======================================================================
PRIVACY POLICY
======================================================================
We are committed to protecting your privacy in every way we can. This page
explains what we collect, why we collect it, who else ever sees it, how long
we keep it, and what you can ask us to do about it. It covers the things you
might not think to ask about, not just the things we are required to disclose.
TWO DIFFERENT KINDS OF DATA:
This policy covers the data we hold about you as our customer: your account,
your billing details, and your support tickets. It does not cover the customer
data you store on your servers. We process customer data strictly on your
instructions, and it is governed by our Data Processing Agreement ("DPA").
WHO WE ARE:
42U Networks L.L.C., 1 WTC, Suite 8500, New York, NY 10007, United States
(also referenced as 285 Fulton St / WTC, Suite 8500, New York, NY 10007).
We are the controller of the personal data described in this policy.
LAST UPDATED:
October 30, 2026.
----------------------------------------------------------------------
1. INFORMATION SECURITY AND ACCESS GOVERNANCE
----------------------------------------------------------------------
One of the most important ways to protect your privacy is to minimize what we
collect. We collect the least personally identifiable information we can,
which reduces what could ever be exposed in the event of an operational issue.
The technical and organizational measures protecting our infrastructure are
documented in Annex II of our Data Processing Agreement, and they apply to
your account records as well as our server platforms.
BILLING PANEL & INFRASTRUCTURE ACCESS CONTROLS:
Our core customer management and billing portal operates on secure cloud
infrastructure hosted in Microsoft Azure Indonesia Central (Zone 1) in
Jakarta, Indonesia, with backups stored in Jakarta. Access to this environment
is strictly segregated:
- Application Level (Billing & Support Portal): Access is restricted strictly
to authorized staff for customer support, ticket handling, and administrative
servicing.
- Infrastructure Level (Underlying Virtual Machines and Operating Systems):
Operating system, hypervisor, console, and root server access is exclusively
restricted to LLC owners and executive officers. General staff have zero
access to the underlying server environment.
----------------------------------------------------------------------
2. WHAT WE COLLECT AND WHY
----------------------------------------------------------------------
+-----------------------------------+-----------------------------------+-------------------------+
| WHAT | WHY WE HAVE IT | LEGAL BASIS (EEA & UK) |
+-----------------------------------+-----------------------------------+-------------------------+
| Name, business name, billing | To open your account, invoice | Performance of a |
| address, email, phone number | you, and contact you about your | contract |
| | services | |
+-----------------------------------+-----------------------------------+-------------------------+
| Payment details and transaction | To process payments and maintain | Contract, and legal |
| records (processed via Stripe / | statutory accounting records | obligation for financial|
| PayPal; we never store raw cards) | | records |
+-----------------------------------+-----------------------------------+-------------------------+
| Support tickets and correspondence| To resolve inquiries and maintain | Performance of a |
| | ticket history for recurring issues| contract |
+-----------------------------------+-----------------------------------+-------------------------+
| IP addresses, login records, and | To secure accounts, prevent fraud,| Legitimate interest in |
| administrative access logs | investigate abuse, and troubleshoot| platform integrity & |
| | technical issues | security |
+-----------------------------------+-----------------------------------+-------------------------+
| Identity verification records | To verify customer identity, | Explicit consent and |
| (KYC via Didit Identity, Inc.) | prevent fraud, and comply with | legitimate interest in |
| where required | platform risk rules | fraud prevention |
+-----------------------------------+-----------------------------------+-------------------------+
----------------------------------------------------------------------
3. IDENTITY VERIFICATION POLICY (KYC)
----------------------------------------------------------------------
Certain orders, high-risk accounts, or service tiers require identity
verification before provisioning. When required, identity verification is
conducted through Didit Identity, Inc. (IDV). This process may require
submitting an unexpired government-issued photo ID, a live selfie biometric
photograph for facial comparison, and identifying tax or national ID numbers.
SECURITY & REDACTION:
Review of verification submissions is strictly restricted to LLC members
and authorized compliance officers. General support staff never have access
to raw identity documents. Submitted biometric and identification files are
immediately redacted and purged once the review is finalized. 42U Networks
does not retain archival copies of your government ID documents.
DECLINING VERIFICATION:
You maintain the right to decline verification. If you choose not to verify,
your order will not be provisioned and you may request a refund in accordance
with our Terms of Service (less any third-party payment processing fees).
----------------------------------------------------------------------
4. WHAT WE NEVER DO
----------------------------------------------------------------------
- We do not sell your personal information. Not to advertisers, not to data
brokers, not to anyone, for money or any other consideration.
