US State Privacy Notice
Last updated: October 27th, 2026
This notice is for residents of US states with comprehensive consumer privacy laws, including California (CCPA/CPRA), Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. It supplements our Privacy Policy, and where the two differ, this notice controls for you.
1. Categories of personal information we collect
| Category | Examples | Collected | Sources |
|---|---|---|---|
| Identifiers | Name, email address, postal address, IP address, account ID | Yes | You; your browser |
| Commercial information | Services purchased, invoices, payment history | Yes | You; our payment processor |
| Internet or network activity | Sign-in records, device and browser, pages requested | Yes | Your browser |
| Professional information | Company name, business address, tax ID | Yes | You |
| Financial information | Payment method token, last four digits | Yes (token only; we never hold a full card number) | You; our payment processor |
| Customer content | Data you store in the services you buy | Yes, as your processor | You |
| Inferences | Fraud risk signals derived from the above | Yes | Derived from the above |
| Government identifiers | SSN, driver's licence number | No | — |
| Precise geolocation | GPS coordinates | No | — |
| Biometric information | Fingerprint, face geometry | No | — |
| Health information | Diagnosis, treatment records | No, unless you have a signed BAA | — |
| Education information | Student records under FERPA | No | — |
| Characteristics of protected classes | Race, religion, sexual orientation | No | — |
| Audio, visual, or similar | Call recordings, video | No | — |
2. How we use it
We use personal information only for these business purposes:
- providing, maintaining, and supporting the services you bought;
- billing, invoicing, tax reporting, and collections;
- authenticating you and securing your account;
- detecting and preventing fraud, abuse, and security incidents;
- responding to your support requests and communicating about your account;
- complying with law and responding to lawful process;
- debugging and improving our own systems, using aggregated or de-identified data;
- as you direct or with your consent.
We do not use personal information for targeted advertising, and we do not use sensitive personal information for any purpose other than providing the services and security.
3. Disclosures
In the past 12 months we disclosed the categories above only to our service providers (payment processing, email delivery, content delivery, DNS, and infrastructure), under contracts that restrict them to acting on our instructions. The current list is at /subprocessors.
4. Sale, sharing, and targeted advertising
We do not sell personal information, and we have not sold it in the past 12 months. We do not share personal information for cross-context behavioural advertising, and we do not process it for targeted advertising. We do not knowingly sell or share the personal information of consumers under 16.
Because we do not sell or share personal information, there is no “Do Not Sell or Share My Personal Information” link to provide — there is nothing to opt out of. We still honour Global Privacy Control signals.
5. Sensitive personal information
We do not collect sensitive personal information as defined by CPRA (government identifiers, precise geolocation, racial or ethnic origin, religion, health, sex life, biometric data, or contents of communications we are not a party to) except where you ask us to store it inside a service you bought, in which case we hold it as your processor and use it only to run that service. We do not use or disclose it to infer characteristics about you.
6. Your rights
| Right | What it means | How to exercise it |
|---|---|---|
| Know / access | Confirm what we hold and get a copy | Portal, or email us |
| Correct | Fix inaccurate personal information | Portal (self-service), or email us |
| Delete | Have your personal information deleted | Portal, or email us |
| Portability | Get a machine-readable copy of what you gave us | Portal export, or email us |
| Opt out of sale or sharing | Not applicable — we do neither | — |
| Limit use of sensitive data | Not applicable — we do not use it | — |
| Non-discrimination | No penalty for exercising a right | — |
| Opt out of profiling | We do not profile you for decisions with legal effects | — |
| Authorized agent | Someone can act for you with written permission | Email us a signed authorization |
Email privacy@lasthourhosting.org or use your portal. We respond within 45 days, and we will tell you if we need the 45-day extension the law allows and why. We may verify your identity by asking you to confirm control of the account email address; we ask for the minimum necessary.
7. Retention
The retention periods for each category are in section 6 of our Privacy Policy.
8. Notice at collection
When we collect personal information we tell you at that point what we are collecting and why. The tables in this notice and in our Privacy Policy are that notice, given in advance of collection.
9. Children
Our services are for adults and businesses. We do not knowingly collect the personal information of anyone under 16. If you are under 18, do not post personal information anywhere in our services.
10. Changes and contact
We will post any change here and update the date. For questions or to appeal a refusal of a request, email privacy@lasthourhosting.org. You may also contact your state attorney general.