Legal

Privacy & Cookie Policy

This Policy explains what information SCComp collects, how and why we use it, when it may be disclosed, how long it may be kept, and the choices available to customers and visitors.

Effective and last updated: September 29, 2026

Your cookie choice

Reset the preference stored in this browser to display the cookie notice again.

Policy overview

This Policy applies to SCComp websites, accounts, customer panels, ordering, billing, support, hosting, VPS, bare metal, colocation, hardware, partner features, and related services. It does not govern third-party services or customer-controlled applications hosted on our infrastructure.

Who we are
Information we collect
Sources of information
How we use information
Legal bases
How we disclose information
Payments and sensitive information
Cookies and browser storage
Communications
Customer content and infrastructure data
Retention
Security
Your choices and privacy requests
Regional privacy rights
Children
International processing
Third-party links
Changes
Contact
Supplemental privacy disclosures

1. Who we are

SCComp Infrastructure LLC (“SCComp,” “we,” “us,” or “our”) is a Buffalo, New York infrastructure and hosting provider. For information covered by this Policy, SCComp generally determines why and how account, commerce, support, security, and operational information is processed.

Customers may use our infrastructure to process information for their own purposes. For customer-controlled content, the customer determines the purpose of processing and is responsible for its notices, permissions, and legal obligations. Questions about data in a customer’s website, server, or application should ordinarily be directed to that customer first.

2. Information we collect

Information you provide

Account details, including username, email address, password hash, roles, verification state, preferences, and recovery information.
Identity, organization, billing-contact, technical-contact, and abuse-contact information.
Orders, quotes, invoices, product selections, hostnames, operating-system choices, IP justification, configurations, discount codes, and transaction references.
Support tickets, sales requests, contact forms, partner submissions, colocation inventories, feedback, attachments, and correspondence.
Information supplied for fraud review, ownership verification, incidents, legal requests, shipping, or hardware transactions.
Marketing and notification preferences, survey responses, and other information you choose to submit.

Information collected through use

IP address, approximate network location, user agent, browser and device characteristics, language, referring page, requested URL, timestamps, and response details.
Authentication, session, CSRF, rate-limit, email-verification, anti-bot, authorization, and administrative audit events.
Account, panel, ordering, provisioning, console-session, power-action, ticket, billing, and preference activity.
Service identifiers, assigned addresses, resource usage, availability, performance, health, hardware inventory, network events, and security alerts.
Logs and metadata from operating systems, virtualization, storage, routing, firewall, monitoring, email, and management systems.

Information we generally do not request

Do not send us passwords, private keys, government identification, health information, or full payment-card numbers unless we specifically request information through an appropriate secure process. Payment-card entry is handled by the applicable processor; SCComp may receive transaction references, billing details, card brand, expiration information, and limited card digits, but does not need your full card number to administer an ordinary payment.

3. Sources of information

We may receive information:

Directly from you, your organization, authorized users, or someone acting on your behalf.
Automatically from browsers, devices, services, network equipment, and security systems.
From Stripe and other transaction, fraud-prevention, billing, or financial-service providers.
From Cloudflare Turnstile and similar anti-abuse or security providers when their features are used.
From facilities, upstream networks, registries, vendors, carriers, marketplaces, and service partners.
From public records, sanctions lists, abuse reports, rights holders, researchers, and lawful authorities.
From referral or partner programs when you use an associated link, code, or offering.

4. How we use information

We use information as reasonably necessary to:

Create, verify, administer, secure, support, and recover accounts.
Review orders, collect payment, issue invoices, prevent fraud, provision services, and manage the customer lifecycle.
Operate websites, hosting, virtual and physical servers, networks, storage, remote management, support, and customer tools.
Authenticate requests, enforce authorization, record administrative actions, and protect credentials and sessions.
Monitor availability and performance; diagnose faults; maintain capacity; and improve reliability, usability, and automation.
Detect, investigate, mitigate, and document abuse, compromise, malicious traffic, policy violations, and incidents.
Respond to tickets, sales inquiries, privacy requests, legal process, rights claims, and emergencies.
Send transactional, service, billing, security, policy, and eligible marketing communications.
Maintain business, tax, accounting, inventory, audit, compliance, dispute, and legal records.
Develop offerings using aggregated, de-identified, or limited operational information where practical.

We do not sell personal information for money. We do not use customer content to train general-purpose artificial-intelligence models. If either practice changes, we will update this Policy and provide any legally required notice or choice before the new practice applies.

5. Legal bases for processing

Where law requires a legal basis, we process information as necessary to perform a contract or take requested pre-contract steps; comply with legal obligations; protect vital interests; pursue legitimate interests such as security, fraud prevention, service delivery, support, improvement, and administration; or based on consent. When processing depends on consent, you may withdraw it for future processing, although prior processing remains lawful.

Our legitimate interests are balanced against the nature of the information, reasonable expectations, and available safeguards. Some information is required to provide or secure a service. Without it, we may be unable to create an account, accept payment, allocate network resources, respond to a request, or continue service safely.

We may disclose relevant information to:

Payment, billing, accounting, banking, fraud-prevention, and transaction providers.
Email, communications, anti-abuse, monitoring, software, support, and infrastructure vendors.
Datacenters, upstream carriers, address registries, domain or certificate providers, and network operators.
Shipping carriers, marketplaces, manufacturers, repair providers, and suppliers for requested transactions.
Professional advisers, auditors, insurers, financing sources, and contractors bound by appropriate duties.
Your organization, account owner, or authorized users consistent with account roles and instructions.
Rights holders, abuse desks, affected parties, incident responders, or researchers when reasonably necessary to investigate and remediate harm.
Courts, regulators, law enforcement, emergency services, or authorities when required or permitted by law.
A buyer, investor, lender, successor, or adviser in a proposed or completed merger, financing, reorganization, bankruptcy, or asset transfer, subject to appropriate safeguards.

