Home › Privacy Policy
Privacy Policy
Last updated: 13 September 2026. This explains what we collect, why, and what you can do about it.
Our approach: we use personal information to provide and secure our services, manage accounts and payments, and respond to enquiries. This notice explains those activities. We do not sell personal information. Rights requests can be made by emailing [email protected]; using account tools is optional.
Who we are
Splash Nodes is a sole trader business, operated by Alan Alaei, registered at 32 Blenheim View, Leeds, West Yorkshire, LS2 9QB, United Kingdom. For the purposes of data protection law, Alan Alaei, trading as Splash Nodes, is the controller for our account, billing and support activities. Where we host or maintain a customer’s website and process their users’ information on their instructions, we generally act as a processor under our service contract. Contact the relevant website operator about processing they control; we assist our customers with requests as required.
What we collect, and why
When you create an account
- Name, email address, and phone number if you give us one
- A password (stored as a one-way cryptographic hash — we never see or store the plain password itself), or, if you sign in with Google, a link to your Google account and nothing about your Google password
- The IP address used to create the account and every sign-in afterwards, kept for 12 months. We show you this on the sign-in screen so it's never hidden processing — it exists to catch someone signing in from an account that isn't theirs.
- A six-digit code sent to confirm your email, deleted 15 minutes after it's sent or used, whichever is first
Lawful basis: performance of a contract (we can't provide the account without this) and legitimate interests (fraud prevention, for the IP records).
Your business and billing details
- Business name, address, postcode and business type
- Order history, service subscriptions, and your account balance ledger
- Card payments are processed by Stripe. Cryptocurrency account top-ups run through BTCPay Server, a payment processor we operate ourselves rather than a third-party payment company, so top-up payment details are not shared with an external crypto payment provider. We keep payment and transaction records needed to manage your account, such as amounts, dates, references and payment status. We do not store full card numbers or card security codes. Stripe handles card payment information under its own applicable terms and privacy notice.
Lawful basis: performance of a contract, and legal obligation (accounting and tax records).
Your website, domain, email and phone service
- The content of any website we build or host for you — text, images, pages you create
- Domain registration details (registrant name and address) passed to our registrar, Spaceship, to register a domain in your name — this information is needed to meet applicable registrar and registry requirements. The details required and any publication or disclosure depend on the domain and applicable rules
- DNS records you configure yourself in SplashNames
- Mailbox names and settings for SplashMail, if you use it — we do not read the content of your email
- Call logs, numbers and recordings if you use SplashPhone, to the extent needed to provide and bill for the service
Lawful basis: performance of a contract.
When you use live chat
If you use the chat widget on our site, we keep the conversation, and — if you leave your details after we couldn't connect you to someone — your name and the email or phone number you give us. If the AI assistant answers your question, that message is sent to our AI provider to generate a reply; if we can't answer automatically, the conversation is shared with our support team over Telegram so a person can help. Chat retention is described below. Support messages may contain personal or confidential information, so please avoid including passwords or unnecessary sensitive information.
Lawful basis: legitimate interests (providing support you've asked for).
Free trials
When you start a free trial, we use your account, service and billing details to administer the trial, record its end date, process cancellation and manage any paid subscription that follows. The billing date and price are shown at checkout. The purposes, sharing arrangements and retention periods described in this policy also apply to trial accounts.
Location and sanctions checks
To meet legal obligations and to keep our services safe, we check new accounts and purchases against sanctions rules. When you sign up or buy, we may compare the country you tell us you live in with the country your connection appears to come from, and check your name and your business name against sanctions lists using a screening provider. We do not decide anything from your nationality or from a name alone.
If something needs a closer look, a person reviews it, and we may pause your order or account until they have. We will tell you when this happens. If you think we have got it wrong you can ask us to look again by contacting us or by using the appeal option in your account, and you will not be refused solely by an automated check without the chance to have a person consider it, except where the law requires us to decline.
We keep a record of each check that needs review, including the details we checked, the outcome, who reviewed it and why, for as long as the law requires (currently up to 6 years). Our lawful bases are compliance with legal obligations and our legitimate interest in preventing unlawful use of our services.
Who we share it with
We use the suppliers listed below for the stated purposes. Their data protection roles depend on the service: some act as processors under our instructions and others may act as independent controllers. Supplier processing and remote access may involve countries outside the UK. Where a restricted transfer occurs, it must be covered by applicable UK adequacy regulations, appropriate safeguards or a permitted exception. Contact us for information about the safeguards relevant to your data. We do not assume that a UK or EEA server location alone resolves transfer requirements.
| Who | What for |
|---|---|
| Stripe | Card payments |
| BTCPay Server (self-hosted) | Cryptocurrency account top-ups — runs on our own infrastructure, not a separate company |
| Spaceship | Domain registration |
| Sign-in, if you choose to use it | |
| Our AI provider | Answering live chat questions automatically |
| Telegram | Routing live chat to a human when needed |
We never sell your data, and we never share it for marketing purposes with anyone outside Splash Nodes.
How long we keep it
- Account and sign-in security records (IP addresses): 12 months
- Sign-up verification codes: 15 minutes
- Sanctions and location screening records: for as long as the law requires, currently up to 6 years
- Chat transcripts: 6 years
- Orders, invoices and wallet transaction history: retained to meet applicable tax, accounting and legal requirements. For a sole trader, tax records are generally required for at least five years after the relevant 31 January submission deadline — this applies even if you delete your account, but the records are disconnected from anything that identifies you beyond what the law requires us to keep
- Everything else (your website, pages, DNS records, personal details): kept while your account is active, and scheduled for deletion after the 14-day account-deletion period, subject to applicable legal retention, dispute handling and backup deletion processes
Your rights, and how to use them
Under UK GDPR you have rights to access, correction, erasure, restriction, portability and objection, subject to their applicable conditions and exemptions. Where we rely on consent, you can withdraw it without affecting the lawfulness of processing before withdrawal. Most of these are self-service:
- See or download everything we hold: Panel › Account › Privacy › Download my data — provides an account-data export. If you need other personal information or cannot use this tool, contact us; the export does not limit your right of access
- Delete your account: Panel › Account › Privacy › Delete my account — this starts a 14-day countdown (so a mis-click or change of mind isn't final), which you can cancel any time in that window. After that period, account deletion proceeds. Some records may need to be retained for legal obligations or claims, and backup copies may follow a separate deletion cycle.
- Correct something: most details can be edited directly in your panel; anything that can't, email us and we'll fix it
For anything else, or if you'd rather deal with a person than a self-service tool, email [email protected]. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) if you think we've got something wrong — we'd rather you talked to us first, but it's your right either way.
We respond to rights requests without undue delay and normally within one calendar month, subject to the statutory rules on extensions and permitted pauses. We request identity information only where reasonably necessary. We acknowledge data protection complaints within 30 days, investigate them and communicate the outcome without undue delay.
Security
Passwords are hashed, never stored in plain text. Full card numbers and card security codes are handled by our card payment provider, rather than stored by us. Two-factor authentication is available on every account. We keep software patched and use standard security headers and rate limiting to protect against automated attacks. No system is perfectly secure, but we treat this seriously rather than as a checkbox.
Changes to this policy
We update this notice when our processing changes and make the revised date clear. Where appropriate, we notify affected account holders of material changes. An update does not itself provide consent for new processing; where consent is required, we ask for it separately.
Contact
Alan Alaei, trading as Splash Nodes
32 Blenheim View, Leeds, West Yorkshire, LS2 9QB
[email protected] — general enquiries
[email protected] — data
protection and GDPR requests