Privacy Policy

1.Who we are

Hostracer is a brand of CodexIndia Technology Solutions (“we”, “us”). This policy explains what personal data we collect when you use hostracer.in, our customer dashboard and our services, why we collect it, and the choices you have. Under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) we are the Data Fiduciary for the personal data described here.

For websites you host with us — including anything your own visitors submit to them — you decide what is collected and why. We process that data only to provide the hosting service.

2.What we collect

What you give us

• Account details — your full name, email address, mobile number and password. The password is stored only in hashed form, never as you typed it.
• Billing details — billing address, and your company name and GSTIN if you add them, plus your order, invoice and payment history.
• Domain contact details — the registrant name, organisation, address, email and phone number that registries require for every domain.
• Support conversations — tickets, emails, calls and WhatsApp messages, including any attachments.
• Migration access — logins for your old host that you share so we can move a site, used only for that migration. Change those passwords once it’s done.

What we collect automatically

• Technical data — IP address, browser and device type, pages requested and timestamps, recorded in server logs and when you sign in, so we can keep accounts secure and investigate abuse.
• Service data — resource usage, configuration and logs from the hosting, VPS and domain services you use.
• Domain lookups — the names you search for or look up with our WHOIS tool, which we pass to registries to check availability and registration details.

Our website does not use advertising or third-party analytics trackers.

3.How we use it

• to create and run your account and provide the services you order;
• to verify your mobile number and confirm sign-ins;
• to raise invoices, collect payment and meet our GST and accounting obligations;
• to register, renew and transfer domain names;
• to answer support requests and carry out migrations you ask for;
• to send service messages — order confirmations, invoices, renewal reminders, ticket replies and security alerts. These are part of the service, so they continue while you have an active service;
• to prevent fraud and abuse and keep our network secure; and
• to comply with the law, court orders and lawful requests from government agencies.

We process your data on the basis of the consent you give when you sign up, and for the legitimate uses the DPDP Act allows — such as providing a service you asked for and complying with the law. We send promotional messages only with your consent, and you can withdraw it at any time.

4.SMS and one-time passwords

When you register, and when we need to confirm that it’s really you signing in, we send a one-time password to your mobile number by SMS. We also send some service alerts by SMS, such as invoice and support-ticket notifications. Messages are delivered through an Indian SMS gateway provider, which receives your mobile number and the message text only to deliver them.

5.Payments

Payments are processed by Razorpay. Card, UPI, net-banking and wallet details are entered in Razorpay’s secure payment window and handled by Razorpay under its own privacy policy and the Payment Card Industry Data Security Standard (PCI DSS). We never see or store your full card number, CVV, UPI PIN or banking password. Razorpay tells us whether a payment succeeded, its reference number, the amount and the payment method used.

6.Who we share it with

We don’t sell your personal data. We share it only with:

• Razorpay, to process payments;
• our domain registrar partner and the registry for each extension, to register and manage your domains — and, where WHOIS privacy isn’t available, the public WHOIS/RDAP record;
• our SMS gateway and email delivery providers, to send messages;
• the datacentre and infrastructure providers our servers run on;
• professional advisers such as accountants and lawyers, under a duty of confidentiality;
• government agencies, courts and law-enforcement bodies — including CERT-In — where the law requires it; and
• a buyer or successor if our business is sold or restructured, who must continue to honour this policy.

Providers that process data on our behalf may use it only on our instructions and for the purpose we shared it for.

7.Cookies and browser storage

Our website doesn’t set advertising or tracking cookies. It uses your browser’s local storage only for things the site needs to work:

• keeping you signed in to your dashboard;
• remembering your cart, and your last order while you check out;
• remembering your light or dark theme, and which announcements you’ve dismissed.

You can clear this storage at any time in your browser settings; you will be signed out and your cart emptied. When you pay, Razorpay’s payment window may set its own cookies, which are covered by Razorpay’s policy.

8.How long we keep it

• Account and service data — while your account is open, and afterwards only as long as we need it to resolve disputes, prevent fraud or meet legal obligations.
• Invoices and payment records — for the period GST and tax law requires.
• Customer and log records required by CERT-In — for the periods its directions set for hosting and VPS providers.
• Website files, databases and email — deleted after the service is terminated; copies in backups expire as those backups are replaced.
• Support tickets — while your account is open, and afterwards for as long as we may need them to resolve a dispute.

When we no longer need personal data for any of these purposes, we delete or anonymise it.

9.Security

We protect personal data with reasonable security safeguards, as the DPDP Act requires: encrypted (HTTPS) connections to our website and dashboard, hashed passwords, one-time-password checks, and access limited to the people who need it. No system is perfectly secure; if a personal data breach happens, we will inform the Data Protection Board of India and the people affected, as the law requires. Please keep your password private and don’t reuse it elsewhere.

10.Your rights

Under the DPDP Act you have the right to:

• Access — a summary of the personal data we hold about you, how we process it, and who we have shared it with;
• Correction and erasure — have your data corrected, completed or updated, and erased once it is no longer needed. Your email address and mobile number are changed through support so we can verify the request;
• Withdraw consent — at any time, as easily as you gave it. This doesn’t affect processing already done, but we may then be unable to provide services that depend on it;
• Grievance redressal — complain to us about how we handle your data and receive a response; and
• Nominate — name someone to exercise these rights for you in the event of your death or incapacity.

To use any of these rights, email info@hostracer.in from the address on your account, or open a support ticket. We may need to verify your identity first, and we will respond within the time the DPDP Act and its rules allow. Data we must keep by law — invoices, or records required by CERT-In — can’t be erased until its retention period ends.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

11.Children

Our services are for adults. You must be 18 or over to open an account, and we don’t knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

12.Where your data is stored

Our hosting servers are in India. Some of the providers listed above may process data outside India; where they do, it is only as the DPDP Act permits.

13.Changes to this policy

We update this policy when our practices change; the date at the top shows the current version. If a change is significant, we’ll tell you by email or in your dashboard.

14.Grievance officer and contact

Questions, requests and complaints about your personal data go to our Grievance Officer at info@hostracer.in — please put “Privacy” in the subject line. You can also call +91 85094 35513 or contact support.