1. Scope and effective date
This policy takes effect on October 10, 2026. It applies to personal information involved when you visit the VpsHold website, create an account, rent a dedicated physical Mac mini, manage orders, or contact us for support. The service provides physical cloud Mac machines, not virtual machines. This policy distinguishes between information used to manage the service and data you store on your machine.
Service management information includes your account email address, order records, payment summaries, and console access logs. Data on your machine includes code, build artifacts, project assets, certificates, and other files you upload. We handle the former under this policy. You decide what the latter contains, who can access it, and how it is backed up. See Section 4 for what happens when a rental ends.
This policy does not replace your responsibility for managing data related to project members, code repositories, or software you install. Privacy matters are governed by the laws of the jurisdiction where the platform operator is based. Any related disputes will be handled by a court with jurisdiction in that jurisdiction. The location of a machine identifies where the service and data are hosted; it does not determine which laws apply.
2. Information we collect
When you create and use an account, we handle the email address you provide and information needed to verify your account, sign you in, and manage the service. Order records include the machine and node you select, rental term, add-ons, order status, and amount charged. If you contact support, we may also handle any machine ID, issue description, or diagnostic materials you choose to provide.
We accept payment only via USDT-TRC20 and Visa / Mastercard / Amex (through Stripe), and all payments are settled in US dollars. We record the transaction hash needed to reconcile a USDT payment or, for card payments processed by Stripe, a payment summary, payment status, and transaction identifier. We do not store full card numbers. Do not send full card numbers, card security codes, wallet private keys, or recovery phrases by email or support ticket.
| Information | What it includes | How we handle it |
|---|---|---|
| Account email | Account contact address, verification and notification records | Used to verify your account and contact you. We do not ask for contact details unrelated to the service. |
| Order and payment records | Configuration, rental term, amount, payment status, transaction hash or card payment summary | Used to provision the service, manage renewals, and reconcile payments. We do not store full card numbers. |
| Console access logs | Access times, source IP addresses, browser details, requests, and actions | Used for security checks and troubleshooting. We do not collect files on your machine as access logs. |
| Support materials | Issue descriptions, log excerpts, and screenshots you submit | Used only to handle the related request. Remove passwords, tokens, and unrelated personal information before submitting. |
When you visit the website or console, the system generates access and security logs. These logs help us check whether requests are working normally, identify unusual account activity, and locate faults. They are not used to read your project files. Diagnostic attachments you choose to submit may contain personal information, so please redact them first and include only what is needed to explain the issue.
3. How we use information
To provision a machine, we link your account and order to the physical node you selected. We use this information to activate the service, provide connection details, manage your rental term, process renewals and cancellations, and send order-related notifications to your account email. Connection credentials are sensitive and are never displayed on public pages.
We use order and payment records to confirm receipt of payment, create billing records, resolve payment status discrepancies, and carry out necessary financial checks. Access logs help identify unusual sign-ins, repeated failed requests, and other security risks, and help us troubleshoot console access issues. Support materials help us investigate the issue you report; submitting a support ticket does not give us ongoing access to your machine's contents.
We handle information only as needed to provide the service, fulfil orders, protect account security, and meet necessary obligations. We do not sell account information to third parties. If we plan to use information for a different purpose, we will explain that purpose and your options first. Where your consent is required, continued use of the service will not be treated as explicit consent.
4. Data on your machine
We do not access files on your machine or include code repositories, build artifacts, model assets, or certificates in website analytics. You can use the macOS graphical interface and command line on your dedicated machine, and manage its system accounts, file permissions, and development tools yourself. If you share a development machine, give each member separate permissions and avoid storing personal credentials in shared directories.
When a machine is reclaimed, we erase its disk before assigning it to someone else. Files from the previous user are not passed on to the next user. Disk erasure and deletion of account records are separate processes: reclaiming a machine handles the data stored on it, while necessary order, payment, and security records are retained in line with Section 5.
Back up your files before your rental ends or you request cancellation, and revoke any repository tokens, CI runner credentials, or other access permissions used on the machine. Do not rely on recovery after a machine has been reclaimed. If you need help investigating a file-related issue, choose and submit only the necessary excerpts. We will not ask you to send an entire project, passwords, or a complete signing private key.
