Privacy Policy

This policy explains what personal data we collect when you visit our website or use the Matrix Streamline client panel at my.matrixstreamline.com, why we collect it, who we share it with, how long we keep it and the rights you have over it. If anything here is unclear, contact us.

Who we are

Matrix Streamline is a cloud server (VPS) hosting service based in India.

We decide why and how your personal data is used, so we are its data fiduciary, as the term is used in India's Digital Personal Data Protection Act, 2023. In this policy, "we", "us" and "our" mean Matrix Streamline, and "you" means anyone who visits our website, creates an account or contacts us.

This policy covers our website, the client panel, our API, our emails and our support. It does not cover the data you store or run on your own servers: that is yours, and Data on your servers explains how we treat it. Payment gateways and other services you reach through us have their own privacy policies.

Information we collect

We collect what we need to run your account and your servers. Most of it you give us; some is recorded automatically when you use the panel.

Your account

• Your name, email address and password when you sign up. We store the password only as a one-way hash, so nobody at Matrix Streamline can read it.
• Details you choose to add: phone number, company name, billing address and GSTIN.
• Notes our staff add to your account to help with support or billing.
• If you were a customer on our earlier client panel: your account details, billing address, wallet balance and history, servers and paid invoices from it, which we carried over so that your service continues.

Billing and payments

• Your orders, invoices, payments, wallet top-ups, every credit and debit to your wallet, and any coupons you use.
• For each online payment: the amount, its status, our reference, the gateway's order and payment references, the confirmation the gateway sends us, and the IP address from which you started the payment.

You enter card, UPI or net-banking details on the payment gateway's own checkout, not on our forms. We do not receive or store your full card number, CVV, UPI PIN or banking password. The confirmation a gateway sends us may include limited details of how you paid, such as the payment method or a masked card number or UPI ID.

Your servers

• Each server's hostname, label, plan, location, operating system, IP address, status and renewal dates.
• The login username, and the password the panel sets when it builds or rebuilds a server or when you reset the password from the panel. We store this password encrypted.
• Monthly traffic totals (data in and out) and a history of actions on the server, such as start, stop, rebuild and console sessions. We record that a console session was opened, not what was typed or shown in it.

Live CPU, memory, disk and network graphs are read from the host when you open them; we do not store them.

Support and messages

The subject, department and priority of your tickets, every message in them, and the server a ticket is about if you pick one. If you email us, we receive your email address and your message. Ticket messages are also sent by email to our support team, and our replies are emailed to you.

Technical and log data

• The date, time and IP address of your last sign-in.
• An activity log of actions on your account, such as sign-ins, failed sign-in attempts, password and profile changes, orders, payments, tickets and server actions, with the IP address and browser (user agent) used. A failed sign-in records the email address that was typed. You can see your own log on the Activity page of your panel.
• If you use our API: the API keys you create, of which we store only a hash, with each key's name, permissions, allowed IP addresses and when and from which IP address it was last used; and a log of API requests showing the time, method, path, response status, duration and IP address. We do not log what you send in API requests.
• Standard web server logs of requests to our website and panel, including the IP address, the page requested, the time and the browser.

How we use your information

• To provide the service: create and manage your account, build and run your servers, give you their login details and let you control them from the panel and the API.
• For billing: raise invoices, take payments, keep your wallet balance, raise renewal invoices and send reminders around their due date, and issue GST invoices that show your billing address and, if you give it, your GSTIN.
• To keep accounts and the network safe: slow down repeated failed sign-ins, keep an audit trail of account and staff actions, prevent fraud, and investigate abuse reports under our Acceptable Use Policy.
• To support you: answer your tickets and emails, and look into problems with your servers or payments.
• To send service emails, described below.
• To meet legal obligations: keep tax and accounting records, and respond to lawful requests from authorities.
• To run the platform: find and fix errors and plan capacity.

