TNode.top Privacy Policy

Tnode Privacy Policy

Last updated: 5 November 2026 Effective date: 5 November 2026

1 Who is responsible

This Policy explains how we handle personal information when you visit https://tnode.top, register, order hosting, contact us or interact with the systems we administer. Contact our Privacy Officer at [email protected].

We are responsible for personal information we use for our own account management, billing, support, security and legal purposes. Under the New Zealand Privacy Act 2020, we are the agency responsible for that information. Where an applicable law uses the term controller, that is generally our role for those activities.

We also host information for customers. When we store or process website content solely on a customer's instructions, we act as their service provider or agent, and as a processor where that term applies. The customer is generally responsible for their own website's privacy notices and the purposes of that processing. Information we independently use to secure our platform or investigate abuse is covered by our own responsibilities in this Policy. Contract labels do not override the actual role imposed by law.

2 Information we handle

We collect only information reasonably needed for the purposes explained here. Depending on your interaction with us, this includes:

• Account and contact information: your name or organisation, email address, username, account identifiers, contact details you supply and account preferences.
• Service information: domains, plan selections, account status, control panel identifiers, configuration, quota usage, provisioning events and relevant authentication or recovery information.
• Billing information where you buy a service: billing name and address, tax details where needed, invoices, amounts, transaction identifiers, payment status and payment dispute records. A payment provider may collect payment instrument details through its own checkout. Do not send complete card details or security codes through support.
• Technical information: IP addresses, request times, requested paths, browser and device information, session or security identifiers, login events, error records, resource use and abuse or fraud indicators. Logs can contain personal information and are treated accordingly.
• Communications: support requests, correspondence, feedback, abuse reports and attachments you choose to provide.
• Hosted content: files, databases, email where included, logs and backups processed to provide hosting. These can contain information about you and your website users.
• Verification information: limited information needed to confirm account control, a payment, an identity or an authority to act where there is a specific and proportionate reason. We explain the request and offer a less intrusive alternative where reasonably possible.

Do not provide sensitive information or information about other people unless needed and you have the authority and lawful basis to do so. We do not require a government ID from every visitor or routinely ask for a date of birth merely to browse our website.

3 Sources and collection notices

We receive information directly from you through forms, orders, account activity and correspondence, and automatically through use of our website and hosting systems.

We may also receive relevant information from the hosting sponsor, infrastructure providers, payment services, authorised account administrators, people reporting abuse and public domain registration sources. For example, a sponsor may send us an account suspension notice or a payment provider may confirm a transaction. We do not treat the public availability of information as unlimited permission to collect it.

Where we collect personal information indirectly for our own purposes, we assess whether collection is permitted and take reasonable steps to tell the individual what was collected, why, the intended recipients, who collects and holds it, and their access and correction rights, as soon as reasonably practicable. If collection is authorised or required by a particular law, the notice identifies that law. We may rely on a lawful notification exception where it applies. Publishing this Policy does not automatically replace a specific notice required by law.

Account information is generally requested to enter into and administer the service relationship, rather than because a statute requires every registration field. If a particular field is legally required, we identify the requirement when requesting it. Optional fields are marked. If you decline necessary contact, payment or security information, we may be unable to create an account, complete an order or safely provide the affected feature.

4 Why we use information

We use relevant personal information to create and administer accounts; provision and support hosting; maintain domains and configurations; process authorised payments and refunds; send necessary service notices; troubleshoot problems; measure service capacity and reliability; protect systems and users; investigate abuse and account ownership disputes; maintain required business records; and establish, exercise or defend legal rights.

Access to non-public hosted content is limited to what is reasonably necessary for service delivery, support you request, security, an abuse investigation or a lawful obligation. We do not claim unrestricted permission to read customer databases or private messages simply because they are hosted by us.

We do not sell personal information for money, rent customer mailing lists, or use private hosted content to train general purpose AI models. We do not use hosted visitor information for unrelated advertising. Any separate marketing or optional measurement described below must have an appropriate legal basis.

