Privacy policy

Hostamir ("we", "us") provides web hosting, virtual servers and domain registration from Chirirbandar, Dinajpur, Bangladesh. This policy explains how we handle personal data when you visit hostamir.com, use our dashboard at clients.hostamir.com, or buy a service. We follow the Personal Data Protection Ordinance 2025 of Bangladesh and the rules of the payment providers and domain registries we work with.

1. What we collect

Information you give us

• Account details — name, email address, phone number, postal address, and company name if you order as a business.
• Identity documents — for .com.bd domains only, a copy of your NID, trade licence or company registration, which BTCL requires. We delete these once registration is approved.
• Payment details — the bKash, Nagad or Rocket number you pay from, or the last four digits of a card. Full card numbers never reach our servers; they are handled by the payment gateway.
• Support messages — tickets, emails, WhatsApp and phone notes, including any login details you choose to share for a migration.

Information collected automatically

• Server logs — IP address, browser, pages requested and timestamps for hostamir.com and the dashboard, kept for 90 days for security and troubleshooting.
• Service logs — for hosting accounts and VPS: resource usage, login attempts to the control panel or SSH, and mail server logs. These are needed to run the service and investigate abuse.
• Cookies and analytics — a preference cookie for your currency and dark-mode choices, and a session cookie so the dashboard keeps you logged in. We also use Google Analytics to see which pages people visit and how they found us; it sets its own cookies and processes that data on Google's servers outside Bangladesh. We do not use advertising cookies and we do not sell your data. You can opt out with Google's browser add-on, or by using your browser's Do Not Track or tracker-blocking settings.

2. Why we use it

• To create and run your account, provision services and issue invoices.
• To register domains in your name. Registries require registrant contact details; we apply free WHOIS privacy where the registry allows it.
• To answer support requests and migrate sites when you ask us to.
• To send service notices — invoices, renewal reminders, maintenance windows and security alerts. These are not marketing and you cannot opt out while you have an active service.
• To send occasional product news, only if you tick the box at signup. Every such email has an unsubscribe link.
• To detect and stop abuse, fraud, spam and attacks, and to meet legal obligations.

3. Your website's data

Files, databases and email stored in your hosting account or VPS belong to you. We do not read, sell or analyse them. Our staff access them only when you ask for help, when an automated system flags abuse or malware, or when required by law. You are the data controller for any personal data of your own visitors and customers; we process it on your behalf as your hosting provider.

4. Who we share it with

• Payment providers — bKash, Nagad, Rocket, SSLCommerz and card networks, to take payment.
• Domain registries and registrars — including BTCL for .bd domains, to register and maintain your domains.
• Datacentre and upstream providers — our primary servers are in Bangladesh, with additional locations in Singapore, Germany and the USA. These providers have physical access to the hardware but no access to your account data.
• SSL providers — Let's Encrypt, which receives the domain name and in some cases an email address.
• Authorities — when we receive a lawful order from a Bangladeshi court or authority. We only disclose what the order requires and tell you unless we are prohibited from doing so.

We never sell personal data or share it for advertising.

5. How long we keep it

• Account and invoice records: for as long as you have an account, then 5 years as required for tax and accounting.
• Hosting content: deleted 30 days after a service is cancelled or terminated. Backups expire on the same schedule.
• Support tickets: 2 years after closure.
• Web server logs: 90 days.
• .com.bd identity documents: deleted on registration approval.

6. Security

All traffic to hostamir.com and the dashboard is encrypted with TLS. Passwords are stored hashed; we cannot see them. Two-factor authentication is available in the dashboard and we recommend turning it on. Staff access to customer systems is logged and limited to what a task needs. If a breach affects your data we will notify you by email within 72 hours of confirming it.

7. Your rights

You can ask us to show you the personal data we hold, correct it, export it, or delete it. You can withdraw marketing consent at any time. Most of this you can do yourself in the dashboard; for anything else, email hello@hostamir.com from your registered address and we will respond within 15 days. Deleting your account deletes your hosting content, so download anything you need first.

8. Children

Our services are for people aged 18 or over, or businesses. We do not knowingly collect data from children.

9. Changes

If we change this policy in a way that affects you, we will email account holders at least 14 days before it takes effect and update the date at the top of this page.

10. Contact

Hostamir, Chirirbandar, Dinajpur, Bangladesh · hello@hostamir.com · 01722-402487