts identified as belonging to underage individuals will be terminated immediately and associated personal data deleted.
Have privacy or data questions?
Our data protection and compliance team is available to process your privacy inquiries.