Introduction
The present Privacy Policy explains how eXact Digital LLC ("eXact Digital", "we", "us", or "our") collects, uses, shares, and protects personal data when you visit https://exact.gg, create an account, buy or use our hosting, virtual private server, dedicated server, and domain services (the "Services"), or contact us. Section 12 of the Policy contains our cookie notice. The Policy should be read together with our Terms of Service at https://exact.gg/terms, which use the same defined terms.
1. Who We Are
1.1 The controller of the personal data described in the Policy is eXact Digital LLC, a limited liability company organized under the laws of the State of Colorado, United States, with postal address c/o its registered agent, 1500 N Grant St, Denver, CO 80203, United States. Privacy requests and questions can be sent to [email protected] with the subject "Privacy request".
1.2 The Policy applies to the personal data of website visitors, prospective customers, customers and their authorized users, resellers, people who submit abuse or copyright notices, and other people who contact us.
1.3 The Policy does not apply to personal data that our customers store or process on the Services as part of their own websites, applications, and servers ("Customer Content"). For Customer Content, our customer decides what data is processed and why, and eXact Digital acts only as a processor on the customer's behalf under the Data Processing Agreement in Part K of the Terms of Service. If your data are stored on a website or server hosted with us by one of our customers, please contact that customer first. We forward any request we receive about Customer Content to the customer concerned.
2. Personal Data We Collect
2.1 Account and identity data. When you create an account or place an order, we collect your name, email address, postal address, country, telephone number where provided, company name and tax identification number where you buy as a business, and your login credentials, stored in hashed form.
2.2 Order and payment data. We record the Services you order, invoices, payment method type, transaction identifiers, the last digits and expiry date of a card as returned by the payment processor, online payment account identifiers, cryptocurrency transaction references, refunds, and chargebacks. When you pay by card, you enter the card details in the payment form of the Client Area; the details are transmitted in encrypted form and then passed to our payment processor, which processes the payment. We do not store full card numbers or card security codes. Payments through online payment accounts and cryptocurrency are completed on the pages of the relevant payment provider.
2.3 Technical and usage data of the Services. To operate the Services, we process IP addresses assigned to your Services, server and network logs, resource usage metrics such as processor, memory, disk, and bandwidth consumption, login records of the Client Area, and records of actions taken in the Client Area.
2.4 Website data. When you visit the Platform, our servers and our content delivery provider receive your IP address, browser type, device information, pages requested, referring page, and date and time of the request. With your consent where required, analytics tools collect information on how you use the website, as described in Section 12.
2.5 Fraud-prevention data. When you sign up or place an order, we and our fraud-screening provider analyze your IP address and its approximate location, device and browser characteristics, email address, and order details to assess the risk of fraud.
2.6 Domain registrant data. When you register a domain name, we collect the registrant, administrative, and technical contact data required by the Registrar and the registry for that extension.
2.7 Communications. We keep the content of support requests, emails, and chat messages exchanged with you, and the abuse reports, copyright notices, counter-notifications, and complaints that you send us or that concern your Services.
2.8 We do not ask for special categories of personal data, such as data concerning health, religion, or political opinions, and we ask you not to send them to us.
3. Purposes and Legal Bases
3.1 We use personal data for the purposes listed below. For people in the European Economic Area and the United Kingdom, the table also shows the legal basis under Article 6 of Regulation (EU) 2016/679 (the "GDPR") and of the United Kingdom GDPR.
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and managing your account, provisioning and operating the Services, and providing technical support | Account, order, technical, and communications data | Performance of the contract (Article 6(1)(b)) |
| Billing, collection of payments, refunds, and handling of chargebacks | Account, order, and payment data | Performance of the contract (Article 6(1)(b)) |
| Keeping accounting and tax records | Account, order, and payment data | Compliance with legal obligations (Article 6(1)(c)) |
| Registering, renewing, and transferring domain names | Domain registrant data | Performance of the contract (Article 6(1)(b)) and compliance with registry and ICANN requirements |
| Preventing fraud and payment abuse | Fraud-prevention, account, and order data | Legitimate interest in protecting eXact Digital and its customers against fraud (Article 6(1)(f)) |
| Protecting the security of our network, enforcing the Acceptable Use Policy and the Fair Use and Resource Policy | Technical and usage data, abuse reports | Legitimate interest in securing our infrastructure and the services of other customers (Article 6(1)(f)) |
| Handling abuse reports, notices of illegal content, copyright notices, and orders of authorities | Communications, technical, and account data | Compliance with legal obligations (Article 6(1)(c)) and legitimate interest in handling complaints (Article 6(1)(f)) |
| Sending service notices, renewal reminders, and changes to our terms | Account data | Performance of the contract (Article 6(1)(b)) and compliance with legal obligations (Article 6(1)(c)) |
| Sending news and offers about our own similar Services to existing customers | Name and email address | Legitimate interest in direct marketing (Article 6(1)(f)), with the right to opt out at any time |
| Sending marketing emails to people who are not customers | Name and email address | Consent (Article 6(1)(a)) |
| Measuring the use of the website through analytics cookies | Website data | Consent (Article 6(1)(a)) where required by law |
| Establishing, exercising, or defending legal claims | All relevant data | Legitimate interest in protecting our rights (Article 6(1)(f)) |
3.2 Providing account, billing, and registrant data is necessary to conclude and perform the contract. Without those data, we cannot provide the Services.
