Last updated: July 30, 2026

1. Overview

This Privacy Policy explains how Xponzy Tech LLC ("Xponzy," "we," "us," or "our") collects, uses, shares, and protects personal information when you visit xponzy.com, create an account in our client portal, or use our services, including web hosting, domain registration and management, business email, email migration, DNS management, email security, web development, technical support, and managed IT services. It also describes the rights you have over your personal information and how to exercise them.

For personal data contained in the content that you host, store, or transmit through our services (for example, the files of your website or the mailboxes of your organization), we generally act as a service provider or processor on your behalf. That processing is governed by our Data Processing Agreement in addition to this Policy.

2. Information We Collect

2.1 Account information

When you register, we collect the information needed to create and manage your account, such as your name, company name, postal address, country, and the credentials you choose. Keeping this information accurate is necessary for billing and for domain registration records.

2.2 Billing information

We collect order history, invoices, and payment status through our WHMCS-based client portal. Card payments are processed by Stripe and PayPal payments by PayPal; these processors receive your payment details directly, and we do not store full payment card numbers on our own systems. We may retain limited payment metadata, such as transaction identifiers, the payment method type, and the last digits of a card, for reconciliation and fraud prevention.

2.3 Support communications

When you open a ticket through our support portal or write to us through the contact form, we collect the content of your messages, attachments you choose to provide, and related metadata, so that we can respond and keep a record of the interaction.

2.4 Technical logs

Our systems automatically record technical data such as IP addresses, browser and device information, request timestamps, pages visited, error events, and authentication activity. We use this data to operate, secure, and troubleshoot the services.

2.5 Cookies and similar technologies

We use cookies to keep sessions active in the client portal, remember preferences such as language, and, where enabled, measure site usage. Details are provided in our Cookie Policy.

2.6 Content processed on your behalf

Websites, databases, email messages, and other data that you place on our infrastructure may contain personal data of your own customers or users. You control that data; we process it only to provide the contracted services.

3. How We Use Information

  • To provide, configure, and maintain the services you order, including provisioning hosting accounts, registering domains, and performing migrations;
  • To manage billing, invoicing, renewals, and collections through our client portal;
  • To respond to support requests and provide technical assistance;
  • To secure our systems, prevent fraud and abuse, and enforce our Terms of Service and Acceptable Use Policy;
  • To send service communications, such as invoices, renewal reminders, maintenance notices, and security alerts;
  • To send marketing communications where permitted, which you can opt out of at any time;
  • To comply with legal obligations, including tax, accounting, and lawful requests from authorities;
  • To analyze and improve our website and services in aggregate form.

4. Legal Bases for Processing

Where the General Data Protection Regulation (GDPR) or similar laws apply, we rely on the following legal bases:

  • Performance of a contract: most processing is necessary to provide the services you have ordered and to manage your account.
  • Legitimate interests: securing our infrastructure, preventing fraud and abuse, improving our services, and defending legal claims, balanced against your rights and expectations.
  • Legal obligation: retaining billing records for tax and accounting purposes and responding to lawful requests.
  • Consent: for optional cookies, analytics where required, and marketing communications; you may withdraw consent at any time without affecting prior processing.

5. How We Share Information

We do not sell personal information. We share it only as described below:

  • Payment processors: Stripe and PayPal process payments under their own terms and privacy practices.
  • Infrastructure providers: data center, server, network, and backup providers that host the systems on which the services run.
  • Domain registries and registrars: registering a domain requires transmitting registrant contact data to the sponsoring registrar and the applicable registry, subject to ICANN and registry policies.
  • Software and tooling vendors: providers of the platforms we use to operate the business, such as our billing and support system.
  • Professional advisors: accountants, auditors, and legal counsel, under confidentiality obligations.
  • Legal requirements: when required by law, court order, or a competent authority, or when necessary to protect the rights, safety, or property of Xponzy, our clients, or the public.
  • Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Policy or an equivalent standard of protection.

6. Data Retention

We retain personal information for as long as your account is active and as needed to provide the services. After termination, we retain data only as necessary to meet legal, tax, and accounting obligations, resolve disputes, and enforce agreements. As a general guideline, billing records are kept for the period required by applicable tax law, support tickets are kept while they remain relevant to the service relationship, and technical logs are kept for shorter periods appropriate to security and troubleshooting. Content hosted on terminated services is deleted after a reasonable grace period, as described in our Terms of Service.

7. Your Rights

Depending on your location, you may have the right to:

  • Access the personal information we hold about you and obtain a copy;
  • Rectify inaccurate or incomplete information;
  • Request deletion of your information, subject to legal retention requirements;
  • Receive your information in a portable, machine-readable format;
  • Object to or request restriction of certain processing;
  • Withdraw consent where processing is based on consent;
  • Lodge a complaint with a data protection supervisory authority in your jurisdiction.

You can exercise most of these rights directly in the client portal, where you can review and update your account details. For other requests, contact us through our contact form at https://xponzy.com/contact.php or open a ticket at https://xponzy.com/submitticket.php. We may need to verify your identity before acting on a request, and we will respond within the timeframes required by applicable law.

8. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act, as amended (CCPA/CPRA), gives you rights to know what personal information we collect, to access and delete it, to correct inaccurate information, and to not be discriminated against for exercising those rights. We do not sell personal information and do not share it for cross-context behavioral advertising. To submit a request, use the contact methods listed above; we will verify and respond as the law requires. You may designate an authorized agent to act on your behalf, subject to verification.

9. International Transfers

Xponzy is based in the United States, and information we collect is processed in the United States and in the countries where our service providers operate. Where we transfer personal data originating from the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, together with supplementary measures where needed.

10. Security

We apply technical and organizational measures appropriate to the nature of the data we handle, including encryption in transit using TLS, access controls based on least privilege, daily backups, monitoring, and timely application of security patches. These measures are described further in our Security Policy. No system is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to respond quickly to incidents. If we become aware of a breach affecting your personal data, we will notify you and the competent authorities as required by applicable law.

11. Children

Our services are intended for businesses and for adults. They are not directed to children under sixteen, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, please contact us and we will delete it.

12. Third-Party Services

Our services may interoperate with third-party products, such as Google Workspace, available at workspace.google.com. When you use a third-party product, its provider processes your data under its own privacy policy, which we encourage you to review. Xponzy is not responsible for the privacy practices of third parties.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The current version, with its effective date, will always be published on this page. If we make material changes, we will provide notice through the client portal or by other reasonable means before they take effect.

14. Contact

For privacy questions or to exercise your rights, please reach us through our contact form at https://xponzy.com/contact.php. For account-related matters, you may also open a ticket at https://xponzy.com/submitticket.php.