Privacy is not a feature. It is a fundamental right.
Last Updated: October 10, 2026.
This policy explains what we collect, why we collect it, and how we protect it.
Vestra is a unified platform for hosting and other related services, committed to protecting user privacy. For the personal data described in this policy, Vestra is the data controller. Where a business customer uses our services to store or process its own users' personal data, Vestra acts as that customer's processor (see section 13).
Under UK GDPR (and EU GDPR where it applies), we rely on the following legal bases:
Users can register with a name, email, and password. You can download the Passport account data shown in your account settings and delete your account yourself from Passport, or ask us to help by emailing [email protected] or opening a support ticket. Self-service deletion first verifies and deletes linked Calagopus and legacy Pterodactyl panel accounts. It stops without deleting your Passport identity if a linked account cannot be matched, the panel is unavailable, or the panel account still owns servers. For access to data held only by another Vestra service, or to exercise a right that the Passport download does not cover, contact us.
We use the following categories of cookies and similar browser storage (such as local storage):
We only use analytics after you consent through our cookie banner. If you reject analytics, or don't make a choice, analytics do not run.
Vestra's in-house analytics: first-party analytics that Vestra runs itself and only loads after you accept. It collects the page path without its query string or fragment, page title, referrer path, time on site, device and browser information (user agent, browser family, device type, language, timezone, screen size and viewport size) and approximate location (country and continent). IP addresses are truncated before they are stored, so we do not keep your full IP address for analytics. After you consent, a random visitor ID is kept in your browser's local storage so we can tell how long visits last. Analytics data is not linked to your Vestra account. Its retention target is 30 days; the automated purge job must be enabled as part of the analytics deployment, and deletion can be requested from [email protected] in the meantime.
Google Analytics: on some pages (the Vestra Hosting One and Vestra Drive landing pages) we also use Google Analytics, provided by Google LLC, only after you consent. Google Analytics sets cookies and processes information such as your IP address, device and browser details, and the pages you view, so that we receive aggregated usage reports. See Google's Privacy Policy for more information.
You can withdraw consent at any time using "Cookie settings" in the footer. You can also opt out of in-house analytics by appending ?analytics=off to the URL; this stores a cookie that preserves your opt-out for up to 2 years.
When you use Vestra's AI services (such as VestraAI and the Vestra AI API), we process your prompts, inputs, uploaded content and the generated outputs to provide the service, measure usage against your plan, and keep the service secure.
We do not use customer prompts, inputs, outputs or uploaded content to train AI models.
We use a small number of service providers to help run our services, including Stripe for payment processing, Cloudflare for content delivery and security, Hetzner for server hosting, netcup for backup servers, Google for consent-based analytics and font delivery on pages that still use it, and Discord for community support, verification and routing recruitment applications to authorised staff. Account and service emails are sent from an email server that Vestra owns and operates. Each provider should receive only the data needed for its purpose.
The full list, including what each provider does and what data it receives, is on our Sub-Processors page.
Some providers, such as Stripe, Cloudflare, Google and Discord, may process personal data outside the UK. Depending on the provider and destination, the available safeguards can include UK adequacy regulations, contractual clauses, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses. Contact us for the safeguard used for a particular transfer. Vestra is reviewing its provider records and transfer documentation; this policy does not claim that a safeguard applies unless it has actually been put in place.
User data is stored on access-controlled servers hosted with Hetzner, with backups on netcup. Connections to our services are encrypted with HTTPS, and passwords are salted and hashed. You can request privacy deletion support by emailing [email protected].
We never sell personal data. We do not share personal data with third parties except where required for service operation (see our Sub-Processors page), legal compliance, or user-requested integrations.
If you are a business using Vestra services to store or process personal data on behalf of others (for example, your own customers' or users' data), our Data Processing Addendum applies. It forms part of our Terms of Service when you use our services as a business customer, and no signature is needed.
Under UK data protection law (UK GDPR), you may request access to your personal data, correction of inaccurate data, deletion of data where appropriate, restriction of processing, transfer your data to another service, or object to certain processing.
Where processing relies on consent (such as analytics), you may withdraw consent at any time using "Cookie settings" in the footer.
To exercise your rights, contact us at [email protected] using the details in this policy. We may require reasonable information to verify your identity before fulfilling a request. We aim to respond within one month where required by law.
For users in the EU, we aim to handle personal data in line with the EU GDPR. For users in other jurisdictions, we aim to comply with applicable data protection laws.
If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority, such as the Information Commissioner's Office (ICO) in the UK or your local data protection authority.
Users must be age 13 or older. We do not knowingly accept accounts from children under 13. Vestra is reviewing whether any service is likely to be accessed by children and what age-assurance and age-appropriate design measures are required; we do not claim special under-16 controls that the product does not yet implement.
Material changes to this policy are announced via email and/or Discord updates where appropriate.
If you believe your copyrighted work is infringed, open a support ticket and provide the required notice details, including ownership proof, disputed content location, and a good-faith statement.
The data controller is Vestra, a privately registered business. For privacy questions or requests, email [email protected], call 07488 375664, or use the support ticket system.