We aim to disclose only information reasonably necessary for the purpose. Providers may process information under their own policies when they independently determine how to provide a service, such as payment networks or public authorities.

7. Payments and sensitive information

Stripe currently supports checkout, subscriptions, billing portals, and hosted invoices on the platform. Payment information submitted on Stripe-hosted interfaces is processed by Stripe under its own privacy and security terms. We receive enough information to associate payment status and transaction records with your order and account. Do not place full card numbers in SCComp forms, tickets, email, or chat.

Credentials and service secrets may be encrypted, hashed, access-controlled, or shown only through limited workflows depending on their purpose. Passwords used to authenticate an SCComp account are stored as password hashes rather than readable account passwords. No transmission or storage method can eliminate every risk.

8. Cookies and similar browser storage

We use cookies and browser storage to keep the website and panel working, maintain authenticated sessions, protect forms against cross-site request forgery, enforce security controls, remember preferences, and reduce abuse. Disabling required storage may prevent login, checkout, forms, and panel features from working.

9. Communications and preferences

We send service messages needed to administer accounts, orders, invoices, security, abuse, support, and policy changes. These are not promotional and may continue while you have an account or service. Where offered, you can manage eligible blog, product, or marketing categories through email preferences or an unsubscribe link. Opting out of marketing does not stop operational messages.

We may retain suppression records to respect an unsubscribe request. Email and support communications may include delivery events and metadata needed to route, troubleshoot, secure, and document the conversation.

10. Customer content and infrastructure data

Customer virtual machines, dedicated systems, and applications may contain information we do not routinely inspect. We process customer content when needed to provide requested support, maintain or secure infrastructure, address abuse, comply with law, or act on authorized instructions. Technical systems necessarily process traffic and metadata to route packets, deliver services, monitor health, and defend the network.

Customers are responsible for required privacy notices and choices to their users, limiting information placed on services, configuring access, and selecting lawful locations and arrangements. Do not use standard services for regulated or highly sensitive data unless SCComp has expressly agreed in writing to the required safeguards and responsibilities.

11. Retention and deletion

We retain information only as long as reasonably necessary for the purposes described here, including providing services, maintaining security and audit trails, meeting tax and accounting rules, resolving disputes, responding to abuse, enforcing agreements, and complying with law. The period varies by record type, service state, sensitivity, legal requirement, and operational need.

Account and transaction records may remain after closure for financial, fraud, legal, or dispute purposes. Security and system logs are generally retained for shorter operational periods unless an incident or legal hold requires preservation. Support records may be kept to maintain service history. Backups rotate on their own schedules, so deleted information may remain temporarily in protected backups until overwritten or securely retired.

When information is no longer needed, we take reasonable steps to delete, anonymize, aggregate, or render it inaccessible. De-identified information that cannot reasonably be linked to a person may be retained for analytics, planning, security, and improvement.

12. Security

We use administrative, technical, and physical safeguards appropriate to the Services. Measures may include access controls, password hashing, encryption for selected secrets and traffic, network segmentation, least-privilege management, logging, monitoring, patching, backups, anti-abuse controls, and documented change practices. Access is limited to personnel and providers with a legitimate operational need.

No service is perfectly secure. You are responsible for strong unique credentials, protecting recovery channels, updating software, configuring workloads, limiting administrative access, monitoring your environment, and maintaining independent backups. Report suspected compromise promptly through support.

13. Your choices and privacy requests

Depending on the information and your relationship with us, you may:

Review or update available account and contact information in the customer panel.
Manage eligible email preferences or use an unsubscribe link.
Reset the browser’s cookie choice or adjust browser storage settings.
Request access, correction, deletion, portability, restriction, or objection where applicable law provides that right.
Withdraw consent for future processing when consent is the applicable basis.
Close an account or cancel services, subject to contractual, security, financial, and legal retention requirements.

Submit a request through support or the contact information below. Describe the request and account without sending credentials. We may verify identity and authority, ask for clarification, deny or limit requests where an exception applies, and retain a record of the request. An authorized agent may act where law permits, subject to proof of authorization.

14. Regional privacy rights

Privacy rights differ by location. Subject to eligibility and exceptions, residents of some regions may have rights to know or access categories and copies of information; correct inaccuracies; delete information; obtain portable data; restrict or object to processing; opt out of certain targeted advertising, sale, sharing, or profiling; and appeal a denied request. You may also have the right to complain to a local privacy authority.

We will not unlawfully discriminate against you for exercising an applicable right. SCComp does not currently sell personal information for money. Because legal definitions vary, contact us if you believe a specific opt-out right applies to a practice not addressed by the controls in this Policy.

15. Children’s privacy

The commercial Services are not directed to children under 13, and we do not knowingly collect their personal information through those Services. A minor legally permitted to use a service must do so with parent or guardian involvement and consistent with law. If you believe a child provided information improperly, contact us so we can investigate and act appropriately.

16. International processing

SCComp operates from the United States. Information may be processed in the United States or other locations where customers, providers, networks, or support resources operate. Those locations may have different privacy laws. Where required, we use an appropriate legal mechanism and safeguards for cross-border transfers, subject to lawful government access and provider operations.

17. Third-party links and services

Our sites may link to Stripe, eBay, Discord, vendors, documentation, social platforms, partner sites, or others. Their services and privacy practices are governed by their own notices, not this Policy. A link does not mean we control or endorse every third-party practice. Review the relevant policy before providing information.

18. Changes to this Policy

We may update this Policy for service, legal, security, or operational changes. We will post the revised version and effective date here. For a material change, we may provide additional notice through the website, account, or contact information where appropriate. Earlier processing remains governed by the Policy and law applicable at that time.

