Oxyforge

Privacy Policy

Effective 1 October 2026

1. Introduction

Oxyforge ("we", "us", or "our") operates a managed WordPress hosting service running on Google Cloud infrastructure in Singapore. This Privacy Policy explains how we collect, use, disclose and safeguard your personal data when you use our website and services.

We are committed to protecting your privacy in accordance with the Singapore Personal Data Protection Act 2012, the Malaysian Personal Data Protection Act 2010, and any other applicable data protection laws.

By accessing or using our services, you consent to the practices described in this Privacy Policy. If you do not agree with this policy, please do not use our services.

2. Information We Collect

2.1 Information you provide

When you register for an account, buy a hosting plan, open a support ticket or use the contact form on this website, we may collect:

  • Full name
  • Email address
  • Phone number, where you give it
  • Billing address
  • Payment details, processed by our payment provider; we do not store complete card numbers
  • Company or organisation name, where applicable
  • Anything else you choose to send us in a support ticket, a contact form or correspondence

2.2 Information collected automatically

When you use our website and our services we collect technical information, including:

  • IP address, browser type and version, operating system and device identifiers
  • Pages visited, time on page and referring URL
  • Web server access logs for your websites, which include visitor IP addresses, requested URLs and response codes
  • Sign-in and activity records for your Oxyforge account, including actions taken in the members area, SFTP and SSH sessions, and deployments
  • Resource measurements for each website you host: storage used, outbound bandwidth, and counts of email sent by your site
  • Results of the automated malware scans we run on hosted files

We keep an audit record of significant actions taken on an account, such as creating or deleting a website, restoring a backup, changing a domain or a staff member accessing an account for support. This record exists so that any change can be traced, and we rely on it to investigate incidents and to meet our legal obligations.

2.3 Content you host

Your websites, their files and their databases may contain personal data belonging to your own visitors and customers. That data remains yours. We process it only to provide the hosting service, to take backups, to run security scans and to respond to a support request you make. In that relationship you are the data controller and we act as your data intermediary. You are responsible for having a lawful basis to collect it and for your own privacy notice to your visitors.

2.4 Cookies

We use cookies and similar technologies on this website and in the members area:

  • Essential cookies for authentication and session management. The members area cannot work without them.
  • Analytics and advertising cookies: Google Analytics for aggregated data about how visitors use our website, and the Meta Pixel so that we can measure our advertising and show relevant adverts to people who have visited. Both are set only on oxyforge.com. You can opt out of Meta's advertising cookies in your Facebook ad settings.
  • Preference cookies that remember your settings.
  • Marketing email: if you ask for a free trial through one of our advertising pages and tick the box, we add your name and email to our mailing list, sent through Resend, and may email you about Oxyforge from time to time. Every such email carries an unsubscribe link, and the trial invitation itself is sent whether or not you tick the box.
  • Referral cookie: if you arrive through an affiliate's link, a cookie named oxy_ref remembers that affiliate's code for 30 days so that, if you create an account, the referral can be credited. It holds the code only, and it is the only thing the affiliate programme records about your visit.
  • Third-party cookies set by service partners, including Cloudflare, for performance monitoring and security.

You can manage or disable cookies in your browser. Disabling essential cookies will prevent you from signing in.

3. How We Use Your Information

  • To create, provision and manage your hosting account and websites
  • To process payments and issue invoices
  • To provide support and respond to your enquiries
  • To send service notices, including maintenance windows, security advisories, limit warnings and account changes
  • To monitor performance, uptime, capacity and security across the platform
  • To measure your usage against the allowances of your plan, and to tell you when you approach them
  • To detect, prevent and address fraud, abuse, malware and security threats
  • To improve our services and this website
  • To meet legal obligations and to enforce our Terms of Use
  • To send promotional messages, only with your consent, which you may withdraw at any time

4. Where Your Data Is Stored, And How It Is Protected

Your websites and their backups are stored on Google Cloud infrastructure in the Singapore region. Google Cloud holds security certifications including ISO 27001, SOC 2 and SOC 3.

The measures we apply include:

  • TLS encryption for data in transit, with certificates issued and renewed automatically for every domain
  • Encryption at rest for stored data and backups
  • Each website running in its own isolated container under its own system user, so that one customer's files cannot be read by another
  • Firewall rules, rate limiting and outbound traffic ceilings on every website
  • Cloudflare for content delivery, DDoS mitigation and web application firewalling
  • Automated nightly malware scanning of hosted files
  • Access controls, individual staff accounts and an audit record of staff access to customer accounts

We take commercially reasonable steps to protect your data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

5. Sharing and Disclosure

We do not sell, rent or trade your personal information. We share data only in these circumstances:

  • Infrastructure providers. Google Cloud hosts the platform and stores backups.
  • Cloudflare sits in front of hosted websites and processes traffic data, including visitor IP addresses.
  • Email providers. We use a transactional email provider to send platform messages such as verification and password resets, and a separate provider to deliver email sent by hosted websites.
  • Payment processing. Our payment provider handles card details directly.
  • Analytics providers receive aggregated website usage data.
  • Legal requirements. We may disclose data where required by law, regulation, legal process or a governmental request.
  • Business transfers. In a merger, acquisition or sale of assets, data may transfer as part of the transaction.
  • Protection of rights. We may disclose data to protect the rights, property or safety of Oxyforge, our customers or the public.

Service providers are bound by contract to protect the data we pass to them.

6. Your Rights

Under the Singapore PDPA 2012, the Malaysian PDPA 2010 and other applicable laws you may have the right to:

  • Request a copy of the personal data we hold about you
  • Ask us to correct data that is inaccurate or incomplete
  • Withdraw consent for processing, subject to legal and contractual limits
  • Ask us to restrict processing in certain circumstances
  • Receive your data in a structured, commonly used format where this is technically feasible

You can take a copy of your website files over SFTP and of your databases with WP-CLI at any time. For anything else, write to us at hello@oxyforge.com and we will respond within a reasonable time and in accordance with applicable law.

7. Retention

We keep your personal data for as long as your account is active and for as long as we need it to provide the service. Website backups are retained for 30 days on a rolling basis. When you delete a website, its files, database and backups are removed. When you close your account, we delete or anonymise your data except where we must keep records to meet legal, tax or accounting obligations, to resolve disputes or to enforce our agreements.

8. International Transfers

Hosted data stays in the Singapore region. Some of our service providers, including Cloudflare and our email and analytics providers, operate globally, so limited data such as IP addresses and message metadata may be processed outside Singapore and Malaysia. Where that happens we rely on the safeguards offered by those providers and on applicable transfer mechanisms.

9. Children's Privacy

Our services are not directed at individuals under 18 and we do not knowingly collect their personal data. If we learn that we have, we will delete it promptly.

10. Third-Party Links

Our website links to third-party websites and services. We are not responsible for their privacy practices and we encourage you to read their policies before giving them personal data.

11. Changes To This Policy

We may update this Privacy Policy. Changes are posted on this page with a new effective date, and material changes will be communicated by email or a notice on the website. Continuing to use the service after a change means you accept the updated policy.

12. Contact

Questions, concerns or requests about this policy or our data practices go to hello@oxyforge.com. We aim to respond within 14 business days.