5 Cookies and optional technologies

Our account and hosting interfaces may use cookies or similar browser storage for sessions, authentication, security challenges, language preferences and the functions you request. Necessary security processing may include your IP address and device or browser characteristics. Blocking essential storage can prevent login, verification or other features from working.

Our current technology and provider details are recorded below. Optional analytics or advertising technologies must be identified here and in the relevant preference controls before they are enabled. Where consent is required, those technologies remain off until you consent. Visiting the website or accepting the Terms is not treated as consent to optional tracking.

Third party embeds and externally hosted resources can send technical information, including your IP address, to their provider. We use suitable consent or loading controls where required. These disclosures concern Tnode's own websites and interfaces; each hosting customer is responsible for identifying the technologies on their own website.

6 Messages and marketing

We send necessary messages about account access, service incidents, security, billing and material policy changes. These messages are separate from promotional subscriptions and may continue while needed to administer your account or meet a legal obligation.

We send electronic marketing only with the consent required by applicable law. You may unsubscribe through the message or by contacting us, without affecting hosting access. We honour an applicable New Zealand commercial email unsubscribe request within five working days. We retain only the minimum suppression information needed to respect the request.

7 Providers and other recipients

We disclose information only where reasonably necessary for a stated purpose and permitted by law. The service providers and locations relevant to our current services are:

• iFastNet Ltd: Sponsored Free Hosting infrastructure and account administration. Provisioning and support may involve your email address, IP address, hosting identifiers, domains, configuration, authentication material needed by the platform and relevant hosted content or logs. Its own processing is described at https://ifastnet.com/privacy.php.
• Tnode Operated Hosting infrastructure, storage, backup and network providers.
• Website security, DNS and content delivery services.
• Payment services.
• Support, transactional email and account administration services.
• Optional analytics, advertising and external resource providers: as identified in section 5, where enabled.

A provider may process some information only on our behalf and other information for its own lawful purposes, such as payment fraud prevention or platform abuse management. The actual role depends on the activity and agreement. We assess provider terms and seek appropriate confidentiality, security and use restrictions for processing entrusted to them. Linking a provider's policy does not remove Tnode's own obligations.

We may disclose necessary information to professional advisers, a lawful successor to the business, or authorities where a lawful basis exists. We assess legal requests and limit disclosure to what is required or otherwise permitted. A complaint from a private person is not by itself authority to reveal a complete account or website database. We notify affected customers of a legal disclosure where permitted and appropriate.

We may share relevant abuse reports and evidence with the affected customer and infrastructure provider to investigate and resolve them. Sponsored hosting reports are forwarded or escalated to iFastNet under its platform requirements. Reporters should tell us about safety concerns; we limit unnecessary personal details and consider applicable confidentiality or disclosure obligations.

InfinityFree is a separate hosting brand. Tnode does not send account information to InfinityFree merely because it uses the same sponsored infrastructure.

8 Overseas processing

Information may be processed outside New Zealand in the countries identified in section 7, including where providers perform support or use subcontractors. An advertised server location does not by itself describe every location used for billing, security, support or backups. Public website content is accessible internationally by design. We do not promise exclusive New Zealand storage unless a service agreement expressly provides it.

Where an overseas provider acts solely as our storage or processing agent, we remain responsible as required by law and apply appropriate provider oversight and safeguards. Where a transfer is a disclosure to a foreign recipient for its own purposes, we assess the conditions in information privacy principle 12, including whether comparable legal or contractual protections apply. If we instead need your informed authorisation because comparable safeguards are unavailable, we explain that fact and obtain the specific authorisation before the disclosure. Acceptance of this Policy alone is not blanket permission for an otherwise non-compliant transfer.

Where another applicable privacy law requires additional transfer safeguards, we must put those in place before the relevant processing. This Policy does not itself constitute standard contractual clauses or a data processing agreement.

