Privacy Policy

Last Updated: November 1, 2026

Tinave (“Tinave,” “we,” “us,” or “our”) provides enterprise-grade managed WordPress hosting, cloud application infrastructure, high-concurrency database hosting, container environments, edge caching, automated deployment pipelines, client portal dashboards, and related support, developer tools, and technical documentation (collectively, the “Services”).

This Privacy Policy explains how Tinave collects, processes, stores, and shares personal data belonging to individuals outside our direct corporate employment – including account holders, billing administrators, team members, prospective leads, website visitors, and vendor representatives (referred to as “you” or “your”).

1. Scope and Critical Legal Distinction (Controller vs. Processor)

A. Data We Process as a Data Controller (or Data Fiduciary)

Tinave acts as a Data Controller (under GDPR / UK GDPR) and Data Fiduciary (under the Indian Digital Personal Data Protection Act, 2023) for:

Account registration details, billing metadata, identity verification records, and support interactions.
Operational, telemetry, access, and security logs generated by your direct interaction with our customer portal, APIs, and public website.

B. Customer Application Data (We Act Exclusively as a Data Processor)

This Privacy Policy does not apply to the content, media, databases, visitor logs, or personal information processed or stored within WordPress installations, Ecommerce instances, databases, or web applications that you run on our infrastructure (“Customer Applications”).

When you host a site on Tinave, you are the Data Controller / Data Fiduciary for that site’s data.
Tinave acts solely as a Data Processor / Data Intermediary executing automated infrastructure services pursuant to our Data Processing Agreement (DPA).
Visitors or end users of any website hosted on our infrastructure must contact the owner or administrator of that respective website to inspect, correct, export, or erase their personal data.

2. Personal Data We Collect

A. Information Provided Directly by You

Account and Profile Credentials: Legal full name, business or trading name, company registration identifiers, physical billing address, administrative email address, telephone number, authentication username, and password hashes.
Billing and Payment Information: Payment card brands, expiration dates, billing addresses, and banking identifiers. Payment card transactions and direct debits are handled by PCI-DSS compliant third-party payment gateways (e.g., Stripe, Razorpay). Tinave never stores complete raw cardholder data (PAN/CVV) on its primary application databases.
Support, Diagnostics, and Communications: Messages, ticket submissions, uploaded diagnostic screenshots, debugging logs, emergency access credentials, and chat records initiated through our live desk, ticket portal, or official email channels.
Comments, Community, and Public Contributions: Profile details, public usernames, avatar identifiers (e.g., Gravatar), and technical feedback posted to public documentation, feedback portals, or official repositories.
No Sensitive Personal Information: You agree never to transmit, submit, or upload sensitive categories of personal data (such as government-issued identity cards, national insurance/Aadhaar/SSN numbers, racial or ethnic origin, religious beliefs, biometrics, health records, or sexual orientation) to Tinave customer support, chat channels, or public feedback tools. Tinave does not intentionally collect or process sensitive personal data and reserves the right to scrub or purge it immediately.

B. Technical and Telemetry Data Collected Automatically

When you access our marketing website, client portal, or authenticated API endpoints, our edge systems and edge networks record:

Network & Device Identifiers: IP addresses, browser fingerprinting strings, user-agent details, operating system architecture, screen resolution, and time zone offsets.
Usage Telemetry & Operational Logs: Request timestamps, referring URLs, API route hits, session interaction durations, clickstream analysis, and diagnostic crash dumps.
Cookies and Local Storage: Session tokens, authentication tokens, language preferences, and essential UI state. Where required by applicable jurisdiction, tracking cookies and performance scripts are loaded only after obtaining consent via our cookie settings manager.

C. Data Received from Third-Party Sources

From time to time, we may receive business contact metadata from verified identity providers (e.g., GitHub, Google OAuth sign-in integrations), fraud prevention engines, public registries, and B2B technical partners to verify billing accounts and identify potential platform abuse.