19. Contact us

For privacy questions or requests, use SCComp support or email support@sccomp.us. Identify the request as a privacy matter and include the email associated with the account. Do not include passwords, private keys, or full payment-card details. You may also use our contact page for general questions.

Supplemental privacy disclosures

The following disclosures provide additional detail about particular records, systems, transactions, rights, and operational contexts. They form part of this Policy and apply when relevant to your interaction with SCComp.

A. Roles, scope, and important distinctions

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to a person or household, as defined by applicable law. It does not necessarily include lawfully de-identified, aggregated, or public information. “Account Information” concerns the customer relationship, identity, billing, and administration. “Customer Content” is material a customer chooses to process through its hosted environment. “Service Data” is operational information generated in delivering, securing, measuring, and supporting services. A single record can fall into more than one category depending on context.

SCComp generally acts as an independent business or controller for Account Information, website activity, billing, security, abuse, legal compliance, and its own operations. For personal information inside Customer Content, SCComp ordinarily acts as a service provider or processor on the customer’s instructions, to the extent those concepts apply. The customer is responsible for determining a lawful purpose, providing notices, honoring its users’ rights, and issuing appropriate instructions. This Policy does not turn SCComp into a joint controller of every workload or make SCComp responsible for a customer’s independent decisions.

B. Account and profile records

Account records may include a username, email address, contact name, organization, role, account state, verification state, communication preferences, creation time, login history, recovery events, consent or acknowledgment records, and identifiers linking the Account to Services and transactions. Passwords used for SCComp account authentication are stored as password hashes, not as readable passwords. We may record when a password, email address, role, or security-sensitive setting changes without retaining the old secret itself.

An optional profile picture may appear beside the username in customer workspaces, support tickets, and community features. A picture shown with a public documentation comment is also public. Uploaded pictures are resized and re-encoded to remove embedded metadata before storage; users can replace or remove them from Account settings.

We use Account records to authenticate users, determine authorization, deliver notices, associate orders and devices, prevent duplicate or abusive registrations, recover access, and maintain an audit trail. Providing optional profile information may improve support but is not required unless identified. Some fields cannot be freely changed because they affect ownership, billing, legal history, or security. If an organization provides or controls an Account, it may be able to access, correct, export, restrict, or delete information associated with that organizational relationship.

C. Authentication, sessions, and access logs

Authentication records may include source IP address, timestamp, user agent, session identifier, success or failure, rate-limit state, email-verification activity, logout, security token use, and relevant risk indicators. Session cookies allow the server to recognize an authenticated browser. Cross-site-request-forgery values help confirm that a form action originated from the expected session. We may invalidate sessions after logout, password or role changes, suspected compromise, maintenance, or policy enforcement.

We use these records to operate access controls, troubleshoot login problems, identify attacks, enforce limits, notify users, and investigate unauthorized activity. Repeated failures and unusual patterns may be correlated across requests or Accounts. Security logging is not a promise that every access attempt will be detected. Customers should protect their email accounts and devices because recovery and verification often depend on them. Do not share session cookies or tokens; possession may permit action as the authenticated user until expiration or revocation.

D. Orders, provisioning, and device-management information

Order records may contain product choice, requested hostname, operating system, resource selection, billing interval, price, currency, discount or affiliate code, IP justification, desired configuration, status, timestamps, and links to invoices, catalog inventory, provisioning jobs, credentials, and devices. Provisioning records may contain assigned identifiers, virtual-machine IDs, physical serial numbers, cluster node, network profile, private or public addresses, VLAN, gateway, deployment image, job attempts, validation results, and failure reasons.

We use these records to reserve capacity, prevent collisions, build and verify Services, show progress, provide support, reconcile billing, manage inventory, apply network policy, and retain an accountable history. Some information is supplied by the Customer; other information is generated by SCComp systems. Requested hostnames and labels should not contain personal, confidential, regulated, or secret information because they may appear in logs, consoles, monitoring, DNS, invoices, or administrative interfaces.

E. Credentials, keys, secrets, and recovery material

Depending on the Service, SCComp may generate, receive, encrypt, hash, display, transmit, rotate, or delete temporary passwords, API credentials, console tokens, recovery codes, SSH public keys, and similar access material. Password hashes are designed for verification without recovering the original password. Reversible encryption may be used where the Service requires later authorized delivery of a generated secret. Public keys are not secret but can still identify a person, device, or organization.

Access to credentials is limited according to role and operational need, and display may be one-time, time-limited, or audited. We do not ask customers to send existing private keys or account passwords through ordinary tickets. If a secret is accidentally submitted, we may redact it from visible records when practical but cannot guarantee removal from every backup or log. The Customer must rotate exposed material. Credential metadata may be retained after the secret is removed to document issuance, access, revocation, or security events.

F. Payment, invoice, and transaction information

SCComp records may include customer and billing identifiers, invoice number, line items, amount, currency, tax treatment, status, due date, payment and refund status, transaction or checkout identifiers, subscription state, hosted invoice URLs, limited payment-method details returned by a processor, and reconciliation events. Stripe processes payment-card entry on its hosted interfaces. SCComp does not need or intend to receive a complete card number or security code through its own ordinary forms.

Transaction information is used to create and fulfill Orders, collect recurring charges, issue invoices and receipts, provide billing portals, attribute discounts and commissions, detect fraud, resolve disputes and chargebacks, maintain accounting records, and satisfy tax obligations. Banks, card networks, Stripe, and other financial participants independently process information under their own policies and legal duties. We may preserve transaction evidence after an Account closes because financial, tax, fraud, and dispute obligations often outlast the active service relationship.

G. Support, sales, contact, and ticket records

When you contact us, we collect the information you choose to provide along with sender, recipient, Account association, timestamps, category, status, assignment, and delivery or workflow metadata. Tickets and forms may include attachments, logs, screenshots, configurations, device identifiers, correspondence, and internal notes needed to investigate and coordinate. Phone, community, or informal conversations may be summarized into an official record when needed for continuity, authorization, or accountability.

