Privacy Policy
Last updated: October 27th, 2026
This Privacy Policy explains what Last Hour Hosting (“we,” “us,” “our”) collects, why, who we share it with, and how long we keep it. It is written by Shiloh, LLC, which operates Last Hour Hosting.
It covers both of our systems:
- Our website at lasthourhosting.org — the marketing site you are reading.
- Your customer portal at my.lasthourhosting.org — where your account, bills, invoices, services, support tickets, and settings live. Earlier versions of this policy excluded the portal; this one does not.
For people in the EEA or UK, see the GDPR Privacy Notice for your specific rights. For California and other US state residents, see the US State Privacy Notice. Our cookies are described in the Cookie Policy, and our subprocessors are listed at /subprocessors.
1. The short version
- Our marketing website sets no cookies, runs no analytics, loads no third-party scripts, and has no advertising trackers.
- Your customer portal sets two strictly-necessary cookies (a session cookie and a CSRF token). That is all. No advertising, no cross-site tracking.
- We do log the IP address and browser of requests to your account, and we keep authentication and audit records. We need these to run your service, stop fraud and abuse, and investigate security incidents. We tell you exactly what and for how long below.
- We do not sell your personal information, and we do not share it with data brokers or advertisers.
- We never read the contents of your sites, mail, or files except where you ask us to as part of support, where we must to fix a fault in your service, or where the law compels us.
2. What we collect
2.1 When you visit our website
Our web server records standard request data for security and troubleshooting: the requested URL, the response status, the time, the amount of data sent, the referring page, the user-agent string, and the IP address. These logs are kept for 14 days and then deleted. We do not use them to build a profile, and we do not correlate them with your account unless you are signed in or we are investigating an attack.
Our website loads its own CSS, JavaScript, and fonts. It does not load Google Fonts, Google Analytics, Facebook pixels, or any other third-party script. Images are served from our own content delivery network, which sees the request and the requesting IP address but does not receive a cookie or any account identifier.
2.2 When you create an account
| Data | Why we have it | Kept for |
|---|---|---|
| First and last name | To address you and identify the account | Life of the account |
| Email address | Login, service notices, invoices, security alerts | Life of the account + 30 days |
| Password (hashed, never readable by us) | Authentication | Life of the account |
| Two-factor secret, if you turn 2FA on | Authentication | Until 2FA is turned off |
| Country and billing address | Tax, invoicing, fraud checks | 7 years (tax) |
| Tax or VAT identifier, if you give one | Tax reporting | 7 years (tax) |
2.3 When you buy something
| Data | Why we have it | Kept for |
|---|---|---|
| Payment method token and last four digits | Recurring billing and refunds. Full card numbers are held by the payment processor, never by us. | Life of the account + 7 years (accounting) |
| Invoices, credit notes, and transaction records | Accounting and tax law | 7 years |
| IP address and user-agent at checkout | Fraud and chargeback defence | 13 months |
| Order and service configuration | To provision and support what you bought | Life of the account + 30 days |
2.4 When you sign in or use the portal
For security, we record sign-ins and account changes. This is the part of our data collection that the previous version of this policy described inaccurately, so here it is precisely:
| Data | Where it is stored | Why | Kept for |
|---|---|---|---|
| IP address and user-agent of each session | session table | Keep you signed in; detect stolen sessions | Session + 30 days |
| IP address of successful and failed sign-ins | authentication log | Detect credential-stuffing and account takeover | 90 days |
| IP address, user-agent, and a before/after record of account changes | audit log | Support you, resolve disputes, and prove what happened | 13 months |
| Actions in the admin area | audit log | Accountability for staff actions on your data | 13 months |
We do not use this data for marketing, we do not sell it, and we do not use it to build advertising profiles. We use it to keep accounts secure and to answer the question “what happened to my account?”
