Who we are and what this covers
VirtualCloud is a brand of [Registered company name], a company incorporated in India with its registered office at [Registered office address] and corporate identity number [CIN] ("VirtualCloud", "we", "us" or "our").
For the personal data described in this policy, we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the "DPDP Act"): we decide why and how it is processed. This policy is our notice to you under section 5 of the DPDP Act and the Digital Personal Data Protection Rules, 2025 (the "DPDP Rules"). It covers:
- the website at virtualcloud.in and every form on it;
- your customer account, the client area and our billing and support systems;
- the services you order from us: domains, hosting, business email, SSL certificates, VPS and dedicated servers; and
- emails, support tickets and other messages you send us.
It does not cover the content you store on our services, such as your website's visitors or your shop's customers. For that data you are the Data Fiduciary and we act as your Data Processor, as explained in Data you host with us.
You can ask for this notice in English or in any language listed in the Eighth Schedule to the Constitution of India by writing to legal@virtualcloud.in.
What personal data we collect
We collect only what we need for the purposes in the next section. Most of it comes from you; some is created when you use our services.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account and contact | Name, email address, phone number, company name, postal address, password (stored only as a salted hash) and two-factor settings | You, when you sign up or update your profile |
| Billing and tax | Billing address, GSTIN, invoices, payment status and payment reference numbers. Card and UPI details are entered with our payment gateway; we never see or store full card numbers | You, and our payment gateway |
| Verification (KYC) | Government-issued photo ID, proof of address, GST certificate or company documents, and the result of the check | You, when an order is held for verification. Mostly VPS and dedicated servers |
| Domain contacts | Registrant, administrative and technical contact names, organisation, address, email and phone | You, when you register or transfer a domain |
| Technical and security | IP addresses, login times, client-area and control-panel actions, server and network logs, and traffic data used to detect attacks | Created when you use our website and services |
| Support | Tickets, emails, attachments and the notes our engineers add while helping you | You, and our support team |
| Website forms | The fields you fill in on a form (contact, sales, migration, affiliate, compliance documents, abuse, grievance, newsletter, status alerts, customer stories, feedback, unsubscribe) and the page it was sent from | You, when you press Send |
| Browser storage | A handful of settings kept in your own browser, listed in Browser storage. They aren't sent to us | Your browser |
We don't ask for sensitive data such as health, financial account or biometric information. The only official documents we handle are the ones you send for verification. We don't buy personal data from data brokers.
Why we use it
Each use below is tied to the data it needs and to its basis under the DPDP Act: your consent (section 6), a legitimate use such as information you gave us voluntarily for a specified purpose (section 7), or a duty required by law.
| Purpose | Data used | Basis |
|---|---|---|
| Create your account and provide the services you order | Account, technical | Consent |
| Invoice you, collect payment, issue GST invoices and prevent payment fraud | Account, billing | Consent Required by law |
| Verify subscribers of VPS and dedicated servers and keep CERT-In records | Verification, account | Required by law |
| Register, renew and transfer domain names | Domain contacts | Consent |
| Answer tickets, emails and the forms you send | Support, website forms | Legitimate use |
| Send invoices, renewal reminders, maintenance and security notices | Account | Consent |
| Protect our network, investigate abuse and keep security logs | Technical and security | Required by law |
| Send newsletters, deal alerts and product updates | Email address, chosen lists | Consent only |
| Respond to courts, regulators and lawful government requests | Only what the request covers | Required by law |
Consent and how to withdraw it
Where we rely on consent, we ask for it with a clear action, such as ticking the consent box on a form or placing an order, and only for the purpose shown at that point. Marketing consent is always separate and never a condition of buying a service.
Withdrawing consent is as easy as giving it:
- Marketing emails: use the unsubscribe link in any newsletter or deal email, or the unsubscribe page.
- Anything else: write to legal@virtualcloud.in from the email address on your account, or use the grievance form and choose "My personal data (DPDP Act)".
When you withdraw consent we stop that processing within a reasonable time, and our processors stop too. Processing done before you withdrew stays lawful. If a service can't run without the data (for example, a domain can't stay registered without registrant details), we'll tell you, and you can choose to cancel it. Invoices, renewal reminders and security notices continue while you have an active service, because we need them to run it.
Once registered Consent Managers start operating under the DPDP Rules, you'll also be able to give, manage and withdraw consent through one of them.