3. Lawful Bases for Processing

Tinave processes personal information exclusively under recognized lawful bases:

Purpose of Processing	Lawful Basis (GDPR / UK GDPR / Global Equivalents)
Creating user accounts, provisioning servers, routing traffic, and delivering WordPress hosting	Contractual Necessity: Performing the agreement made under our Terms of Service.
Invoicing, tax compliance (GST, VAT, Sales Tax), and financial reporting	Legal Obligation: Compliance with mandatory corporate, taxation, and statutory accounting laws.
Platform security, DDoS mitigation, fraud prevention, bot filtering, and system log auditing	Legitimate Interests: Protecting infrastructure integrity, tenant isolation, and enterprise safety.
CERT-In incident log retention and cybersecurity reporting	Legal Obligation: Compliance with mandatory national cybersecurity directives and statutory requirements.
Product improvement, feature performance analytics, and administrative platform alerts	Legitimate Interests: Enhancing stability, reliability, and usability of managed services.
Opt-in newsletters, promotional webinars, and non-essential analytics/tracking cookies	Consent: Freely given, specific, informed consent (revocable at any moment).

4. How We Share and Disclose Your Information

Tinave does not sell, rent, or trade personal data to third parties for monetary or commercial consideration. Data is shared exclusively under binding data protection contracts with the following vendor categories:

Infrastructure and Cloud Upstream Partners: Dedicated bare-metal providers, Tier-3/Tier-4 enterprise data centers, and object storage providers providing compute and network backbone facilities.
Edge Security & CDN Providers: Global Content Delivery Networks and DDoS mitigation networks processing edge requests and protecting our endpoints.
Payment Gateways & Financial Institutions: Tokenized billing processors managing merchant settlement, chargebacks, and tax verification.
Operational SaaS & Helpdesk Tools: Ticketing, transactional email routing (e.g., automated server notices, password resets), and real-time chat infrastructure.
Legal, Regulatory, and Law Enforcement Authorities: When strictly compelled by enforceable subpoenas, court orders, or statutory cyber regulations (such as CERT-In mandatory directions or judicial warrants), Tinave may disclose minimal requisite technical data.
Corporate Restructuring: In the event of a merger, acquisition, corporate reorganization, or sale of assets, customer account metadata may transition to the successor entity under equal privacy protections.

5. Cross-Border Data Transfers

Because Tinave operates a global hosting infrastructure with edge nodes, upstream data centers, and technical engineers situated worldwide, your personal information may be transferred to, stored, and processed across international borders.

European Economic Area (EEA) and UK Data: Where customer data is transferred outside the EEA or UK to jurisdictions without an adequacy decision, Tinave implements Standard Contractual Clauses (SCCs) approved by the European Commission, along with the UK International Data Transfer Addendum.
Indian Operations & Global Delivery: Cross-border processing of customer account data conforms to the transfer guidelines permitted under the Digital Personal Data Protection Act, 2023 and applicable national cyber regulations.
Onward Transfer Safeguards: Tinave requires all subprocessors to enter into written confidentiality and data processing agreements that guarantee security measures equivalent to our own.

6. Retention of Data

We retain personal data only as long as necessary to fulfill the business purposes outlined in this Policy, or as required by statutory law:

Active Accounts: Retained for the duration of your active subscription and service agreements.
Terminated / Canceled Accounts: Core account identifiers are retained for up to 90 days following account closure to facilitate service reactivation or dispute resolution, after which they are systematically purged or anonymized.
Accounting and Tax Records: Invoices, transaction receipts, and payment records are retained for a minimum of 7 to 8 years pursuant to applicable corporate taxation statutes.
System, Edge, and Security Logs: Firewall events, access requests, and authentication telemetry are preserved for a minimum of 180 days to maintain infrastructure security and satisfy regulatory cybersecurity audit requirements.

7. Your Legal Data Rights

Depending on your country, state, or regional residence (including the European Economic Area, the United Kingdom, India, and various US states such as California), you possess specific legal rights regarding your personal data:

Right of Access / Inspection: You may request confirmation of whether we process your data, along with a readable copy of that personal information.
Right to Rectification: You may correct inaccurate, outdated, or incomplete personal data via your dashboard settings or by contacting support.
Right to Erasure (“Right to be Forgotten”): You may request the deletion of your personal data when it is no longer required for contractual, regulatory, or tax purposes.
Right to Restriction of Processing: You may request that we temporarily freeze or restrict processing under disputed conditions.
Right to Data Portability: You may request your account registration and profile data in a structured, commonly used, and machine-readable format (e.g., JSON or CSV).
Right to Object / Opt-Out: You may object to data processing grounded in legitimate interests, and unconditionally opt out of direct marketing communications at any time via the “Unsubscribe” link.
Right to Withdraw Consent: Where processing depends on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
Non-Discrimination Guarantee: We will never deny services, charge differentiated pricing, or degrade service quality for exercising your privacy rights.

