Privacy Policy

1. Data we collect

• Account: phone number, name and email (if given). If you sign in with Google: your Google account ID, email and name.
• Sign-in: SMS codes are kept briefly and only in hashed form. Sessions, IP addresses and browser type are recorded for security.
• Orders and payments: the service ordered, amount, dates, and QPay invoice and transaction IDs. We never receive card or bank account details.
• SMS: the phone number, purpose (sign-in code, reminder) and time of each message.
• Your content: the files and data you put on a VPS, in storage or on a website. We only hold this on your behalf.

2. How we use it

• to create your account, identify you and sign you in;
• to process orders and payments, and to open and renew services;
• to send expiry reminders and service notices;
• to protect against fraud and attacks, and to fix problems;
• to meet our legal accounting and tax obligations.

We do not use your data for advertising and we do not sell it.

3. Third parties

We share data only as far as needed to provide the services:

• Cloudflare: network, DNS and DDoS protection. All traffic passes through the Cloudflare network.
• QPay and banks: payment invoices and transactions.
• Skytel: sending SMS (phone number and message).
• Google: only if you choose to sign in with Google. The exacloud.mn site loads its fonts from Google Fonts.

We may disclose data to authorities when the law requires it.

4. Where data is stored and how it is protected

• Your data is stored on our servers located in Mongolia.
• All connections are encrypted (HTTPS). Each customer’s servers and accounts are isolated.
• Passwords and SMS codes are stored in hashed form.
• Staff access your content only to help you, to keep the systems running, or when the law requires it.

5. How long we keep data

• Account data: while your account is active.
• Your content (VPS, files, websites): deleted 17 days after the service expires.
• Backups: kept for up to 7 days, then replaced automatically.
• Payment records: for the period required by accounting and tax law.
• SMS codes: a few minutes. Sign-in sessions: until you sign out or they expire.

6. Cookies and browser storage

• exa_cloud_sid: an essential cookie that keeps you signed in to the panel.
• exa_cloud_oauth: a security cookie kept for a few minutes during Google sign-in.
• exa-theme: your light or dark mode choice, stored only in your browser.
• The panel keeps the order you are configuring in temporary (session) browser storage, cleared when you close the tab.

We do not use advertising or tracking cookies, or analytics.

7. Your rights

• to see your data and get a copy;
• to have incorrect data corrected;
• to close your account and have your data deleted (except payment records we must keep by law);
• to withdraw consent you gave, such as a Google connection.

Send requests to [email protected]. We reply within 10 working days.

8. Changes to this policy

When we update this policy we change the date on this page. We announce significant changes on the site, in the panel or by SMS.

9. Contact

Exa Cloud LLC · Khan Hills 533-101, Khan-Uul District, Ulaanbaatar, Mongolia · [email protected]