3.3 Fraud screening produces a risk score. An order flagged as high risk is reviewed by a member of our team before any decision to refuse it is taken, so no decision with legal or similarly significant effects is based solely on automated processing. You may ask for a review of any decision on your order by contacting [email protected].
4. Sharing of Personal Data
4.1 We do not sell personal data, and we do not share personal data for cross-context behavioral advertising or targeted advertising. We disclose personal data only to the recipients listed below and only as far as necessary for the purposes in Section 3. You can obtain the names of the providers in each category by writing to [email protected].
| Recipient | Purpose | Location |
|---|---|---|
| Payment processors and online payment services | Payment processing, refunds, and chargebacks; each acts as an independent controller for its own regulatory obligations | United States, European Union, and other countries |
| Cryptocurrency payment gateways | Processing of cryptocurrency payments chosen by you | Location of the gateway selected at checkout |
| Content delivery and network security provider | Content delivery, DNS, protection against attacks and bots | Global network, including the United States |
| Fraud-screening provider | Fraud screening at sign-up and checkout | Countries where the provider operates, under the safeguards in Section 5 |
| Website analytics provider identified in Section 12 | Website analytics, only with consent where required | United States and European Union |
| ICANN-accredited domain registrars, registries, and ICANN | Registration and management of domain names | The European Union, the United States, and the country of each registry |
| Operator of our data center facility in Frankfurt | Housing of the servers on which our systems and the Services run | Germany |
| Email delivery and support tools | Sending transactional emails and managing support requests | European Union or United States |
| Professional advisers, auditors, and insurers | Legal, accounting, and tax advice and audits | Countries where they operate |
| Courts, law enforcement authorities, and regulators | Compliance with legal obligations and orders | Country of the authority |
| Persons submitting abuse or copyright notices | Information on the outcome of a notice, without disclosure of your personal data unless the law requires it, such as forwarding a counter-notification under the Digital Millennium Copyright Act | Country of the notifier |
4.2 Our team members and contractors who need access to personal data to provide the Services are bound by confidentiality obligations.
4.3 If eXact Digital is involved in a merger, acquisition, reorganization, or sale of assets, personal data may be transferred to the successor, who will remain bound by the Policy or by a policy offering equivalent protection, and we will inform you before your data become subject to a different policy.
4.4 Resellers who buy our reselling services decide on the data of their own clients. Where you are a client of a reseller, the reseller's privacy notice governs the processing of your data by the reseller.
5. International Transfers
5.1 eXact Digital is a United States company. The servers of the Services are located in Frankfurt, Germany, and our team works from the United States, the United Kingdom, and other countries. Personal data may therefore be accessed from, or transferred to, countries outside the European Economic Area or the United Kingdom.
5.2 Where personal data of people in the European Economic Area are transferred to a country without an adequacy decision of the European Commission, we rely on the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, or on the certification of the recipient under the EU-U.S. Data Privacy Framework where the recipient is certified. For transfers from the United Kingdom, we rely on the United Kingdom adequacy regulations, on the International Data Transfer Addendum to those clauses, or on the UK Extension to the EU-U.S. Data Privacy Framework. You can obtain a copy of the relevant safeguards by writing to [email protected].
6. Retention
6.1 We keep personal data only for as long as necessary for the purposes for which they were collected, according to the following periods.
| Data | Retention period |
|---|---|
| Account data | For the life of the account and 24 months after its closure, to handle questions, refunds, and claims |
| Invoices, payment, and tax records | Seven years after the end of the year of the transaction, to meet tax and accounting obligations |
| Server, network, and Client Area logs | 90 days, unless needed longer to investigate a specific security incident or abuse case |
| Fraud-screening results | 24 months after the order |
| Support requests and communications | 36 months after the request is closed |
| Abuse reports, notices, statements of reasons, and complaints | 36 months after the decision, or longer if a dispute is pending |
| Domain registrant data | For the life of the registration and for the period required by the Registrar, the registry, and ICANN |
| Marketing preferences | Until you unsubscribe or withdraw consent, and a record of the opt-out for as long as needed to respect it |
| Analytics data | 14 months |
6.2 At the end of the retention period, we delete or anonymize the data. Data in backup copies are overwritten within the ordinary backup rotation cycle.