2.5 When you contact support
Support tickets, replies, and attachments are stored on our servers and are readable by the staff who handle the ticket. Where end-to-end encrypted messaging is enabled for a ticket, message bodies are encrypted with a key that stays in your browser and our staff cannot read them; the subject, participants, timestamps, and attachments are not end-to-end encrypted. Ticket records are kept for 3 years after the ticket is closed so we can keep a record of what we told you.
2.6 When you use the services you bought
We operate the infrastructure, so we necessarily process the data your services contain — your website files, databases, mail, and backups. Three things matter here:
- You are the controller of your own content. We process it as your processor, to run the service you bought, under the Data Processing Addendum.
- We do not read it. Staff access to customer content is restricted, logged, and only used for support you requested, to fix a fault, or where the law compels us.
- It stays yours. We claim no ownership of it and we do not use it for our own purposes, including training machine-learning models.
2.7 When you report abuse or a security issue
If you report abuse or a vulnerability we keep the report, your contact details, and our investigation notes for as long as needed to resolve it, and afterwards for 3 years to show a pattern of repeat infringement or abuse.
3. What we do not do
- We do not sell your personal information, and we have not sold it in the past 12 months.
- We do not share it with data brokers, advertising networks, or social networks.
- We do not run third-party analytics, session recording, heatmaps, or A/B testing tools.
- We do not use advertising or cross-site tracking cookies.
- We do not send marketing email to people who have not asked for it, and every marketing email has a one-click unsubscribe. Account, billing, security, and legal notices are not marketing and are sent to every account because you need them.
- We do not use your content to train machine-learning models.
- We do not use your name or logo publicly without your written permission.
4. Cookies and tracking
Our website sets no cookies at all. Your portal sets two strictly-necessary cookies, which are exempt from consent because the service cannot work without them. There are no analytics, advertising, or third-party cookies anywhere. Full details, including names and expiry, are in the Cookie Policy.
We honour the Global Privacy Control signal and browser Do-Not-Track settings: because we do not sell or share personal information for advertising, we simply have nothing to switch off.
5. Who we share data with
5.1 Service providers (processors)
We use a small number of providers to run the business. They are listed, with what each one does and where it is, at /subprocessors. Each is bound by a written agreement that limits them to processing on our instructions. The categories are: payment processing, email delivery, content delivery, DNS, and infrastructure.
5.2 Legal requirements and safety
We may disclose information where we are legally required to, or where we reasonably believe it is necessary to:
- comply with a subpoena, court order, warrant, or other lawful process;
- respond to a valid law-enforcement request, after reviewing it for legal sufficiency and, where we are permitted, telling you about it;
- report child sexual abuse material to the National Center for Missing & Exploited Children's CyberTipline, as US law requires;
- report suspected criminal activity, or comply with sanctions and export-control law;
- investigate and stop fraud, abuse, attacks, or a threat to someone's safety;
- protect our rights in a legal proceeding, or respond to a valid copyright takedown notice under our Copyright Policy.
We publish a transparency summary of the legal requests we receive, with counts, in our annual review. We do not give law enforcement direct access to customer data, and we do not build backdoors.
5.3 Business transfer
If we merge with, are acquired by, or sell substantially all of our assets to another company, your information may transfer as part of that transaction. We will tell you before your data becomes subject to a different privacy policy, and the new owner must honour the commitments in this one for data collected before the transfer.
5.4 What we never share
We do not share your content with third parties for their own marketing, we do not share customer lists, and we do not disclose who our customers are without permission.
6. How long we keep data
| Category | Retention |
|---|---|
| Website access logs | 14 days |
| Session records | Session lifetime + 30 days |
| Authentication logs | 90 days |
| Audit logs | 13 months |
| Support tickets | 3 years after closure |
| Invoices, credit notes, tax records | 7 years (required by tax law) |
| Account data (name, email, address) | Life of the account, then 30 days |
| Account content (sites, mail, files) | Until you delete it or close the account, then 30 days |
| Backups containing your content | 30 days after deletion |
| Abuse and security investigation records | 3 years |
| Marketing email subscription | Until you unsubscribe, then 30 days |
Where we can keep a record without identifying you, we de-identify instead of deleting: for example, an invoice for a closed account is kept for tax purposes with the name and address replaced by a reference.
