Privacy Policy
This policy explains how CodeOn Hostings ("CodeOn", "we", "us") handles personal information when you use our website, order services through the client area, manage servers through the control panel, or contact our support community. We collect the minimum we need to provide hosting and support — we do not sell personal information, and this website runs no advertising or tracking scripts.
Legal context. This document is written with the Sri Lankan Personal Data Protection Act No. 9 of 2022 in mind.
1. What we collect and why
Account and billing information. When you order, the client area records your name (or the name you register under), email address, billing address and order history. We use it to create your account, deliver the service, invoice you and keep required records of transactions.
Payment information. Payments are processed at checkout by the payment channels enabled on your order screen; we do not receive or store your full card number. Payment processing is handled at checkout by the processors enabled on your order — currently Visa/Mastercard card processing, PayHere, Genie, PayPal, Sri Lankan bank-transfer reconciliation and cryptocurrency (USDT/BTC) where offered. CodeOn stores only the transaction record — amount, currency, reference, status and the email on the order — and never your full card number.
Support communications. If you contact us on Discord, through client-area tickets or by email (support@codeon.lk), we keep the correspondence and whatever details you choose to share so that we can help you and follow up correctly.
Technical logs and hosting data. To keep the platform working and secure we process technical information such as IP addresses, connection data required to route your service, and records necessary to investigate abuse or attacks. Customers and server owners are themselves responsible for any logs or player data stored on their own hosted services; if your server collects other people's data, handle it lawfully and consult this policy plus your own obligations where relevant.
Site interactions. The public website itself sets no cookies of its own and runs no analytics; the external requests it makes are limited to web fonts, media assets, the Trustpilot reviews widget on the home page, and the directory listing badges in the footer (Twelve Tools and WHTop) — see the Cookie Policy.
2. Purposes of processing
- providing and operating the hosting service you ordered, including provisioning, panel access and technical maintenance;
- billing, invoicing and preventing payment fraud;
- supporting you through Discord, tickets and email;
- detecting, investigating and responding to abuse, attacks and violations of our Acceptable Use Policy;
- meeting obligations that are legally required of us, and defending legitimate claims;
- We do not send product or marketing communications; nothing in the current setup supports newsletters or campaigns. If that ever changes, this policy is updated first.
3. Third-party service providers
We rely on a small number of providers to operate, including our billing platform (billing.codeon.lk), our control panel, infrastructure and network providers that host the physical or virtual machines behind your services, and payment processors. Each provider processes data only as needed to deliver its function.
- Named providers: Cloudflare (edge security and delivery for codeon.lk and its subdomains), the Pterodactyl control panel (control.codeon.lk), the client-area billing platform (billing.codeon.lk), and the payment processors named in section 1. The infrastructure behind your services is operated by Codeon Technologies Ltd.
- Where your data is processed on infrastructure outside Sri Lanka (the node locations published on our service pages), that processing happens because it is necessary to deliver the service you ordered — the ground the PDPA recognises for contract performance — under the safeguards described in this policy.
We do not share your personal information with advertisers, and we do not sell it.
4. Retention
- Account and billing records are kept while your account is active and for as long as needed to meet accounting record-keeping obligations. After account closure, hosted data follows the Terms' deletion window (kept at least 7 days, permanently deleted no later than 30 days); account and billing records are kept only as long as Sri Lankan accounting and tax record-keeping rules require.
- Support conversations are kept while they may still be useful for helping you, then in line with the retention schedule above.
- Technical and abuse-investigation logs are kept for the period necessary for security purposes — currently up to 89 days, after which they are deleted or aggregated.
- Content on your own hosted service (worlds, files, databases) is yours; it follows the data-handling rules in the Terms of Service, including deletion after termination.
5. Security
We protect personal information with measures appropriate to its sensitivity: restricted access, credentials that only authorised staff hold, encrypted transport where applicable, and a defined process for handling security reports (see Abuse & Security Reporting). No hosting provider can guarantee perfect security, and we will communicate what happened, honestly and promptly, if something goes wrong — without undue delay, and in plain language.
6. Your rights
- Subject to applicable law, you may ask for access to the personal information we hold about you, request correction, request erasure where lawful, and object to certain processing.
- To exercise any right, contact us through the routes in Contact & Support or by email to support@codeon.lk. We treat these requests in the order received and may ask you to verify identity from your account details first.
- If you are unhappy with how we handle your request or your data, you may complain to us first (support@codeon.lk), and under Sri Lanka's Personal Data Protection Act No. 9 of 2022 you may take a complaint to the Data Protection Authority of Sri Lanka.
7. Children
Accounts are for people aged 13 or over; under-18 accounts require a parent or legal guardian to open and hold the account, with their consent and supervision. Game servers we host are frequently played by people under 18, so the privacy of younger players is partly in your hands: if you run a community server, publish your own rules for children's participation and data. The consent mechanism is the account itself: a parent or legal guardian opens and holds the account, with their own payment details.
8. Changes to this policy
We will update this policy as our services and providers change, and announce substantive changes in advance through the client area or Discord. The date above marks the most recent revision of this policy.
9. Contact
Privacy questions and data requests go to the routes on the Contact & Support page: Discord community, client-area tickets, or email to support@codeon.lk. There is no separately named privacy officer — privacy requests are handled by the same team through those routes.