We use these records to answer questions, prepare quotes, diagnose Services, authenticate requests, schedule work, document decisions, train personnel, improve documentation, manage quality, and establish what was requested or delivered. Do not include unrelated personal data or secrets. We may redact obvious credentials from the working view, restrict a sensitive ticket, or move a request to a more secure channel. Support history may remain after resolution so recurring issues, prior authorization, and service context can be understood.

H. Website requests and security telemetry

Web servers, application servers, proxies, security controls, and rate-limit systems may record IP address, time, method, host, path, query characteristics, response status and size, referrer, user agent, protocol details, request identifiers, cookie or session state, and detection results. Sensitive form bodies are not intentionally placed in ordinary access logs, although information included in a URL may be logged; users should never place passwords, tokens, or unnecessary personal data in URLs.

Telemetry is used to deliver pages, route requests, prevent abuse, identify errors, analyze availability, enforce security headers, investigate incidents, and understand aggregate use. An IP address may indicate a network or approximate area but is not treated as precise location. We may correlate requests when necessary to identify automated abuse, compromised sessions, or operational faults. Logs may be sampled, rotated, aggregated, or retained longer for a documented incident, legal hold, or repeated threat.

I. Cloudflare Turnstile and anti-automation controls

Protected forms may use Cloudflare Turnstile to assess whether a request appears legitimate. The browser may communicate directly with Cloudflare and provide network, browser, device, challenge, interaction, and security information necessary to produce a validation result. SCComp generally receives a token or result plus request context rather than a detailed profile of Cloudflare’s assessment. Cloudflare processes information under its applicable privacy terms and may act independently for security purposes.

SCComp uses the result to reduce automated registrations, credential attacks, spam, fraudulent orders, and form abuse. Other controls may include honeypot fields, timing signals, rate limits, verification links, blocklists, and server-side validation. These mechanisms can make mistakes. A failed challenge may be retried or raised with support, but we may require alternative verification. We do not use a challenge result as the sole basis for a legally significant decision unrelated to platform security.

J. Cookies, local storage, and essential state

A cookie is a small value stored by a browser and sent with matching requests. Local storage is retained by the browser and is not automatically sent with every request. SCComp uses essential session state to support login, request integrity, secure navigation, and account features. The cookie-preference value records whether the user selected essential-only or accepted all categories. Clearing browser data, changing profiles, using private mode, or switching devices can remove or create a separate choice.

Cookie duration depends on its purpose, browser behavior, session configuration, and security events. Some cookies expire when the session ends; others persist for a defined period. Necessary cookies do not require a marketing purpose and may be set even after an essential-only choice. If SCComp later enables optional measurement or advertising technology, it will be governed by the displayed choice and applicable law. Embedded third-party content may have its own storage practices, which should be reviewed before interaction.

K. Communications and email-delivery information

Communication records may include destination and sender address, subject, category, template, related Account or transaction, queued and sent time, message identifier, delivery, bounce, complaint, unsubscribe, preference, and failure status. The contents of service, security, billing, and support messages may be retained with the underlying record. Email systems necessarily expose routing metadata to sending and receiving providers. We do not include full passwords, private keys, or complete payment-card information in ordinary email.

Operational messages are sent to perform the contract, protect Services, collect payment, provide support, or comply with law. Eligible marketing and blog notifications follow the available preference and unsubscribe controls. We may maintain a minimal suppression record after unsubscribe to avoid sending the unwanted category again. Delivery and open-related information may be available from providers, but SCComp does not promise use of tracking pixels. Forwarding an email can disclose Account or service information to a new recipient and remains the Customer’s responsibility.

L. Infrastructure, network, and traffic metadata

Operating an infrastructure service creates metadata such as source and destination addresses, ports, protocols, connection timing and volume, address assignments, route and firewall actions, NAT mappings, DNS records, interface identifiers, device health, flow or security events, and mitigation status. SCComp does not ordinarily inspect the content of every packet. Limited content or payload may be processed when technically necessary for a requested support action, threat investigation, abuse response, or lawful requirement.

Network information is used to route traffic, allocate scarce resources, prevent spoofing, enforce policy, troubleshoot reachability, measure usage, defend systems, and coordinate with carriers and affected networks. Address, DNS, routing, and abuse information may be shared with registries, operators, reputation services, or complainants when reasonably necessary. Public services inherently disclose assigned addresses and offered protocols to Internet users. Customers should use encryption for sensitive communications and should not assume transport metadata is secret.

M. Virtualization, storage, backup, and platform metadata

Virtualization systems may record guest name, identifier, host, image, state, allocated CPU, memory and storage, attached interfaces and disks, console sessions, power actions, migration, snapshots, backup jobs, guest-agent reports, task output, and errors. Storage systems may record volume identifiers, capacity, placement, health, replication, checksums, snapshots, and access events. These records generally describe operation of a resource rather than the files stored within it.

SCComp uses platform metadata to provision and verify Services, balance capacity, detect failure, support the Customer, secure management operations, and restore eligible data. A guest agent may report hostname, operating-system information, interface addresses, and other documented telemetry when enabled. Customers can often limit guest-agent information by configuration, but doing so may prevent automated verification or support features. Backups and snapshots may temporarily retain Customer Content according to the purchased configuration and technical rotation schedule.

N. Bare-metal, iDRAC, and hardware-management information

Physical-system records may include manufacturer, model, service tag or serial number, components, firmware, warranty status, rack or facility location, network interfaces, power state, sensor readings, health alerts, storage inventory, assigned customer, maintenance history, photographs, and shipping or chain-of-custody information. Remote-management systems may record logins, console use, virtual-media actions, configuration changes, alerts, and power commands.

