Privacy Policy

Last updated: March 17, 2026

This Privacy Policy describes how Practical Objects, LLC (d/b/a Impulse Hosting, "we", "us") collects, uses, stores, and protects your personal information when you use our services or visit our website.

1. Data Controller

Practical Objects, LLC is the data controller for the personal information we collect. For GDPR purposes, our contact details are provided at the bottom of this policy.

2. Information We Collect

2.1 Account Information

When you create an account, we collect your name, email address, physical address, phone number (optional), and company name (optional).

2.2 Payment Information

Payment card details are collected and processed directly by Stripe. We do not store your full credit card number on our servers. We retain transaction records including the last four digits of your card, transaction amounts, and dates.

2.3 Service Data

We collect data generated through your use of our services, including server logs, IP addresses, resource usage metrics (storage, bandwidth, CPU), support ticket contents, and service configuration data.

2.4 Website Analytics

We collect standard web analytics data including pages visited, referral sources, browser type, device information, and IP address. We do not use third-party tracking scripts or sell analytics data.

2.5 Communications

We retain records of communications with our support team, including emails and support tickets.

3. How We Use Your Information

We use your information to:

• Provision, maintain, and support your services
• Process payments and send invoices
• Communicate service updates, maintenance notices, and security alerts
• Respond to support requests
• Detect and prevent fraud, abuse, and violations of our Terms of Service and AUP
• Comply with legal obligations
• Improve our services and infrastructure

4. Legal Basis for Processing (GDPR)

For individuals in the European Economic Area (EEA) and United Kingdom, we process personal data under the following legal bases:

• Contractual Necessity — Processing required to deliver the services you purchased (account management, provisioning, billing, support).
• Legitimate Interest — Processing for fraud prevention, security monitoring, service improvement, and infrastructure management.
• Legal Obligation — Processing required to comply with applicable tax, accounting, and regulatory requirements.
• Consent — Where we send marketing communications, we do so with your opt-in consent. You may withdraw consent at any time.

5. Data Sharing

We do not sell, rent, or trade your personal information. We share data only with the following categories of third parties as necessary to provide our services:

• Vultr (The Constant Company, LLC) — Infrastructure provider for server provisioning
• Cloudflare, Inc. — DNS, CDN, and SSL services for ImpulseDrive custom domains
• Stripe, Inc. — Payment processing
• eNom / Tucows, Inc. — Domain registration services
• Netdata, Inc. — Infrastructure monitoring

Each sub-processor is bound by data processing agreements. We may also disclose information if required by law, court order, or to protect the rights and safety of Impulse Hosting and its customers.

6. International Data Transfers

Our primary infrastructure is located in the United States. If you select a region outside the US (such as London, UK or Singapore), your service data is stored in that region. Account and billing data is processed in the US regardless of your selected service region.

For transfers of personal data from the EEA/UK to the US, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission. If you require a Data Processing Addendum (DPA), please contact us.

Customers with data residency requirements for EU/UK data may select the London region to ensure service data remains within the UK.

7. Data Retention

• Active accounts: Data retained for the duration of the account.
• Service data after termination: Deleted within seven (7) days of service termination.
• Account and billing records: Retained for seven (7) years after account closure for tax and legal compliance.
• Support tickets: Retained for three (3) years after resolution.
• Server logs: Retained for ninety (90) days.

8. Data Security

We implement industry-standard security measures including: encryption in transit (TLS/SSL on all services), encrypted storage for credentials and sensitive configuration data, access controls and principle of least privilege, automated monitoring and alerting, and regular security reviews of our infrastructure.

9. Cookies

We use strictly necessary cookies for session management and authentication within our client portal. We use a single preference cookie to store your theme selection (dark/light mode). We do not use third-party advertising or tracking cookies.

10. Your Rights

10.1 All Customers

You may access, update, or correct your personal information through your client dashboard at any time. You may request account deletion by contacting support.

10.2 GDPR Rights (EEA/UK Residents)

If you are located in the European Economic Area or United Kingdom, you have the following rights:

• Right of access — request a copy of your personal data
• Right to rectification — correct inaccurate data
• Right to erasure ("right to be forgotten") — request deletion of your data
• Right to restrict processing
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interest
• Right to withdraw consent — where processing is based on consent
• Right to lodge a complaint — with a supervisory authority (e.g., the UK Information Commissioner's Office)

We will respond to GDPR requests within thirty (30) days. Contact us at the address below to exercise your rights.

10.3 CCPA/CPRA Rights (California Residents)

If you are a California resident, you have the right to: know what personal information we collect, request deletion of your personal information, opt out of the sale of personal information (we do not sell personal information), and not be discriminated against for exercising your rights. To exercise your CCPA rights, contact us at the address below.

11. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email at least thirty (30) days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.