We email you when your account is created, when you ask to reset your password, when a renewal invoice is raised, when an invoice is due or overdue, when we receive a payment, when a server is ready or rebuilt (with its login details), suspended, restored or terminated, and when our staff reply to your ticket. These emails are part of the service, so every account receives them.

We do not send newsletters or marketing emails, and we do not use your personal data for advertising. If we ever want to send you marketing emails, we will ask for your consent first.

Consent and legal basis

We process your personal data on one of two grounds:

• Your consent, which you give when you create an account or place an order after being shown this policy.
• Legitimate uses allowed by law, which do not need separate consent: for example where you give us information for a specific purpose (such as the details in a support ticket), where the law requires us to keep records (such as tax invoices), or where we must respond to a court order or a request from a government authority.

If you only browse our website without signing up, we process only the cookie and log data described in this policy, and anything you choose to send us.

You can withdraw your consent at any time by asking us to close your account, as explained in Your rights. Withdrawal does not affect what we did before it, and we still keep the records the law requires. We cannot run or bill for servers without this data, so withdrawing consent means we stop your services and close your account. The Refund & Cancellation Policy explains what happens to any unused wallet balance.

Cookies and browser storage

We set two cookies of our own. Neither is used for tracking or advertising.

The panel also keeps a few items in your browser's own storage, such as the graph range you picked, a ticket reply you have not sent yet (removed once you send it) and the progress of an order you are watching. These stay on your device and are not sent to us.

We do not use analytics, advertising or social media cookies, and our emails do not contain tracking pixels.

Files loaded from other services

To display pages, your browser loads some files directly from other services, which receive your IP address and basic browser details with each request:

• fonts from Google Fonts, on our website and in the panel;
• styles, icons and scripts for the panel, and the server console viewer, from the jsDelivr network;
• the payment gateway's checkout script, only on the payment page for that gateway.

These services handle that data under their own privacy policies. You can block or delete cookies in your browser settings, but if you block the mtxsid cookie you will not be able to sign in.

Who we share it with

We do not sell or rent your personal data, and we do not share it with advertisers. We share it only with the parties below, and only what each needs:

• Payment gateways (currently Cashfree): when you pay online, we send the gateway your name, email address, phone number (if you gave one), the amount and our payment reference. The gateway collects your payment details directly and handles them under its own terms.
• Our email delivery provider: the name and email address of each recipient and the content of our emails, including the server login details in the Server ready and Rebuild complete emails.
• Infrastructure providers: companies that supply the data-centre space, hardware, network connectivity or hosting on which our panel and your servers run.
• Professional advisers, such as accountants, auditors and lawyers, when they need it to advise us or to prepare our accounts and tax filings.
• Authorities: courts, police, tax authorities and other government agencies, when the law requires it or we receive a valid legal order, and when it is needed to protect our customers, our network or the public from fraud or harm. For example, details of business invoices that carry a GSTIN are reported in our GST returns.
• A new owner: if our business or its assets are sold or merged, your data may pass to the new owner, who must use it in line with this policy.

Our staff can see the account, billing, ticket and server information in the panel, including the server passwords the panel sets, so that they can support you and run the service.

Where your data is stored

Our panel, its database and its backups run on servers we operate or rent. Your servers run in the location you choose when you order. Some of the providers above, such as payment gateways and email and font services, may store or process data outside India under their own terms.

How long we keep it

We keep personal data only as long as we need it for the purposes in this policy, or longer where the law requires. An automatic clean-up runs every day.

Deleting your account

You can ask us to delete your account by opening a ticket or by emailing us from the address on your account. Any servers you still have must be terminated first, which permanently erases their disks.

We then delete your account and the data linked to it from the panel, including your profile, servers, orders, tickets, wallet history and API keys. We keep only the invoices and payment records the law requires, for as long as it requires. Copies in our database backups expire within 14 days, and activity log entries within 180 days.

Ask for any unused wallet balance to be refunded before your account is closed; the Refund & Cancellation Policy explains how.