Who we share it with
We share personal data only with the service providers we need to run VirtualCloud (our Data Processors) and with authorities when the law requires it. Every processor works under a written contract that limits it to our instructions and requires reasonable security safeguards.
| Recipient | Why | Data shared |
|---|---|---|
| Payment gateway [Payment gateway name] | Takes UPI, RuPay, Visa, Mastercard, net banking and wallet payments | Name, email, phone, amount, invoice number |
| Email delivery provider | Sends invoices, notices and the newsletters you subscribed to | Email address, name, message content |
| Data-centre and network partners | House and connect our servers in the region you choose | Physical hosting only; they don't access data on our servers |
| Domain registrar and registries | [Accredited registrar name] and the registry for each extension, such as NIXI for .in | Domain contact details, as each registry requires |
| Certificate authorities | Validate and issue OV and EV SSL certificates | Organisation name, address, contact person |
| Software licence vendors | Activate cPanel/WHM, Plesk and Windows Server licences | Server IP address, licence ID |
| Professional advisers | Auditors, tax advisers and lawyers, under confidentiality | Only what each engagement needs |
| Government and law enforcement | Valid legal orders, CERT-In incident reports and tax filings | Only what the order or law requires |
Domain registries may publish some registrant details in public WHOIS or RDAP records, depending on the extension's rules. The Domain registration agreement explains which details appear and when privacy protection is available.
If VirtualCloud is merged with or sold to another business, personal data may pass to it under this policy. We'll tell you before that happens.
Where your data is stored
Your services run in the region you pick from our data centre locations when you order: Mumbai or Delhi NCR in India, or Singapore, Frankfurt, London or New York. The websites, databases, mailboxes and server disks of that service, and their backups, stay in that region. Business email is stored in India. Choosing a region outside India is your instruction to store that service's data there.
Some processors, such as an email delivery provider, may handle account data outside India. We use only countries that the Central Government has not restricted under section 16 of the DPDP Act, and the same contract and security requirements apply wherever the data is.
How long we keep it
We keep personal data only while we need it for the purposes above, or for longer where a law requires it. After that it is deleted, or anonymised so it can no longer identify you.
| Data | Kept for | Why |
|---|---|---|
| Account and contact details | Account life | Then only as long as the billing records below need them |
| Invoices, payments and tax records | 8 years | Companies Act, 2013 and GST law |
| KYC and subscriber records (VPS and dedicated servers) | 5 years after the service ends | CERT-In Directions of 28 April 2022 |
| Data on a terminated service | 7 days | So you can ask for it back, then permanently deleted |
| Backups | Up to 30 days | Each plan's backup schedule rolls old copies off automatically |
| Security and system logs | 180 days | CERT-In Directions; kept in India |
| Records of how personal data was processed | 1 year minimum | DPDP Rules, 2025 |
| Support tickets | Account life + 3 years | To handle follow-up questions and disputes |
| Form enquiries that don't lead to an order | 2 years | To answer follow-ups; deleted sooner on request |
| Mailing lists | Until you unsubscribe | Your email then moves to a suppression list so we never email you again |
| Form rate-limit records | 1 hour | A one-way hash of your IP address, used only to block spam floods |
Your rights under the DPDP Act
As a Data Principal, you have these rights over the personal data we hold about you:
| Right | What it means | How to use it |
|---|---|---|
| Access s.11 | A summary of the personal data we process, what we do with it, and who we've shared it with | Email legal@ from your account email |
| Correction s.12 | Correct, complete or update inaccurate or incomplete data | Edit your profile in the client area, or email us |
| Erasure s.12 | Delete data we no longer need, unless a law requires us to keep it | Email legal@; we'll confirm what can and can't be erased |
| Withdraw consent s.6 | Stop processing that relies on your consent | See Consent above |
| Grievance redressal s.13 | Have a complaint about our data handling answered | The Grievance Officer |
| Nomination s.14 | Name someone to use your rights if you die or can't act yourself | Email legal@ with the nominee's name and contact |
To protect your account, we confirm your identity before acting on a request, usually by replying to the email address on the account. We don't charge for requests. We acknowledge them within 24 hours and answer within 15 days; if a request is complex, we'll tell you why and when you'll have the answer.
The DPDP Act also asks you to give accurate information, not to impersonate anyone, and not to file false or frivolous complaints.