This information is used for inventory, assignment, fulfillment, capacity, support, preventive maintenance, repair, security, auditing, and return or disposal. Access to out-of-band management is restricted because it can reveal sensitive configuration and control a physical system. Customer-facing access may be proxied or logged through authenticated SCComp tools. Hardware records may remain after reassignment or retirement to document ownership, sanitization, repair, warranty, accounting, and incident history, while prior customer credentials and data should be removed through the applicable lifecycle process.

O. Colocation, visitors, shipping, and physical access

Colocation and facility records may include customer equipment specifications, serial numbers, photographs, ownership documentation, power requirements, rack position, cabling, shipping labels, carrier tracking, sender and recipient, authorized visitor names, appointment details, badge or access activity, remote-hands instructions, work notes, and video surveillance where used by the facility. Government identification may be reviewed by a facility for access, but should not be sent through ordinary SCComp forms unless requested through a secure process.

These records protect people, property, and shared infrastructure; coordinate receipt, installation, access, and removal; document work; investigate incidents; and satisfy facility or insurance requirements. Facility operators, carriers, vendors, and authorized technicians may receive the minimum information needed for their role. Physical-security records can be retained beyond a visit when necessary for audit, incident, property, or legal purposes. Visitors should not photograph or record other customers’ equipment or identifying information.

P. Abuse, fraud, and trust-and-safety records

Abuse records may contain reporter information, affected addresses or domains, timestamps, logs, message samples, malware indicators, screenshots, rights claims, correspondence, Customer response, remediation, repeat-history, and enforcement decisions. Fraud records may contain transaction risk signals, identity consistency checks, processor results, device or network indicators, disputed payments, linked Accounts, and review notes. Some information comes from complainants or automated systems and may be incomplete or inaccurate.

SCComp uses this information to validate reports, stop harm, protect networks and people, respond to rights holders, prevent evasion, preserve evidence, and make proportionate enforcement decisions. Relevant portions may be shared with the Customer, reporter, payment provider, network operator, security researcher, or authority. We may withhold details that would expose another person, confidential detection method, privileged information, or an active investigation. A record of confirmed or repeated abuse may remain after service termination to prevent recurrence and defend decisions.

Q. Console sessions and remote administration

Browser console and remote-management workflows may create short-lived authorization tokens and record Account, target device, issuance and expiration time, source address, connection state, and administrative events. Console transport necessarily carries what the Customer types and what the remote system displays. SCComp does not use console content for marketing and does not ordinarily record the visual session, but underlying gateways, browsers, operating systems, or management controllers may create technical logs.

Console access is used for recovery and administration and can expose passwords, boot output, personal data, and application content. Customers should close sessions, avoid shared devices, and understand that copy-and-paste features may place text in the local clipboard or transmit it to the target. SCComp limits console authorization by Account ownership or administrative role. We may revoke a token, terminate an abandoned session, or inspect connection metadata to diagnose failure or investigate suspected unauthorized access.

R. Monitoring, analytics, and service improvement

SCComp may analyze aggregate page activity, product interest, workflow completion, provisioning duration, error frequency, support themes, capacity use, performance, reliability, and security patterns. Analysis may use operational records, limited Account attributes, and feedback. Where practical, reports used for broad planning are aggregated or de-identified. Individual records may still be examined to diagnose a specific failure, respond to a request, verify a release, or investigate suspicious activity.

We use analysis to prioritize engineering, improve interfaces and documentation, forecast resources, test controls, reduce support burden, detect regressions, and understand whether Services work as intended. A statistical or de-identified result may be retained after source records expire when it cannot reasonably identify a person. We do not represent that all analytics are anonymous. Optional analytics or advertising tools, if introduced, will be addressed through cookie choice and appropriate notice rather than silently reclassified as essential.

S. De-identification and aggregation

SCComp may remove or transform direct identifiers, generalize values, combine records, apply thresholds, or report statistics so information is no longer reasonably linkable to an individual. De-identification is assessed in context; simply removing a name may not be sufficient when a unique address or device remains. We use reasonable measures appropriate to the intended use and do not attempt to reidentify information treated as de-identified except to test safeguards, investigate misuse, or as permitted by law.

Aggregated information may describe totals, averages, trends, capacity, or reliability across multiple events or customers. It can be used for planning, security, reporting, product development, and business operations without being treated as Personal Information where applicable law so provides. If an aggregate group is so small or distinctive that reidentification is reasonably likely, we treat it with appropriate protection. Customers must not attempt to reverse engineer another customer’s activity from shared metrics or status information.

T. Service providers, contractors, and subprocessors

SCComp uses providers for functions such as payment, email delivery, datacenter operations, connectivity, software, monitoring, fraud prevention, shipping, professional advice, and security. A provider receives information appropriate to its function and may operate from a different jurisdiction. SCComp evaluates providers proportionate to risk and uses contractual, access, and technical safeguards where appropriate. Providers that independently determine purposes, such as banks, tax authorities, carriers, or law enforcement, may not act solely on SCComp’s instructions.

Personnel and contractors may access information only for legitimate work such as support, provisioning, maintenance, accounting, development, security, or compliance. Access may be logged, time-limited, role-based, or reviewed depending on the system. No list can remain perfectly static because vendors and infrastructure evolve. Material changes affecting regulated processing may be addressed in an applicable data-processing agreement or notice. Customers with specific subprocessor requirements should contact SCComp before placing regulated data on a Service.

U. Business transfers and corporate transactions

SCComp may disclose information under appropriate confidentiality to prospective or actual investors, lenders, insurers, advisers, buyers, or successors evaluating or completing a financing, merger, acquisition, reorganization, bankruptcy, sale of assets, or transfer of a service line. Due diligence is limited to information reasonably relevant to the transaction, and direct Customer Content should not be disclosed when summaries or operational records are sufficient.