To exercise any of these statutory rights, please submit a verified ticket via your Tinave client portal or email privacy@tinave.com. We acknowledge and act upon verified requests within 30 days (or within timelines mandated by local regulations).

8. Technical and Organizational Security Measures

Tinave implements defense-in-depth security architectures designed to safeguard personal data against unauthorized access, destruction, loss, or alteration:

Encryption in Transit and at Rest: All web management consoles, APIs, and administrative connections mandate TLS 1.3 encryption. Backend database volumes, disks, and cold disaster-recovery archives use AES-256 encryption.
Container and Tenant Isolation: Managed WordPress customer environments run in strictly isolated, sandboxed containers, preventing cross-tenant privilege escalation, shared process access, or directory traversal.
Access Control & Least Privilege: Administrative infrastructure access requires hardware multi-factor authentication (MFA), role-based privilege controls (RBAC), and ephemeral SSH session bastion controls.
Continuous Monitoring & Hardening: Real-time kernel hardening, proactive DDoS edge protection, automated vulnerability scanning, and periodic third-party security audits.

Note: While Tinave engineers industry-standard safeguards, no Internet-connected system, API endpoint, or electronic storage facility can guarantee absolute, impenetrable security.

9. Protection of Children’s Privacy

Tinave Services are designed, targeted, and sold strictly to business operators, working professionals, and individuals of legal age (at least 18 years old, or the age of majority in your jurisdiction). We do not knowingly solicit, collect, or process personal data from children under the age of 16 (or under 18 in relevant jurisdictions). If we discover that a minor has provided us with personal data, we will immediately take steps to terminate the account and purge the data.

10. Third-Party External Links and Integrations

Our website and documentation may provide hyperlinks to third-party tools, WordPress core repositories, developer docs, or software integrations. Tinave does not govern the privacy standards or content of independent third-party platforms. We advise reviewing their published privacy notices before providing personal information.

11. Amendments to This Policy

We may modify or revise this Privacy Policy periodically to reflect infrastructure modifications, updated software capabilities, or statutory requirements. When updates occur, we will revise the “Last Updated” timestamp at the top of this document. For material modifications that substantially alter your privacy protections, we will provide notification via your primary account email or a prominent banner inside the Tinave dashboard.

12. Contact Information and Statutory Grievance Redressal

If you have questions, feedback, or legal inquiries concerning this Privacy Policy, please contact our data protection team:

Global Privacy Office:Tinave Hosting Infrastructure
Email: privacy@tinave.com

Statutory Grievance Redressal (India / IT Rules & DPDP Act)

In compliance with the Indian Information Technology Act, 2000, associated Intermediary Guidelines, and the Digital Personal Data Protection Act, 2023, the designated Grievance Officer for Tinave is:

Designation: Grievance Officer
Email: grievance@tinave.com
Response Timelines: Acknowledgment within 24 hours; formal resolution within statutory regulatory limits.

If you are an EEA or UK resident and feel that our response to your data privacy inquiry is unsatisfactory, you also have the legal right to submit a complaint directly to your local supervisory data protection authority (e.g., the UK Information Commissioner’s Office or the national data authority in your EU member state).

Appendix: Regional Statutory Notices

California and US State Residents (CCPA / CPRA)

Categories of Personal Information Processed: Identifiers (IP, email, name), commercial transaction history, internet telemetry logs, and customer communications.
Notice of Sale or Sharing: Tinave does not sell personal information for financial remuneration, nor do we disclose personal data to third parties for cross-context behavioral advertising without your explicit direction or consent.
Global Privacy Control (GPC): Tinave respects verified Global Privacy Control (GPC) signals broadcast by compatible browsers as a valid legal instruction to opt out of third-party tracking cookies.