5. Storage and retention
Data on your machine is stored at the node you select. VpsHold offers five node locations: Singapore, Tokyo, Seoul, Hong Kong, and the eastern United States. Your choice determines where your machine data is stored. Account, order, and support records are held in service management systems, so the machine's location alone does not tell you where all of those records are stored.
Files on your machine remain there until the service ends and the machine is reclaimed. We erase the disk before assigning it again. We retain account details for as long as needed to manage your account and related services. Order and payment records are retained as needed for reconciliation, dispute handling, and applicable retention obligations. Access and security logs are kept for as long as needed to investigate issues and manage security risks, not indefinitely as a matter of routine.
Different records may have different retention requirements, so we do not promise to delete all data on the same date. When we receive a deletion request, we check for active orders, outstanding payment reconciliation, or necessary retention obligations, then explain what can be deleted and which categories must be kept for now. To ask about the retention period for a specific record or where a management system stores data, contact us using the details in Section 9.
6. Third-party processors
Stripe processes card payments. When you pay, the information needed for that payment, including the amount and transaction identifier, is handled through the relevant payment flow. We receive the payment result and summary needed to fulfil your order, but do not store full card numbers. We use USDT-TRC20 transaction hashes to verify payments. Public on-chain records cannot be removed by deleting your VpsHold account.
Providing the service also involves necessary processing by node infrastructure, email delivery, and service systems. We share relevant information only as needed to fulfil orders, send service notifications, protect security, or meet necessary obligations. Access is limited according to each processor's role; we do not give them complete account records unrelated to your order.
Taking part in service delivery does not give a processor permission to use your data freely. If you want to know which processors handle a category of information, what they receive, or how information is handled across regions, tell us the relevant order or information category and we will provide details we can verify. You choose any code hosting, CI, or other tools you connect, and should check their data flows separately.
7. Cookies and analytics
The website and console use necessary cookies or similar storage to keep you signed in, verify requests, and remember essential interface preferences. If you disable this storage, sign-in or account actions may not work properly. We do not put files from your machine, connection passwords, or payment card information into website analytics.
Website analytics are processed through a same-domain endpoint to help us understand page visits, referral sources, and whether key actions are working smoothly. Analytics serve a different purpose from order fulfilment records. Non-essential analytics are not required to provision a machine. Analytics data is handled according to this policy's purposes and retention principles and is not used to sell personal information.
You can view, clear, or restrict site cookies and local storage in your browser. Clearing sign-in data may require you to sign in again. To ask what information analytics uses or request that non-essential processing stop, contact our support email. Deleting browser cookies does not delete your account, order, or payment records.
8. Your rights
You can ask to access account-related information we hold, correct inaccurate details, export records we can provide, or delete information we no longer need to retain. Submit a support ticket through the signed-in console or email us from your account address. Please specify the type of request, the information involved, and any relevant order number. Do not include passwords or payment keys.
To make sure we do not disclose information to someone else, we will verify your connection to the account. We will request only the information needed to handle your request. If we cannot confirm your identity, we will explain what additional information is needed rather than exporting or deleting data immediately. Exporting service management records does not mean exporting your entire machine; back up your project files yourself while you still have access to the machine.
If you have an active service, a payment under review, or a necessary retention obligation, we may need to handle some deletion requests in stages. We will explain what can be deleted, which categories must still be retained, and why. You can also ask us to clarify the outcome. We will not require you to buy the service again because you made a reasonable privacy request.
9. Contact and policy updates
Send privacy questions, data rights requests, and security reports to support@vpshold.com, or sign in to the console and submit a support ticket. For questions about an existing order, include its order number and machine ID. Do not send connection passwords, access tokens, or complete certificate private keys in public email.
We will review the relevant records based on your request and, if needed, ask you for more information through the original channel. Use a subject such as “Privacy inquiry”, “Correction request”, “Data export”, or “Deletion request”, and describe what you want us to handle. Support tickets let you track progress, while email lets you contact us without signing in; both are official contact channels.
Updates to this policy will be posted on this page with a new version and effective date. We will notify you by account email or through the console of significant changes to information use, processing scope, or your rights. If renewed consent is required, we will provide a clear choice. You can keep a copy of this page to compare versions or ask us how a particular change affects an existing service.