If responsibility for Personal Information transfers, the successor may continue to use it consistently with this Policy and applicable law. Materially different use may require additional notice or choice. A transaction does not eliminate Customers’ contractual rights or the successor’s legal obligations. We may retain copies when required for tax, litigation, corporate, or transaction records. If a proposed transaction does not close, recipients remain subject to confidentiality and appropriate deletion or retention duties.

V. Legal process, emergencies, and preservation

SCComp may use or disclose information to comply with a subpoena, warrant, court order, regulatory demand, tax obligation, or other valid process; establish or defend legal claims; enforce agreements; protect rights or property; prevent fraud or abuse; or respond to an emergency involving danger of death or serious physical harm. We assess requests in light of applicable authority and may challenge, narrow, redirect, or seek clarification where appropriate.

When legally permitted and operationally appropriate, we may notify the affected Customer before disclosure. Notice may be prohibited, delayed, or unsafe. A preservation request may require SCComp to retain specified existing records for a period even if ordinary rotation would remove them. Preservation does not grant the requester access and does not mean responsive data exists. We may document requests, disclosures, objections, and costs and may publish aggregate transparency information that does not compromise investigations or identify affected people.

W. Data location and cross-border transfer detail

Primary SCComp infrastructure is operated in the United States, and Account, operational, or Customer information may be stored or accessed there. Providers such as payment, communications, software, and network companies may process information in the United States or other locations in which they operate. Internet traffic can transit multiple jurisdictions regardless of intended destination. SCComp does not promise that every support or metadata record remains in one state or country unless a written Order expressly says so.

For transfers subject to a law requiring safeguards, SCComp may rely on contractual clauses, adequacy decisions, consent, necessity to perform a contract, or another lawful mechanism as appropriate. We do not claim certification under a particular international framework unless expressly stated. Customers requiring residency, localization, transfer-impact review, or a data-processing addendum must raise that need before using the Service for regulated data so feasibility and responsibilities can be documented.

X. Retention criteria by category

SCComp determines retention by purpose rather than promising one universal period. Active Account and Service records ordinarily remain while needed to provide and secure the relationship. Financial and tax records may remain for legally required accounting periods. Support and change records may remain for continuity and dispute history. Security, access, and network logs typically rotate sooner, unless selected for an investigation, abuse case, legal hold, or long-term threat defense. Inventory and hardware records may remain for asset lifecycle and ownership evidence.

Customer Content is retained according to active Service operation, purchased backup settings, termination workflow, technical rotation, legal holds, and incident needs. Deletion from a live system may not immediately remove encrypted backup blocks, replicas, caches, or disaster-recovery media. Those copies are protected and expire through normal rotation rather than being selectively restored solely to delete one record. A longer period may apply when law, fraud, chargeback, litigation, safety, or a documented dispute requires it; a shorter period may apply to transient tokens and temporary files.

Y. Account closure and deletion consequences

Closing an Account does not automatically erase every record. SCComp may retain information needed to complete termination, collect or refund payment, issue tax records, resolve disputes, detect return fraud, respond to abuse, enforce agreements, document consent, honor suppression choices, protect security, and comply with law. We may retain the minimum identifier necessary to prevent a deleted Account from being recreated for evasion or to record that a request was completed.

Data remaining solely in protected backups is not returned to normal use and will be removed as backups rotate, unless restoration is required for disaster recovery or law. If restored, applicable deletion controls will be reapplied where feasible. Public material or messages shared with others may remain in their possession. Records held by Stripe, banks, carriers, partners, or authorities are governed by those parties. Deletion may be denied or limited when another person’s rights, legal privilege, security, or an active transaction would be harmed.

Z. Privacy-request verification

To protect against fraudulent requests, SCComp must reasonably verify that the requester is the person concerned or an authorized representative. Verification may use control of the registered email, authenticated Account access, transaction or service facts, existing contact information, signed authority, or other proportionate evidence. We will not ask for more sensitive information than reasonably necessary and may be unable to fulfill a request when identity cannot be verified.

The verification method depends on the sensitivity and scope of the request. A request for general categories may require less evidence than access to support attachments, billing history, or security records. Authorized agents must show authority, and we may confirm directly with the individual where law permits. We may refuse manifestly unfounded, excessive, repetitive, or abusive requests and may charge a lawful fee after notice. Appeal rights and response deadlines apply only as provided by applicable law.

AA. Access and portability requests

An eligible access response may identify categories of Personal Information, sources, purposes, recipient categories, retention criteria, and specific information as required by law. Portability may be provided in a commonly used format when technically feasible and legally required. Security details, privileged material, confidential information about another person, fraud methods, trade secrets, or information that would adversely affect others may be redacted or withheld.

Account interfaces already provide direct access to some profile, order, invoice, ticket, preference, and device information. A privacy request is not a substitute for a Customer’s ordinary export of Customer Content from its servers. SCComp may refer a requester to the Customer that controls hosted data. We do not create information that does not exist, reconstruct expired logs, or provide proprietary internal analysis when the law requires only the underlying Personal Information.

AB. Correction and completion requests

You may request correction of inaccurate Personal Information, subject to verification and legal exceptions. SCComp may ask for evidence when a proposed change conflicts with transaction history, ownership, tax records, security events, or another reliable source. A statement of opinion, risk assessment, historical record, or record accurate when created is not necessarily “incorrect” merely because the requester disagrees or circumstances later changed.

Where appropriate, SCComp may append a correction or dispute notation instead of overwriting the original record, especially when historical integrity matters. We may notify relevant providers of a verified correction when required and feasible. Customers can correct their own hosted content and should direct their end users accordingly. Updating Account information does not automatically update separate records held by payment processors, carriers, registries, or partners.

AC. Deletion, restriction, and objection requests

An eligible person may request deletion, restriction, or objection where applicable law provides that right. Exceptions may allow continued processing to provide a requested Service, complete a transaction, maintain security, prevent fraud, exercise free expression, comply with law, establish legal claims, conduct compatible internal uses, or protect another person. SCComp will explain a denial to the extent required without exposing confidential security or third-party information.