We may keep specific records longer where there is a legal hold, an open dispute, an open investigation, or a law that requires it. If we do, we keep only what the hold requires and delete the rest.
7. Security
We take security seriously and we would rather tell you what we actually do than make vague claims:
- Encryption in transit (TLS 1.2+) on every site and API, with HSTS on the portal.
- Passwords are hashed with a memory-hard algorithm; we cannot read them.
- Two-factor authentication is available on every account and we recommend it.
- Access to production systems is limited to named staff, uses individual credentials, and is logged.
- Access to customer content requires a support reason and is itself logged.
- We patch the platform on a defined schedule and track vulnerabilities in the software we host.
- We test restores, not just backups.
No system is perfectly secure, and we cannot promise that a determined attacker will never succeed. What we do promise is in section 8.
8. If there is a breach
If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of personal data, we will:
- contain it and fix the cause;
- notify affected account holders within 72 hours of confirming the breach (and within 24 hours where credentials, payment data, or customer content are confirmed compromised);
- tell you what happened, what data was involved, what we have done, and what we recommend you do;
- notify regulators and, where required and high-risk, the affected individuals, where we are the controller;
- publish a post-incident summary once the incident is closed.
We will not delay notification to finish an investigation, and we will not describe an incident as “unauthorized access to a small number of accounts” when we know more than that.
9. Your choices and rights
You can, at any time:
- See and correct your data in your portal, under Account.
- Export your data from the portal, or by asking us. We provide account data, invoices, tickets, and a copy of your service content.
- Delete your account and data from the portal, or by asking us. We delete or de-identify within 30 days, except records we must keep for tax or legal reasons.
- Turn off marketing email with the unsubscribe link in any marketing email, or in the portal under Notifications. Account and billing notices will still be sent.
- Object to a use of your data, or ask us to restrict it, by emailing privacy@lasthourhosting.org.
We will never charge you or degrade your service for exercising a privacy right. If we need to verify your identity before acting on a request, we will ask for the minimum necessary and explain why.
10. Children
The Services are for businesses and adults. You must be at least 18 to hold an account, and the Services are not directed at anyone under 16. We do not knowingly collect personal information from a child under 16. If you believe a child has given us information, email privacy@lasthourhosting.org and we will delete it.
11. Where your data is processed
Our servers, backups, and mail infrastructure are in the United States, and that is where your account data and your content live. Two supporting services operate outside the United States:
- DNS is provided by deSEC, a non-profit based in Germany. DNS zone records (which include the hostnames in a domain's zone, including mail and verification records) are stored there.
- Content delivery is provided by Bunny.net, which caches public static files at edge locations worldwide. Your account data and the contents of your services are not stored at those edges; only publicly-requestable files are cached, and only briefly.
These arrangements are described in the Subprocessor List. For transfers from the EEA or UK to the United States, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, available in the Data Processing Addendum.
12. Changes to this policy
If we change how we handle personal data, we update this page and the date at the top. If the change is material — a new category of data, a new purpose, or a new category of recipient — we will email account holders at least 30 days before it takes effect, and where the law requires it we will ask for your consent rather than assume it.
13. How to contact us
Privacy questions, requests, and complaints: privacy@lasthourhosting.org. Post: Shiloh, LLC (Last Hour Hosting), Attn: Privacy, P.O. Box #15264, 517 America's Way, Box Elder, SD 57719, USA.
We answer privacy requests within 30 days, and we will tell you if we need longer and why. If you are not satisfied with our answer you can complain to your data protection authority (EEA/UK) or your state attorney general (US). We will not penalize you for complaining.