Privacy Policy

Last updated: July 9, 2026

This Privacy Policy explains how R Software & Consulting LLC, doing business as Candor Host ("we," "us"), collects, uses, and protects information when you use our website and hosting services. We keep this short and plain on purpose.

1. Information we collect

  • Account information you provide: name, email address, billing address, and phone number.
  • Payment information: processed securely by our payment provider, Stripe. We do not store full card numbers on our servers.
  • Service data: the content, files, databases, and email you host with us, which we process only to provide the service. See Section 8 for how we treat this data.
  • Technical data: IP addresses, server and access logs, and basic analytics we use to operate, secure, and improve the service. See our Analytics Transparency page for exactly what our website analytics collect and don't collect.
  • Support communications: emails and tickets you send us, and our responses.

We do not collect biometric data, health data, or precise geolocation.

2. How we use information

We use your information to:

  • Provide and bill for hosting services.
  • Secure our platform against abuse and attack.
  • Provide customer support.
  • Send you service-related messages (invoices, renewal notices, security notices, incident reports, breach notifications).
  • Comply with legal obligations.
  • Enforce our Terms of Service and Acceptable Use Policy.

We do not sell your personal information. We do not use your personal information for advertising. We do not share your data with any party except as described in Section 3.

3. Sharing and disclosure

We share information only with:

  • Subprocessors who help us run the service, listed at candorhost.com/subprocessors/. Each is bound by contract to protect your data.
  • Law enforcement or courts, when required by valid legal process and after taking reasonable steps to notify you unless legally prohibited from doing so.
  • Successor entities in the event of a merger, acquisition, or sale of substantially all of our assets, under equivalent protections.

We do not sell data to marketers, data brokers, or affiliates.

4. Legal basis for processing (GDPR)

For customers in the European Economic Area, United Kingdom, or Switzerland, we process personal data under the following bases:

  • Contract performance: to provide the hosting service you've purchased.
  • Legitimate interests: to secure our platform, prevent fraud, and improve the service.
  • Legal obligation: to comply with tax, accounting, and law-enforcement requirements.
  • Consent: where we ask for it, which you can withdraw at any time.

Candor Host acts as the data controller for account, billing, and technical data described above. For the content you host with us (Service Data), Candor Host acts as a data processor on your behalf. Our Data Processing Agreement governs that processing and is available on request or as a downloadable addendum in your client portal.

5. Your rights

Depending on where you live, you may have the right to:

  • Access the personal information we hold about you.
  • Correct inaccurate or incomplete data.
  • Delete your personal information ("right to erasure").
  • Restrict or object to certain processing.
  • Portability: receive your data in a machine-readable format and transmit it to another controller.
  • Withdraw consent where processing is based on consent.
  • Lodge a complaint with your local data protection authority. For EU residents, that is the supervisory authority in your Member State.

To exercise any of these rights, email legal@candorhost.com with "Data request" in the subject line. We will respond within 30 days. We may need to verify your identity before fulfilling requests.

6. California residents (CCPA / CPRA)

California residents have the right to know what personal information we collect, the right to delete it, the right to correct it, and the right to opt-out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined by the California Consumer Privacy Act. We will not discriminate against you for exercising any CCPA right.

To exercise CCPA rights, email legal@candorhost.com.

7. Children's privacy

Our services are not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If we learn we have collected personal information from a child under 13, we will delete it. If you believe a child has provided us information, contact legal@candorhost.com.

8. Service data (content you host)

Content that you host on Candor Host — websites, databases, email — is your data. We access it only to provide the service, respond to your support requests, investigate abuse of our platform, or comply with legal process. We do not read, analyze, or share your content for any other purpose. Our staff access to service data is logged and restricted.

9. International data transfers

Our servers are located in the United States. If you access our services from outside the United States, your data will be transferred to and processed in the U.S. For customers in the European Economic Area, United Kingdom, or Switzerland, transfers are made under the European Commission's Standard Contractual Clauses (2021/914) or successor mechanisms. Our Data Processing Agreement includes the applicable clauses.

10. Data retention

We retain:

  • Account and billing records for as long as your account is active, plus seven years after cancellation for tax and accounting purposes.
  • Hosted content for the duration of your service. Upon cancellation, we retain content for 30 days to allow reactivation, then delete it as described in our Cancellation Policy.
  • Backups according to the retention schedule of the plan you purchased (typically 30 days on rolling snapshots).
  • Support communications for three years.
  • Server access logs for 90 days for security and troubleshooting.

You can request earlier deletion of your data at any time by emailing legal@candorhost.com, subject to legal retention requirements.

11. Security

We protect your data with encryption in transit (TLS 1.2+), access controls, per-site container isolation, regular backups, and staff training. Access to production systems is restricted, logged, and reviewed. No system is perfectly secure, but we take reasonable measures to safeguard your information.

Breach notification. If we suffer a personal data breach that is likely to result in a risk to your rights, we will notify affected customers and the relevant supervisory authorities without undue delay and no later than 72 hours after becoming aware of it, in accordance with GDPR Article 33.

To report a suspected security vulnerability, see our Vulnerability Disclosure Policy.

12. Cookies

Our marketing website and client portal use only cookies necessary for the site to function — for example, keeping you signed in, remembering your language preference, and providing CSRF protection. We do not use advertising or tracking cookies. Full details in our Cookie Policy.

13. Do Not Track and Global Privacy Control

We do not track visitors across third-party sites, so DNT and GPC signals do not change our behavior. We follow the same privacy practices for every visitor.

14. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or through your client portal at least 30 days before the changes take effect. The "Last updated" date at the top of this page reflects the latest version.

15. Contact

Questions about privacy? Email legal@candorhost.com.

Data Controller: R Software & Consulting LLC dba Candor Host Jacksonville, Florida, USA