Restriction may mean limiting active use while preserving information for a dispute or legal obligation. Objection requires consideration of the specific processing and legal basis; it does not automatically override compelling security, contractual, or legal grounds. Deleting an Account identifier while an active server remains would make the Service unsafe and is generally not feasible. We may first require cancellation, data export, balance resolution, and confirmation of ownership.

AD. Opt-out preference signals and marketing choices

Where applicable law requires recognition of a browser-based universal opt-out signal, SCComp will process a valid signal for the browser and context in which it is received. A signal may not identify an Account or apply across devices unless the user is authenticated and the law requires account-level treatment. Because SCComp does not currently sell Personal Information for money, some sale opt-outs may not change present practices.

Email unsubscribe controls apply to the categories they identify. Service, billing, security, legal, and support messages remain necessary and are not disabled by a marketing opt-out. Cookie choice applies to optional browser technology on the applicable browser. Customers may need to repeat choices after clearing data or using another device. SCComp does not require a privacy request to select essential-only cookies or unsubscribe from eligible email categories.

AE. United States state privacy disclosures

Residents of a state with a comprehensive privacy law may have rights described in the main Policy, subject to scope, thresholds, definitions, and exceptions. Categories potentially collected include identifiers; customer and commercial records; Internet or network activity; approximate geolocation inferred from IP; professional or organizational information; payment-related information; and inferences used for security or service administration. Sources, purposes, and recipient categories are described throughout this Policy.

SCComp does not currently sell Personal Information for money. SCComp does not knowingly sell or share for cross-context behavioral advertising the Personal Information of children. We do not offer a financial incentive in exchange for Personal Information merely because discounts or referral programs exist; those programs concern transactions and attribution rather than purchase of privacy rights. If a legally defined sale, sharing, targeted-advertising, or profiling practice begins, we will provide required notice and opt-out controls.

AF. EEA, United Kingdom, and Switzerland information

Where European data-protection law applies, the main Policy describes processing purposes and bases, including contract, legal obligation, legitimate interests, vital interests, and consent. Individuals may have rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent, plus the right to complain to a competent supervisory authority. Rights are not absolute, and SCComp may retain information or decline a request where law permits.

SCComp Infrastructure LLC is the contact for its controller activities unless another notice states otherwise. For Customer Content processed on behalf of a Customer, that Customer is ordinarily the appropriate controller contact. International transfers may use legally recognized safeguards when required. SCComp does not claim participation in the EU-U.S. Data Privacy Framework or appointment of a data protection officer or European representative unless separately and accurately published. Customers needing a GDPR data-processing agreement should contact SCComp before regulated processing.

AG. Canadian and other regional information

Where Canadian or another consent-based privacy law applies, SCComp collects, uses, and discloses Personal Information for purposes a reasonable person would consider appropriate, as explained here, and obtains additional consent when required. Consent may be express or implied depending on sensitivity, expectations, and context. Withdrawal applies prospectively and may prevent continued service where processing is necessary for the relationship.

Other jurisdictions may provide comparable rights, breach notices, localization rules, or regulator access. Rather than claiming every regional regime applies to every user, SCComp evaluates a request based on the individual, location, relationship, processing, and applicable law. You may identify your jurisdiction in a privacy request. We may ask for information needed to determine eligibility without treating the claim itself as proof.

AH. Children, students, and educational accounts

Commercial Services are not directed to children under 13. SCComp does not knowingly solicit their Personal Information. Educational or student programs may involve users under the age of majority only with appropriate school, parent, guardian, or organizational involvement and lawful authority. An institution that creates or sponsors Accounts is responsible for required notices and consents and for limiting student information to what the program needs.

Students should not place education records, sensitive personal information, or information about other minors into server names, tickets, projects, or public services unless authorized. If SCComp learns that information was collected from a child without required authority, it may suspend access and delete or return the information consistent with law and safety. A parent or guardian may contact SCComp, but identity and authority must be verified before information is disclosed.

AI. Customer responsibility for end-user privacy

A Customer operating a website, game server, application, VPN, email system, database, analytics tool, or other workload determines what its end users submit and how it is used. The Customer must provide its own privacy notice, identify applicable legal bases, obtain consent where required, limit collection, configure retention, secure information, honor rights, and contract with subprocessors. SCComp’s Policy does not replace the Customer’s notice.

SCComp generally cannot identify which files or database rows concern a particular end user and should not receive direct requests for Customer-controlled content unless the Customer is unavailable or law requires. We may forward a request to the Customer. Customers must not direct end users to SCComp as a way to avoid their own obligations. If a Customer needs SCComp’s assistance with a verified request, support can assess technical feasibility and any applicable professional-services scope.

AJ. Data-processing addenda and regulated instructions

A data-processing addendum may be appropriate when SCComp processes personal data in Customer Content on behalf of a Customer subject to specific law. Any addendum must accurately reflect the Services, subject matter, duration, data types, individuals, instructions, security measures, subprocessors, transfer mechanism, deletion, and assistance obligations. A generic website statement does not create commitments that operational systems cannot meet.

Customers must disclose requirements before processing begins and issue lawful, documented, technically feasible instructions. SCComp may reject an instruction it reasonably believes violates law, threatens security, exceeds the Service, or conflicts with another customer’s rights. Audits, bespoke questionnaires, localization, dedicated personnel, special retention, encryption-key arrangements, or regulatory certifications may require additional terms and fees. No addendum is effective merely because a Customer attaches it to a purchase order or ticket.