- We do not share your information for cross-context behavioral advertising
or targeted advertising.
- We do not deploy third-party advertising or analytics trackers that profile
you across the web.
- We do not read, index, mine, or inspect the contents of your servers, and
we never use your data to train artificial intelligence or machine learning
models.
- We do not share your data with external third parties beyond the limited
service providers enumerated below.
----------------------------------------------------------------------
5. WHO ELSE SEES YOUR DATA (SERVICE PROVIDERS)
----------------------------------------------------------------------
We engage a minimal number of trusted service providers strictly necessary to
operate our business infrastructure. Each provider is bound by written data
protection terms:
+----------------------+----------------------+---------------------+---------------+
| PROVIDER | WHAT THEY DO | WHAT THEY SEE | LOCATION |
+----------------------+----------------------+---------------------+---------------+
| Microsoft Azure | Cloud infrastructure | Encrypted database | Jakarta, |
| (Indonesia Central, | hosting our billing | records & ticket | Indonesia |
| Zone 1) | and management panel | history. No access to| |
| | and offsite backups | customer servers. | |
+----------------------+----------------------+---------------------+---------------+
| Stripe, Inc. | Payment processing & | Billing details and | United States |
| | fraud detection | payment credentials.| |
| | | No Customer Data. | |
+----------------------+----------------------+---------------------+---------------+
| PayPal, Inc. | Merchant payment | Billing details and | United States |
| | processing | transaction info. | |
| | | No Customer Data. | |
+----------------------+----------------------+---------------------+---------------+
| Didit Identity, Inc. | Identity verification| Government ID photo,| United States |
| | (IDV) and KYC | live biometric selfie| / EU |
| | validation | image. Redacted | |
| | | post-validation. | |
+----------------------+----------------------+---------------------+---------------+
Payment card details are entered directly into Stripe or PayPal via secure
elements and are never transmitted to or stored on our servers. Internal software
platforms operating on our servers run on dedicated instances without third-party
vendor access to account information.
----------------------------------------------------------------------
6. WHERE YOUR DATA IS LOCATED & INTERNATIONAL TRANSFERS
----------------------------------------------------------------------
42U Networks is a New York limited liability company. Our operational data
flows as follows:
- Billing & Management Portal: Hosted and operated in Microsoft Azure Indonesia
Central (Zone 1) in Jakarta, Indonesia. System backups of the billing and
support portal are also securely encrypted and stored in Jakarta, Indonesia.
- Administrative Personnel: Select administrative support and engineering may
be conducted from the United States and the United Kingdom via authenticated,
logged, and multi-factor-secured channels.
- Customer Hosted Servers: Customer hosting instances, VPS nodes, and dedicated
servers remain stationed in their specifically provisioned datacenter regions
(such as our Michigan facilities) and are not replicated internationally unless
expressly ordered by you.
Transfers of personal data originating from the EEA, the UK, or Switzerland to
us in the United States or our Indonesian cloud instances are executed under
the European Commission's Standard Contractual Clauses (SCCs) and the UK
International Data Transfer Addendum, as detailed in our DPA.
NOTICES REGARDING REGIONAL REGISTRIES (RIRs):
For EU/UK and international users, if any account data or technical contact
information must be submitted to an external regulatory registry or Regional
Internet Registry (e.g., ARIN or RIPE NCC) for IP allocation, IP justification,
or mandatory routing registration, you will be notified in advance via the
portal or support ticket system, adhering to strict data minimization principles.
----------------------------------------------------------------------
7. DATA RETENTION
----------------------------------------------------------------------
+-----------------------------------+-------------------------------------------+
| CATEGORY | RETENTION PERIOD |
+-----------------------------------+-------------------------------------------+
| Customer Server Contents | Destroyed immediately and irretrievably |
| | upon service cancellation or termination, |
| | including platform snapshots and backups. |
+-----------------------------------+-------------------------------------------+
| Lapsed Service Grace Period | Held for 2 additional days if expired |
| | without a cancellation notice, or while an|
| | active billing dispute is being resolved. |
+-----------------------------------+-------------------------------------------+
| Account, Contact & Ticket History | Maintained while your account is active, |
| | and retained for 36 months following your |
| | last account activity (login, ticket, or |
| | active service). Thereafter purged. |
+-----------------------------------+-------------------------------------------+
| Invoices and Transaction Records | Retained for up to 7 years in accordance |
| | with US tax, legal, and accounting laws. |
+-----------------------------------+-------------------------------------------+
| Identity Verification Data (KYC) | Redacted and purged immediately after review|
| | by LLC compliance officers. |
+-----------------------------------+-------------------------------------------+
| Billing Database Backups | Maintained on an encrypted rolling 30-day |
| (Jakarta, Indonesia) | rotation; deleted records expire out of |
| | backup archives as snapshots roll over. |
+-----------------------------------+-------------------------------------------+
| Server & Authentication Logs | Stored temporarily for system security, |
| | troubleshooting, and abuse audits, then |
| | discarded. |
+-----------------------------------+-------------------------------------------+
----------------------------------------------------------------------
8. GOVERNMENT AND THIRD-PARTY REQUESTS
----------------------------------------------------------------------
We believe you have the right to know if a third party or authority seeks
information regarding your account. If we receive a legal inquiry, subpoena,
or warrant demanding customer data, we will promptly notify you so you may
seek protective relief, unless we are strictly prohibited from doing so by a
valid United States court gag order or statutory prohibition.
