Privacy Policy · MenaHost

This Privacy Policy explains which personal data MenaHost (“MenaHost”, “we”, “us”) collects when you use menahost.net and our Services, why we use it, how long we keep it and what rights you have. We process personal data in accordance with Tunisian Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data and, where it applies to you, the EU General Data Protection Regulation (GDPR).

Who is responsible

MenaHost, a hosting company based in Tunisia operating the website menahost.net, is responsible for the personal data described in this policy (the “data controller”). For the content you store on your own Services (websites, game servers, bots, databases, e-mails), you are the controller and MenaHost acts only as a technical host (“processor”).

Data we collect

Account data: name, e-mail address, password (stored hashed, never readable), language, phone number and address you choose to give.
Billing data: company name, tax identifier, billing address, invoices, orders, Wallet transactions and payment references.
Top-up proofs: the transfer or D17 reference and the receipt you upload when topping up your Wallet.
Service data: the Services you order, their configuration, domain names, panel usernames (CyberPanel, Pterodactyl) and usage statistics.
Domain data: the owner (WHOIS) information required by domain registries.
Support and project data: tickets, chat messages, quotes, files and attachments you send us.
Technical data: IP address, browser and device information, login history, security events and server logs.
Linked accounts: if you sign in with Google, your Google identifier, name and verified e-mail; if you link Discord, your Discord identifier and username.
Marketing preferences: whether you agreed to receive news and offers, and when.

We do not collect bank card numbers: payments are made by bank transfer or D17 and credited to your Wallet.

Why we use your data

To provide the Services you order: create your account and panel accounts, activate, renew, suspend or terminate Services, register domains (performance of the contract).
To invoice and keep accounts: issue invoices and credit notes and keep them as required by Tunisian tax and accounting law (legal obligation).
To support you: answer tickets and project messages (performance of the contract).
To keep the platform secure: detect fraud and abuse, protect accounts, investigate incidents (legitimate interest).
To send service e-mails: order confirmations, invoices, renewal reminders, security alerts. These cannot be turned off while you have active Services.
To send news and offers, only if you agreed (consent). You can unsubscribe at any time from any e-mail or from your profile.
To improve our website and Services using aggregated, non-identifying statistics (legitimate interest).

Cookies and local storage

Essential cookies: the session cookie that keeps you signed in and the security (CSRF) cookie that protects forms. They are required for the website to work.
Preferences: your theme (dark or light) is kept in your browser’s local storage and your language in your session.
Infrastructure: our network provider (Cloudflare) may set technical cookies to protect the website against attacks.

We do not use advertising cookies and we do not sell or share your data for advertising.

Who we share data with

We never sell your personal data. We only share what is strictly necessary with:

Infrastructure providers: data centres, network and DDoS protection (Cloudflare), e-mail delivery.
Domain registries and registrars (for example ATI for .tn domains), which require owner information and may publish part of it in WHOIS according to their rules.
Sign-in and integration providers you choose to use: Google (sign-in) and Discord (account linking and role).
Software we operate to run your Services, such as CyberPanel and Pterodactyl, installed on our servers.
Accountants, auditors and legal advisers, bound by confidentiality.
Public authorities, when required by law or by a valid court order.

International transfers

Some providers (for example Cloudflare, Google or Discord) may process data outside Tunisia. We only use providers that apply appropriate security and confidentiality guarantees, and we limit the data transferred to what is necessary for the service concerned.

How long we keep data

Account data: as long as your account is open, then up to 3 years after your last activity, unless a longer period is required by law.
Invoices and accounting records: 10 years, as required by Tunisian law.
Service content (files, databases, e-mails, backups): deleted when the Service is terminated.
Support tickets and project messages: up to 3 years after they are closed.
Logs and security events: up to 12 months.
Top-up proofs: as long as needed to justify the related payment.
Marketing consent: until you withdraw it.

When an account is deleted, its identifying details are removed or anonymised, except the records we must keep by law (such as invoices).

How we protect your data

Encrypted connections (HTTPS/TLS) on the whole website.
Passwords stored with strong one-way hashing; sensitive credentials and secrets encrypted at rest.
Optional two-factor authentication on your account.
Restricted staff access based on roles, activity logs and regular backups.
Security updates and monitoring of our servers, designed by an IT and cybersecurity engineer.

No system is perfectly secure. If a data breach is likely to affect your rights, we will inform you and the competent authority as required by law.

Your rights

You can at any time:

access your personal data and obtain a copy;
correct inaccurate or incomplete data (most of it directly from your profile);
delete your data, subject to the records we must keep by law;
object to some processing, and withdraw your consent to marketing e-mails at any time;
request the portability of the data you gave us, where applicable.

To exercise these rights, open a ticket from your client area or write to [email protected]. We may ask you to prove your identity and will answer within 30 days. You can also file a complaint with the Tunisian personal data protection authority (Instance Nationale de Protection des Données Personnelles, INPDP).

Children

Our Services are intended for adults. Minors may only use them with the consent and under the supervision of a parent or legal guardian. We do not knowingly collect data from children without such consent.

Third-party websites

Our website may link to other websites (partners, panels, documentation). We are not responsible for their privacy practices; please read their own policies.

Changes to this policy

We may update this policy to reflect changes in our Services or in the law. The date of the last update is shown at the top of this page. Significant changes are announced by e-mail or in your client area.

Contact

For any question about your personal data: open a ticket from your client area or write to [email protected].