Privacy Policy

Iron Balkans is the data controller for the limited information processed through the Services. You can contact us about privacy matters at [email protected] or Telegram (@ironbalkans).

We do not encrypt your VM disks. You are free, and encouraged, to encrypt sensitive data yourself.

We do not inspect or modify the data on your server's disk without your explicit permission, unless we are legally compelled to. When alerted by a complaint, we may, however, check public services you expose from your Service, such as an FTP or HTTP server, in order to investigate the report.

To create and use an account, we do not require and do not collect:

• Your name, physical address or phone number.
• Any government-issued identity document or KYC verification.
• Advertising identifiers or data from third-party advertising or analytics trackers.

We only store data that is essential to provide and improve the Services, keep them secure, and meet our legal obligations:

Account information

A securely hashed password (using a modern algorithm such as Argon2) and a hash of your recovery key, plus any contact details you choose to provide, such as an email address, Matrix username or Telegram handle.

Services and configuration

The data you store on your Services, and configuration details such as assigned IP addresses (including a history of past assignments), subdomains and authorised SSH keys.

Transactional data

A history of your transactions, payments, service renewals and account-balance changes. For cryptocurrency deposits we store the details needed to confirm the payment. Public blockchains such as Bitcoin and Litecoin are outside our control; Monero is recommended where on-chain privacy matters to you.

Security and technical logs

Connection information, IP addresses and event logs, retained for a limited period to secure the platform, prevent and investigate abuse, and troubleshoot problems.

Support communications

Any information you voluntarily provide when you contact us by email or Telegram. Please do not send passwords, recovery keys, cryptocurrency seed phrases or unnecessary personal data.

We use only the minimal browser storage (such as localStorage) required for essential functionality, for example to keep you signed in to the control panel. We do not use cookies for tracking or analytics, and fonts are self-hosted so your browser does not make requests to third-party font or CDN providers.

• To provide, maintain and provision your Services.
• To process cryptocurrency payments and manage your account balance.
• To secure our network and to prevent, detect and investigate abuse and fraud.
• To respond to your support requests.
• To comply with legal obligations that apply to us under Romanian and EU law.

Where the General Data Protection Regulation applies, we rely on performance of our contract with you (to deliver the Services), our legitimate interests (to secure our network and prevent abuse), and compliance with a legal obligation.

We do not sell your data and do not disclose customer information outside IronBalkans unless required by law or approved by you beforehand. Limited sharing occurs only where necessary:

• With infrastructure and data-centre providers, strictly to the extent necessary to operate the Services.
• With authorities, only in response to valid legal process under Romanian law. We do not automatically comply with foreign requests.

Our infrastructure is located in Romania, within the European Union, and data is primarily processed within the EU.

We keep account and service data while your account is active and for a limited period afterwards, as necessary to meet legal, accounting and abuse-prevention obligations. Security and connection logs are retained for a limited period and then deleted or anonymised.

We apply technical and organisational measures to protect information, including encryption of traffic in transit and hashing of authentication credentials. Our servers use disk redundancy (such as RAID6 or RAID10), which reduces the risk of hardware-related loss but is not a backup. No system is perfectly secure, and you remain responsible for safeguarding your password and recovery key, which are essential to protecting your account.

Where the GDPR applies, you have rights to access, rectification, erasure, restriction, objection and portability regarding your personal data.

Please note a practical limitation that follows from our privacy-first design: because accounts are anonymous, we often cannot identify you or link data to a real-world identity, and we cannot verify who you are without your account credentials. Exercising certain rights may therefore require you to authenticate with your account.

The Services are intended for adults and are not directed to children. We do not knowingly provide services to minors.

We may update this Privacy Policy from time to time. Active customers will receive at least 7 days of notice before any significant change takes effect. The date of the latest revision is shown at the top of this page.

For any privacy question or request, contact us at [email protected] or Telegram (@ironbalkans).