7. Security
7.1 We protect personal data with technical and organizational measures appropriate to the risk, including encrypted connections to the Platform and the Client Area, hashed passwords, multi-factor authentication for our administrative accounts, access limited to authorized personnel, network filtering and attack mitigation, regular security updates, and separate backups. The measures applied to the Services are described in Section 26 of the Terms of Service.
7.2 If a personal data breach is likely to result in a risk to your rights and freedoms, we notify the competent supervisory authority and, where required by law, we inform you without undue delay.
8. Your Rights in the European Economic Area and the United Kingdom
8.1 If the GDPR or the United Kingdom GDPR applies to the processing of your personal data, you have the right to request access to your personal data, rectification of inaccurate data, erasure, restriction of processing, and portability of the data you provided to us, under Articles 15 to 20 of the GDPR. You have the right to object at any time to processing based on our legitimate interests, under Article 21 of the GDPR, and we stop the processing unless we demonstrate compelling legitimate grounds or need the data for legal claims. You may object at any time to direct marketing, and we then stop it without exception.
8.2 Where processing is based on consent, you may withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. Cookie consent can be withdrawn through the cookie settings button at the bottom left of the website.
8.3 To exercise your rights, write to [email protected] or use the support page at https://exact.gg/support. We answer within one month, which may be extended by two further months for complex or numerous requests, in which case we inform you of the extension and the reasons within the first month. We may ask for information needed to confirm your identity.
8.4 You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement. In the United Kingdom, the supervisory authority is the Information Commission, which took over the functions of the Information Commissioner on September 30, 2026. We would appreciate the chance to address your concern first.
9. Privacy Rights under United States State Laws
9.1 Several states of the United States, including Colorado, have adopted comprehensive consumer privacy laws. Depending on your state of residence and on whether the applicable law covers eXact Digital, you may have the right to confirm whether we process your personal data and to access it, to correct inaccuracies, to delete personal data, to obtain a portable copy, and to opt out of the sale of personal data, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects.
9.2 We do not sell personal data, we do not process personal data for targeted advertising, and we do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects. We honor requests to access, correct, delete, and receive a copy of personal data from residents of any state of the United States, whether or not their state law applies to us. We treat a Global Privacy Control signal or a similar universal opt-out signal sent by your browser as a refusal of non-essential cookies on the website.
9.3 You or an authorized agent can submit a request to [email protected]. We verify requests by matching the information provided with the data in our records and respond within 45 days, which may be extended by a further 45 days where reasonably necessary, with notice to you. If we decline a request, you may appeal by replying to our decision with the subject "Privacy appeal", and we answer the appeal within 45 days, explaining the outcome and the reasons. If the appeal is denied, you may contact the Attorney General of your state. We do not discriminate against you for exercising your rights.
9.4 In the last 12 months, we collected the categories of personal data described in Section 2, namely identifiers, commercial information, internet or network activity information, approximate geolocation derived from IP addresses, and the content of communications, from you, from your devices, and from our payment and fraud-screening providers, for the purposes in Section 3. We disclosed those categories for business purposes to the recipients in Section 4. We have not sold or shared personal data for cross-context behavioral advertising.
10. Children
10.1 The Services are intended for adults and are not directed to persons under 18 years of age. We do not knowingly collect personal data of minors. If we learn that we have collected personal data of a person under 18, we delete it and close the related account, subject to retention required by law. Parents or guardians who believe that a minor has provided us with personal data can contact [email protected].
11. Marketing Communications
11.1 Customers may receive emails about new Services and offers similar to the Services they bought. Other people receive marketing emails only with their consent. Each marketing email contains an unsubscribe link, and you can also opt out by writing to [email protected]. Service notices, invoices, renewal reminders, and security messages are not marketing and continue to be sent while you have an account.
13. Changes to the Policy
13.1 We may update the Policy to reflect changes in our Services, in our providers, or in the law. The date of the last update appears at the top. We inform customers of significant changes by email or through a notice in the Client Area before they take effect.
14. Contact
14.1 For any question about the Policy or the processing of your personal data, write to [email protected] with the subject "Privacy request", or by post to eXact Digital LLC, c/o its registered agent, 1500 N Grant St, Denver, CO 80203, United States.