SmallHost Co Privacy Policy

Privacy Policy

Effective date: 7 September 2026

Draft: replace every item in square brackets before publishing. This document assumes that Smallhost operates from Australia.

This Privacy Policy explains how Tensai Labs, trading as Smallhost Co. (Smallhost, we, us), ABN 16 435 781 797, handles personal information when you visit smallhost.co, create an account, buy or use a service, or contact us.

1. Who to contact

Questions, access or correction requests, and privacy complaints can be sent to:

Email: support@smallhost.co Postal address: Parcel Collect 90, PERTH TAS 7300

2. Information we collect

The information we collect depends on how you deal with us. It may include:

• your name, business name, address, email address, and telephone number;
• account details, login records, preferences, and support history;
• order, invoice, transaction, tax, and payment status information;
• domain registrant and technical contact details where you order a domain;
• service configuration, usage, security events, IP addresses, device and browser information, and server logs;
• messages, files, screenshots, or other material you send to support; and
• feedback, complaints, and records of our communications with you.

Depending on the payment method, a payment provider may collect card or bank details directly under its own privacy policy. We receive the transaction information needed to process the order, maintain accounts, handle refunds, and prevent fraud.

Please do not send sensitive information unless we ask for it and it is reasonably necessary for the matter we are handling.

3. How we collect information

We usually collect personal information directly from you when you create an account, place an order, configure a service, submit a support request, or communicate with us.

We may also receive information from payment providers, domain registries and registrars, fraud prevention services, infrastructure suppliers, authorised account users, and public sources where reasonably necessary.

Our systems collect technical information when you use the website, client area, or services. This includes IP addresses, request times, browser details, and security or diagnostic logs.

4. Why we use information

We use personal information where reasonably necessary to:

• create and secure accounts;
• process orders, payments, renewals, cancellations, and refunds;
• supply, maintain, troubleshoot, and improve services;
• register and manage domains or other third-party products you request;
• provide support and service notices;
• detect abuse, spam, fraud, and security threats;
• keep financial, tax, operational, and legal records;
• enforce our terms and protect our customers, systems, and legal rights;
• comply with legal obligations and valid requests from authorities; and
• send marketing communications where you have consented or where the law otherwise permits it.

You can unsubscribe from marketing emails using the link in the message or by contacting us. You may still receive invoices, security alerts, and other messages needed to provide your service.

5. Cookies

We use cookies and similar browser storage needed to provide the website and client area. These may keep you signed in, maintain a shopping cart, remember preferences, protect forms, prevent fraud, and balance traffic between servers.

We do not use cookies to sell personal information or build advertising profiles. If we introduce optional analytics or advertising technology, we will update this policy and provide any consent controls required by law.

You can block cookies in your browser, but essential account, checkout, or security features may stop working correctly.

6. When we disclose information

We do not sell or rent personal information.

We may disclose personal information to:

• infrastructure, data centre, email, support, monitoring, backup, security, and software providers that help us operate;
• payment providers, banks, accountants, and fraud prevention services;
• domain registries, registrars, certificate authorities, and other suppliers needed to fulfil an order;
• professional advisers and insurers;
• a buyer or successor involved in a proposed or completed sale, merger, or restructure, subject to appropriate confidentiality protections;
• law enforcement, regulators, courts, or other parties where required or authorised by law; and
• another person where you direct or authorise us to do so.

We require service providers to handle information only for the agreed purpose and to apply suitable privacy and security protections where reasonably possible.

7. Overseas disclosure

Some service providers or their systems may be located outside Australia. Personal information may therefore be disclosed to or accessed from United States, New Zealand, Singapore.

The countries involved depend on the services and suppliers you use. Where Australian privacy law applies, we take reasonable steps required by that law before disclosing personal information overseas.

8. Customer content

If you use our hosting services to collect or store personal information about other people, you are responsible for your own privacy notices, permissions, security, and legal obligations. We process that hosted content to provide, secure, support, and maintain the service, and as otherwise required by law.

We do not use customer-hosted content for advertising or sell it to third parties.

9. Storage, security, and retention

We use administrative, technical, and physical safeguards that are reasonable for the nature of the information and the risks involved. No internet service or storage system can be guaranteed completely secure.

We keep personal information only for as long as reasonably needed for the purposes described in this policy, including providing services, resolving disputes, preventing fraud, maintaining backups, and meeting tax, accounting, and legal obligations. Retention periods vary by the type of record and applicable law.

When information is no longer required, we take reasonable steps to delete it or remove identifying details, unless the law requires or permits us to retain it.

10. Data incidents

We investigate suspected unauthorised access, disclosure, loss, or misuse of personal information. Where an incident is an eligible data breach under Australian law, we will notify affected individuals and the Office of the Australian Information Commissioner as required.

11. Access and correction

You can ask for access to personal information we hold about you or ask us to correct information that is inaccurate, incomplete, or out of date. Some account details can be reviewed and changed in the client area.

We may need to verify your identity. We will respond within a reasonable time and explain any lawful reason for refusing or limiting a request. We will not charge for making a request. If a permitted access charge applies, we will tell you before doing the work.

12. Privacy complaints

Send a complaint to the privacy contact listed above and describe what happened. We will acknowledge and investigate the complaint, then respond within a reasonable time.

If you are not satisfied with our response and Australian privacy law applies, you may contact the Office of the Australian Information Commissioner at oaic.gov.au.

13. Children

Our services are not directed to people under 18, and a person under 18 may not open an account. If you believe a child has provided personal information to us without appropriate permission, contact us so we can investigate.

14. Changes to this policy

We may update this policy when our services, suppliers, or legal obligations change. We will publish the current version on our website and change the effective date above. We will give reasonable notice if a change materially affects how we handle personal information.