9 Retention and deletion

We keep personal information only for as long as reasonably necessary for its stated purpose, a legal obligation or a substantiated dispute or security need. Our operational retention periods are:

• Account and contact records: while the account is active, then 730 days from when account becomes inactive.
• Billing and tax records: 7 years from which the record was created.
• Support correspondence: 3 years.
• Routine security, access and system logs: 90 days.
• Abuse, fraud and dispute evidence: 5 years.
• Verification documents: 48 hours; where possible, we retain a verification result instead of the source document.
• Tnode Operated Hosting content: the 14 day retrieval period after termination described in the Terms, followed by deletion from active systems; residual backup copies expire within 30 days unless legally preserved.
• Sponsored Free Hosting content: the sponsor's applicable retention and deletion cycle. We do not control an upstream retrieval window.

Legal holds may require particular records to be retained longer. We limit access during a hold and remove or anonymise records when the reason ends. Deleting hosting content does not automatically delete an invoice, an independently justified abuse record or an email suppression entry.

Deletion from active systems may precede expiry from backup rotation. Where a backup cannot reasonably be edited immediately, retained copies are restricted to recovery or legal purposes and re-enter the normal deletion process if restored. A permanent deletion request is not a promise that we can retrieve content that has already been removed by the sponsor.

10 Security and incidents

We use reasonable organisational and technical safeguards appropriate to the information and service, including access controls, protected administration, software maintenance and restrictions on access by personnel and providers. The measures vary with the platform; no internet service can promise absolute security. You should secure your own applications and credentials, use available multifactor authentication, and keep independent backups.

If we become aware of a breach involving information processed for you, we notify you without undue delay with the information reasonably available so you can assess your own obligations. We contain and investigate the incident and provide relevant updates. For information for which we are responsible, we notify the New Zealand Privacy Commissioner and affected individuals as soon as practicable where the legal serious harm threshold is met, subject to lawful exceptions. Other applicable notification requirements also apply.

11 Your choices and rights

You may request access to personal information we hold about you and correction of inaccurate information. Contact [email protected], even if your account is closed or you cannot log in. We verify identity proportionately. Under New Zealand law, we make and communicate our decision on an access or correction request as soon as reasonably practicable and within 20 working days, unless a lawful extension applies. We explain a refusal, extension or applicable charge and your complaint rights. If we decline a requested correction, you may ask us to attach a statement of the correction sought as provided by law.

You may also ask to close an account or delete information. We assess deletion against retention duties and applicable rights, and explain what must be retained. Necessary deletion can mean we can no longer provide a requested service. New Zealand access and correction rights do not create an unconditional right to erase every record or transfer all data to another provider.

Where another privacy law applies, additional rights may include erasure, restriction, portability, objection or withdrawal of consent. We honour rights required by that law and do not make consent a condition for unrelated processing. We explain how to exercise an applicable right without requiring a paid plan.

If your request concerns a website run by a Tnode customer, contact that website operator first because they determine the relevant processing. We reasonably assist the customer and fulfil any direct duties that apply to us. We do not disclose another customer's content merely because someone asks for it.

12 Automated protection and children

Our systems and infrastructure providers may automatically detect malware, suspicious signups, login attacks, quota excesses and abusive traffic. This can block a request or restrict a service. If a restriction affects your account and you believe it is wrong, request review through [email protected]. We assess the issue with the relevant provider where needed. An upstream provider may control its own technical decision and review process.

Account holders must be at least 18. Our services are not directed to children as account customers. Public hosted websites may nevertheless have younger visitors; their operators must provide suitable notices and safeguards. If you believe we have collected a child's information improperly for our own purposes, contact our Privacy Officer so we can investigate and take appropriate action. The age rule is not a claim that no child's information can ever appear in hosting content or technical logs.

13 Complaints and changes

Contact our Privacy Officer at [email protected] with a question or complaint. We investigate and aim to provide an initial response within ten working days. You can also complain to the New Zealand Office of the Privacy Commissioner at https://www.privacy.org.nz or another competent regulator where applicable; you do not need our permission.

We publish the current version and its effective date. We give direct notice of material changes relevant to account holders where reasonably practicable, and obtain new consent where required for a new purpose or optional technology. A Policy update does not retrospectively authorise an incompatible use or disclosure of information already collected.