Privacy policy

Last updated: 16 October 2026.

This policy explains how Serverary SIA, registration No. 40203789294 ("Serverary"), processes personal data when a person creates an account, orders a service, contacts support, or uses Serverary's website. The terms and conditions are published with this policy. Privacy requests: support@serverary.com.

1. Controller

Serverary SIA is the controller. Serverary has not appointed a data protection officer. For an organisation of this size and activity, that appointment is not required. Requests concerning personal data should be sent to support@serverary.com.

2. Data we process

• Account data: name, organisation, postal address, email address, telephone number, and the credential used to sign in.
• Billing data: invoices, payments, currency, and the payment reference returned by the payment provider. Full card numbers are processed by the payment provider and are not stored by Serverary.
• Support data: tickets, attachments, and correspondence with the support department.
• Service data: the services ordered, addresses assigned to a service, and the technical records required to provide and secure that service.
• Technical data: IP address, browser type, and the session cookie used to keep a person signed in.

3. Purposes and legal bases

• Contract: to open the account, provide the service, invoice, and respond to support requests.
• Legal obligation: to retain the accounting and tax records required by Latvian law.
• Legitimate interests: to secure the platform, prevent fraud and abuse, and keep a record of a dispute. The processing is limited to the operation and protection of the service.
• Consent: for optional marketing email. That choice is unticked on the registration form. Consent may be withdrawn at any time by email to support@serverary.com, or from the client area. Withdrawal does not affect the service.

4. Human verification

Registration and sign-in forms use Cloudflare Turnstile to reject automated abuse. The check is used for security only. It is not used for advertising. Cloudflare processes the technical data required to complete the check, under Cloudflare's data-processing terms.

5. Cookies

Serverary uses a session cookie that is strictly necessary to keep a person signed in and to submit forms. It is not an advertising cookie, and no separate consent is required for it. Serverary does not use advertising cookies on its website or client area.

6. Recipients

• Zoho, which hosts the support mailbox in the European Union.
• Stripe, which processes card payments. Stripe may process data in the European Union and in the United States under its data-processing terms and, where required, standard contractual clauses.
• Revolut, which provides hosted payment checkout in the European Union.
• OVH, which hosts the billing system in Warsaw.
• Cloudflare, which provides DNS for serverary.com and the Turnstile check described above. The billing hostname is not proxied through Cloudflare.
• The infrastructure provider that hosts a customer virtual server, where that product is supplied. That provider processes the technical data required to run the server.

Serverary may also disclose personal data where the law requires it, or where disclosure is necessary to establish or defend a legal claim.

7. Retention

• Account data is kept for the life of the account and for up to 24 months afterwards, unless a longer period is required for a claim or by law.
• Invoices and accounting records are kept for at least 5 years, and for up to 10 years where Latvian accounting or tax law requires the longer period.
• Support tickets are kept for the life of the account and for 24 months after the last message, unless a dispute requires a longer period.
• Security logs on the billing system are kept for up to 12 months.
• Marketing records are kept until consent is withdrawn, after which Serverary retains only a suppression record so that the message is not sent again.

8. Rights

A person may request access, rectification, erasure, restriction, or a copy of their personal data, and may object to processing based on legitimate interests. Where processing is based on consent, that consent may be withdrawn. Serverary may need to confirm identity before acting on a request. Data that must be retained for an invoice, or while a service remains active, cannot be erased on request.

A complaint may be made to the Latvian supervisory authority, Datu valsts inspekcija (pasts@dvi.gov.lv, www.dvi.gov.lv). A person in another European Union country may also complain to the authority in the country where they live.

9. Children

The service is not directed at children under 16. Serverary does not knowingly open an account for a child.

10. Changes

Serverary will publish changes to this policy and, where a change materially affects customers, will send notice by email before the change takes effect.