How we protect it

• Account passwords are stored only as a one-way hash (bcrypt).
• After 6 failed sign-in attempts in the same browser session, further attempts from it are paused for 15 minutes, and each successful sign-in starts a fresh session.
• Every form that changes something in your account is protected against cross-site request forgery.
• Server passwords, and the passwords and keys we use to connect to our hosts, payment gateways and email provider, are stored encrypted with AES-256.
• API keys are shown to you once and stored only as a hash. Keys can be read-only, limited to IP addresses you allow and set to expire, and API requests are rate-limited.
• Online payment confirmations are checked with the gateway before an invoice is marked as paid.
• Connections to our website and panel are encrypted with HTTPS.
• Only our staff can use the admin area, and staff actions on accounts and servers are recorded in an audit log.

No system is completely secure, and we cannot guarantee that data will never be lost or accessed without permission. We use reasonable safeguards and keep improving them. If a personal data breach affects you, we will tell you and the relevant authorities as Indian law requires.

What you can do

• Use a strong password that you do not use anywhere else, and keep your API keys private.
• Change your server's password after your first login, because the original one is sent to you by email.
• Keep your server's software up to date and protect it with a firewall.
• Keep your own backups. We do not back up the data on your servers.

Your rights

You have these rights over your personal data:

• Access: ask for a summary of the personal data we hold about you, what we do with it and who we have shared it with. Much of it is already in your panel: your profile, invoices, payments, tickets and activity log.
• Correction: correct, complete or update your details. You can edit your name, email address, phone number, company, billing address and GSTIN on your Profile page; ask us to change anything else.
• Erasure: ask us to delete your personal data, as described in How long we keep it. We keep only what the law requires.
• Withdraw consent: as described in Consent and legal basis.
• Grievance redressal: complain to our Grievance Officer about how we handle your personal data.
• Nominate: name another person to use these rights for you if you die or become unable to use them yourself.

How to make a request

Open a support ticket from your panel, or email support@matrixstreamline.com from the address on your account, and tell us which right you want to use. We may ask you to confirm your identity first, so that we don't give your data to the wrong person.

We acknowledge requests within 48 hours and complete them within 30 days. If you are not satisfied with our response, you can complain to the Data Protection Board of India.

Data on your servers

The files, databases, applications and other content you store or run on your servers are yours. We provide the servers; you decide what goes on them.

If you collect or process other people's personal data on your servers, such as your own customers' data, you are responsible for handling it lawfully, including the notices and consents your users need. For that data you are the data fiduciary, and we only provide the infrastructure it runs on.

We do not access the contents of your servers, except:

• when you ask us for help and give us access;
• when the law or a valid legal order requires it;
• when we need to investigate abuse or a threat to our network or other customers, as described in our Acceptable Use Policy.

The panel works inside your server only to finish its first-boot setup and, when you or our support team ask for it, to set a new password or apply network settings. It does not read your files.

Our staff can see the password the panel set for your server. If you change the password from inside the server, the panel no longer knows it.

We do not back up your servers. A rebuild erases the server's disk. Termination deletes the server and its disks permanently and returns its IP address to our pool, where it may later be given to another customer. If a renewal invoice is not paid, the server is suspended more than 3 days after the due date and terminated more than 14 days after the due date, as set out in our Terms of Service.

Children

Our services are for adults and businesses. You must be at least 18 years old to create an account, and by creating one you confirm that you are. We do not knowingly collect personal data from anyone under 18.

If you believe a child has given us personal data, contact us and we will close the account and delete the data, except any records the law requires us to keep.

Changes to this policy

We may update this policy when our service or the law changes. The date at the top of this page shows when it was last updated. If a change significantly affects how we use your personal data, we will email you before it takes effect, and where the change needs your fresh consent, we will ask for it.

Grievance Officer

If you have a question or a complaint about this policy or about how we handle your personal data, contact our Grievance Officer:

We acknowledge every grievance within 48 hours and resolve it within 30 days of receiving it.

Please write from the email address on your account and include the number of any server, invoice or ticket your complaint is about. For anything else, see our Contact page.