Data you host with us
Personal data inside your websites, databases, mailboxes and servers is yours to control. For it, you are the Data Fiduciary and we are your Data Processor. We:
- process it only to provide the service and on your instructions, never for our own purposes;
- access it only when you ask for support, to keep the platform secure, or when the law requires it;
- keep it in the region you chose, and delete it 7 days after the service ends; and
- tell you without delay if we become aware of a breach affecting it.
You are responsible for your own privacy notice, for having a basis to collect that data, and for answering your users' requests. If you need a data processing agreement for your compliance records, write to legal@virtualcloud.in.
Children's data
Our services are for adults and businesses: you must be at least 18 to open an account, as our Terms of service require. We don't knowingly collect personal data from children. If we learn that we have, without verifiable consent from a parent or lawful guardian, we'll delete it.
If your own website or app processes children's data, the DPDP Act requires you to obtain verifiable parental consent and not to track, profile or target advertising at children.
How we protect it
We take reasonable security safeguards, as section 8 of the DPDP Act requires, including:
- Encryption in transit (TLS) on the website, client area and our APIs, and salted hashing for passwords;
- Access control: staff get only the access their role needs, with two-factor sign-in and logged access to customer systems;
- Monitoring: logging, intrusion detection and DDoS mitigation across our network;
- People: confidentiality obligations for everyone who handles personal data; and
- Processors: contracts that require the same standard of protection.
If a personal data breach happens, we'll tell affected users without delay, in plain language: what happened, the likely impact, what we're doing and what you can do. We'll inform the Data Protection Board of India without delay and send it a detailed report within 72 hours, and report cyber incidents to CERT-In within 6 hours, as the law requires. More about our controls is on the Security & trust page; to report a vulnerability, email security@virtualcloud.in.
Cookies and browser storage
The VirtualCloud website sets no cookies and loads no analytics, advertising or social-media trackers, so there's no cookie banner to click through. A few features keep small settings in your own browser's storage. They stay on your device, aren't sent to us, and you can clear them at any time in your browser settings.
| Key | Type | What it remembers | How long |
|---|---|---|---|
vc-theme | localStorage | Your light or dark theme choice | Until cleared |
vc-search-recent | localStorage | The last 5 pages you opened from the site search (Ctrl K), shown as shortcuts next time | Until cleared |
vc-kb-feedback | localStorage | Help articles you've rated, so you aren't asked twice | Until cleared |
vc-mg-checklist | localStorage | Ticks on the migration checklist | Until cleared |
vc-bl-speed-checklist | localStorage | Ticks on the website speed checklist | Until cleared |
vc-announce | sessionStorage | That you closed the announcement bar | Until the tab closes |
vc-launched | sessionStorage | That the intro animation has already played | Until the tab closes |
vc-estimate | sessionStorage | A price estimate you chose to send to sales; it pre-fills the contact form and is only sent if you submit it | Until the tab closes |
vc-rdap-cache | sessionStorage | Recent domain availability results, so repeat searches are instant | 10 minutes |
Every page loads its fonts from Google Fonts and a smooth-scrolling script (Lenis) from the jsDelivr CDN, and the home page loads a 3D graphics library (three.js) from cdnjs. Those services see your IP address and browser details, as with any web request, but set no cookies for us. The domain search and free tools query domain registries' RDAP services and Cloudflare or Google DNS-over-HTTPS directly from your browser, only when you use them. Full details are in the Cookie & browser storage policy.
Grievance Officer and complaints
If you have a question or complaint about how we handle personal data, contact our Grievance Officer, who also acts as our contact for the DPDP Act:
- Name: [Grievance Officer name], [Grievance Officer designation]
- Email: legal@virtualcloud.in (subject: "Privacy")
- Online: the form on the Grievance officer page
- Post: [Registered company name], [Registered office address], India
We acknowledge complaints within 24 hours and resolve them within 15 days. If you're not satisfied with our answer, you can complain to the Data Protection Board of India under the DPDP Act, after first using our grievance process.
Changes to this policy
We'll update this policy when the law, our services or our processors change. The current version is always on this page with its "Last updated" date. If a change materially affects how we use your personal data, we'll email you before it takes effect and, where we rely on consent, ask for it again.
| Version | Date | What changed |
|---|---|---|
| 1.0 | 20 October 2026 | First published. |
Contact us
Privacy questions and requests: legal@virtualcloud.in. Security issues and vulnerability reports: security@virtualcloud.in. By post: [Registered company name], [Registered office address], India.
For anything else, use the contact page. Billing questions go to billing@virtualcloud.in, and abuse reports to the report abuse page.