AK. Security incidents involving Personal Information

SCComp maintains processes to identify, contain, investigate, and remediate suspected security incidents within its responsibility. Investigation may involve logs, Account activity, system images, network data, providers, and affected Customers. An alert or vulnerability is not necessarily a reportable breach. SCComp assesses whether protected information was actually or reasonably likely accessed, acquired, altered, lost, or disclosed without authorization and what legal and contractual duties apply.

When notification is required, SCComp will provide information reasonably available about the nature, affected data, likely consequences, mitigation, and contact point, subject to law-enforcement restrictions and evolving facts. Customers remain responsible for incidents inside their workloads and for notifying their own users or authorities where they are the controller. Both parties should preserve evidence, avoid misleading public statements, and coordinate communications. No fixed notification period applies unless imposed by law or a written data-processing agreement.

AL. Security safeguards and access governance

Safeguards are selected according to sensitivity, risk, cost, state of the art, and Service design. They may include host-only and secure cookies, request-integrity controls, password hashing, encryption for selected credentials, protected management networks, role checks, least-privilege service identities, segmented customer networking, audit records, patches, monitoring, backups, and change validation. Details can change as threats and architecture evolve.

Personnel access is limited by job need and system permissions. Emergency access may be broader for the shortest practical time and should be recorded where systems support it. Providers may administer infrastructure under contractual and technical restrictions. SCComp does not disclose security details that would materially increase risk, and this description is not a certification or guarantee. Customers must implement complementary safeguards in their Accounts and workloads as described in the Terms.

AM. Automated processing and meaningful human review

SCComp may use rules or scores to detect spam, fraud, credential attacks, abnormal traffic, payment risk, resource misuse, or other security concerns. Inputs can include Account, transaction, network, device, timing, reputation, and behavioral signals. Automated systems may hold an Order, require verification, rate-limit a request, or alert an operator. SCComp does not intend to make solely automated decisions producing legal or similarly significant effects where applicable law prohibits doing so without safeguards.

A person may review relevant context before a consequential denial or may review the result after a user contacts support, depending on urgency and risk. Emergency security blocks can occur immediately to prevent harm. Affected users may provide additional information or challenge a mistake through support. SCComp may not disclose detailed fraud or abuse logic because doing so would help evasion. Automated tools are monitored and adjusted, but no detection method is perfectly accurate.

AN. Artificial intelligence and Customer Content

SCComp does not use Customer Content to train general-purpose artificial-intelligence models. Ordinary security, search, classification, support, or automation functions are not treated as model training merely because software helps process information. If SCComp introduces an AI-enabled feature that sends input to an external model provider or uses content for a materially different purpose, it will provide product-specific disclosure and any choice required by law before that practice applies.

Customers using SCComp infrastructure to operate their own AI systems are responsible for the information those systems collect and generate. That processing is Customer-controlled content and is governed by the Customer’s notice and instructions. Users should not submit secrets or regulated information to an AI feature unless its documentation expressly supports that use. Automated output can reveal or infer Personal Information and should be reviewed, secured, and retained according to applicable obligations.

AO. Public information, search engines, and publication choices

Information placed on a public website, DNS record, partner page, blog comment, game server, public repository, or Internet-facing service may be viewed, indexed, copied, archived, and redistributed by others. SCComp cannot control third-party search caches or copies after lawful publication. Removing material from SCComp systems may not remove it elsewhere. Customers should not publish personal information without authority and should use access controls when public distribution is not intended.

Some SCComp pages, such as Account, checkout, and support workflows, are configured to discourage search indexing or caching, but robots directives are instructions rather than absolute technical barriers. Public product, company, partner, blog, and documentation pages may be indexed. If Personal Information appears publicly by mistake, contact support with the exact location. SCComp may remove or redact it where appropriate but cannot guarantee third-party deletion.

AP. External links, embedded resources, and social platforms

A link may send the browser to a third party that receives IP address, browser information, referrer data, and anything the user submits. An embedded resource can make a request to a third party while the SCComp page is open. SCComp limits integrations based on function and security but does not control another company’s retention, cookies, profiling, or international transfers. Opening eBay, Discord, Stripe, vendor, partner, or documentation links is subject to that provider’s policies.

Social and community interactions may be visible to other users and platform operators. Do not use a public community channel for Account recovery, payment disputes, private support, abuse evidence, or credentials. SCComp may move such a conversation to an authenticated ticket. A third-party account used to communicate with SCComp remains controlled by that platform, and deleting the SCComp relationship does not delete the external platform’s record.

AQ. Changes of purpose and policy updates

SCComp will not use existing Personal Information for a materially incompatible new purpose without evaluating applicable notice, consent, and legal-basis requirements. Compatible uses may include security, debugging, fraud prevention, legal compliance, and service improvement related to the original relationship. A new product may have an additional notice that supplements this Policy. If notices conflict, the more specific notice controls for the identified processing.

Policy revisions may clarify language, describe new features, reflect provider changes, add regional disclosures, or respond to law. The effective date identifies the current version. Material changes may be announced through the website, Account, or registered email when appropriate. Users should retain a copy relevant to an important transaction. Continued use does not replace consent when law specifically requires consent, and a policy update does not retroactively make an unlawful past practice lawful.

AR. Contact, complaints, and escalation

A privacy inquiry should identify the requester, relevant Account or interaction, jurisdiction if important, right being exercised, and scope. Do not include passwords, private keys, complete payment-card details, or unrelated identity documents. SCComp may first acknowledge the request, then verify, clarify, search systems, consult providers, apply exceptions, and respond. Complex or multiple-system requests can take longer where law permits, and SCComp will provide required extension notice.

If dissatisfied, reply with the specific issue so it can be reviewed. Where applicable law provides an appeal, identify the response being appealed and why it should change. You may also contact an appropriate regulator or supervisory authority. SCComp will not retaliate for a good-faith complaint or request, although Services may still be limited when required information cannot be processed or when an Account independently violates the Terms. Operational support and privacy requests may be separated to protect confidentiality and track deadlines.