When responding to compulsory legal process:
- We disclose only the specific data strictly demanded by the order;
- We challenge overbroad, vague, or improper subpoenas and demands;
- We never grant government bodies direct, bulk, or unmonitored access, and
we never construct security backdoors into our platforms.
----------------------------------------------------------------------
9. YOUR LEGAL PRIVACY RIGHTS
----------------------------------------------------------------------
GENERAL RIGHTS:
Regardless of where you reside, you may request access to the personal data
we hold regarding your account, request corrections to inaccurate records, or
request deletion of your account. Requests can be submitted via client support
ticket or our contact form. We respond within thirty (30) days without charge.
EEA, UK, AND SWISS DATA SUBJECTS:
If you are located in the EEA, the UK, or Switzerland, you have the right to:
- Request access to, rectification of, or erasure of your personal data;
- Request restriction of processing or object to processing;
- Request data portability in a structured, machine-readable format;
- Withdraw consent at any time where processing is based on consent;
- Lodge a complaint with your local supervisory authority (e.g., the UK ICO
or the Swiss FDPIC).
UNITED STATES STATE PRIVACY RIGHTS:
If you are a resident of California (under CCPA/CPRA), Virginia, Colorado,
Connecticut, Utah, Texas, Oregon, Montana, or another state with applicable
comprehensive privacy laws, you possess rights to know, access, correct,
delete, and port your personal data, and to opt out of the sale or sharing
of personal information.
Because 42U Networks does not sell or share personal data, no opt-out
mechanism is required. Any sensitive information collected during identity
verification is strictly utilized for the legally exempt purpose of fraud
prevention and account security. You may exercise your rights or appeal any
decision by opening a ticket with our compliance team.
----------------------------------------------------------------------
10. ACCOUNT CLOSURE AND DELETION
----------------------------------------------------------------------
You may request account closure and deletion at any time via the client area.
Upon verified request:
- Your active services are deprovisioned and wiped immediately;
- Account profile details and ticket correspondence are purged from live
databases, and age out of rolling encrypted backups within thirty (30) days;
- Historical invoices, payment records, and accounting ledgers are retained
for the statutory period required by taxation and corporate law.
----------------------------------------------------------------------
11. COOKIES
----------------------------------------------------------------------
Our client portal utilizes only strictly necessary functional cookies required
to authenticate user sessions, maintain session security, manage CSRF tokens,
and retain display preferences (such as language or currency). We do not
deploy third-party advertising cookies, marketing pixels, or tracking networks.
----------------------------------------------------------------------
12. MINORS
----------------------------------------------------------------------
Our Services are intended exclusively for individuals aged eighteen (18)
years or older. We do not knowingly solicit or collect personal information
from children under 18. If we discover that an account has been opened by
or on behalf of a minor, the account and all associated data will be terminated
and deleted immediately.
----------------------------------------------------------------------
13. CHANGES TO THIS POLICY
----------------------------------------------------------------------
We may update this Privacy Policy to reflect evolving services, technologies,
or legal mandates. For material updates that diminish your privacy rights, we
will provide at least thirty (30) days advance notice via email or client
dashboard announcement. Continued use of our Services following the effective
date indicates acceptance of the revised policy.
----------------------------------------------------------------------
14. CONTACT INFORMATION
----------------------------------------------------------------------
For privacy inquiries, Data Protection Officer communications, or to exercise
your data privacy rights, please contact us:
42U Networks L.L.C.
Attn: Privacy & Data Protection Department
1 WTC, Suite 8500
New York, NY 10007
United States
Client Support Ticket: Open a ticket via the 42U Networks Customer Portal.
======================================================================
