How ShellSecrets Cloud Solutions Pvt. Ltd. collects, uses, stores, shares, protects, and deletes information — including Google user data — when you use shellsecrets.com, the ShellSecrets client portal at portal.shellsecrets.com, its Google and GitHub sign-in, forms, support channels, and services.
This policy is published by ShellSecrets Cloud Solutions Pvt. Ltd. ("ShellSecrets", "we", "us"), a web hosting, cloud, and DevOps company in Budhanilkantha, Kathmandu 44600, Bagmati, Nepal. We are responsible for the personal data described here.
It applies to our website at shellsecrets.com, the ShellSecrets client portal at portal.shellsecrets.com, and the "ShellSecrets" application you see on the Google and GitHub sign-in screens when you choose to sign in to the client portal with those accounts.
Information We Collect
We collect only what we need to run our website and client portal, deliver the services you order, bill for them, support you, and keep accounts secure.
Account details you give us: your name, email address, company name, phone number, billing address, and (if you provide one) tax number, plus your password, stored only as a one-way hash.
Sign-in details from Google or GitHub, only if you choose those options: your account identifier, email address and its verified status, and your name (see "Google User Data" below).
Orders and billing: the products and domains you order, invoices, payments, account credit, and payment references. Card and wallet details are entered on the payment provider's own page; we never receive or store them.
Service data: your domains and the registrant contact details registries require, your hosting and server details, and settings you save in the portal.
Support and messages: support tickets, attachments you upload, quotation requests, and emails you send us.
Security and usage data: IP address, browser type, sign-in times and devices (to alert you to new sign-ins), and pages visited on shellsecrets.com through our self-hosted analytics.
How We Use Information
To create and manage your account and sign you in, including with Google or GitHub if you choose.
To set up, run, renew, and support the hosting, servers, domains, and email services you order.
To issue invoices, take payments, keep account credit, and send billing, renewal, and service notices.
To answer support tickets, quotation requests, and other messages.
To protect accounts and services: detecting fraud, spam, abuse, and unauthorised access, and notifying you of new sign-ins.
To meet legal, tax, accounting, and domain registry obligations.
We do not use personal information for advertising, and we do not sell it.
Client Portal Accounts
The ShellSecrets client portal (portal.shellsecrets.com) is where customers order and manage hosting, VPS, domains and email services, pay invoices, and open support tickets. To create and use a portal account we collect your name, email address, company name, phone number, and billing address, and we keep your order, invoice, service, and support history.
You can sign in with an email address and password, or with your Google or GitHub account. Passwords are stored only as salted one-way hashes, never in readable form.
Google User Data
If you choose "Continue with Google" in the ShellSecrets client portal (portal.shellsecrets.com), Google asks you to allow the "ShellSecrets" application to share basic profile information with us. We use Google Sign-In only to sign you in. This section explains exactly how we access, use, store, share, protect, retain, and delete the Google user data involved.
Data we access: with your permission and using only the openid, email, and profile scopes, Google shares your Google account identifier, your email address and whether Google has verified it, and your name. We do not request or access your Gmail, contacts, Drive files, calendar, or any other Google data.
How we use it: only to sign you in to the client portal — to find your existing account by its verified email address, or to create a new account using your name and email address — and to recognise your Google sign-in on later visits. We do not use Google user data for advertising, profiling, or any purpose other than providing sign-in to your account.
How we store it: we store your Google account identifier and email address, linked to your portal account; if Google sign-in creates your account, your name and email address are saved as the account's contact details. This data is kept in our own database on our servers. We do not store your Google password, and Google access tokens are used once during sign-in and are not saved.
Who we share it with: no one. We do not sell, rent, or transfer Google user data to third parties, and do not share it except where required by law. It stays within the infrastructure we operate to run the portal.
How we protect it: the portal is served only over encrypted HTTPS connections, our database is not reachable from the internet, and access is restricted to authorised ShellSecrets staff who need it to support your account.
Retention and deletion: we keep the linked Google identifier for as long as your account uses Google sign-in. You can revoke ShellSecrets' access at any time at myaccount.google.com/permissions, and you can ask us to remove the Google link or delete your account by emailing the address in the Contact section; we act on such requests within 30 days, keeping only the billing and legal records we are required to retain.
Limited Use: ShellSecrets' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Sign In with GitHub
If you choose "Continue with GitHub", GitHub shares your GitHub account identifier, name, and verified email address with us. We use them only to sign you in to the client portal, in the same way as Google sign-in above.
Disconnecting GitHub Sign-In
You can revoke ShellSecrets' access at any time in your GitHub settings (Applications). To have the GitHub link or your portal account deleted, email us at the address below; we act on such requests within 30 days, keeping only the billing and legal records we are required to retain.
Cookies and Similar Technologies
Essential cookies keep you signed in to the client portal (a secure, httpOnly session cookie), remember your cart across shellsecrets.com and the portal, and remember your theme and currency choice. Our website uses self-hosted analytics to count page visits; it does not share data with advertisers. The network security provider that protects our sites, and the captcha shown on some forms, may set security cookies to tell people from bots. You can block cookies in your browser, but signing in to the portal requires the session cookie.
Data Sharing
We do not sell or rent personal information. We share it only with the providers we need to deliver your services, and only what each one needs:
Cloud hosting and network providers that run our servers and database and deliver and protect our websites.
The payment provider or bank you choose to pay with, to process the payment.
Domain registry partners and registrars, which receive the registrant contact details required to register, transfer, and renew your domains.
Upstream data centre and infrastructure partners, when we set up a server you ordered on their network.
Our email delivery service, to send you invoices, notices, and replies.
Authorities, where the law requires it.
Google user data is never shared with any of these providers.
Third-Party Websites
Our website and client portal may contain links to third-party websites not affiliated with us, including domain registry partners, SSL certificate authorities, and payment providers. We are not responsible for the privacy practices of those third-party sites; please review their own policies.
Security
Our sites are served only over HTTPS. Passwords are stored as salted one-way hashes, and sensitive data such as stored credentials is encrypted at rest. Our database is not reachable from the internet, staff access is limited to those who need it, and you can protect your portal account with two-factor authentication. We notify you by email when your account is signed in to from a new device. No online service is completely risk-free, so please keep your password private and turn on two-factor authentication.
Where Data Is Stored
The client portal and its database run on cloud servers we operate in the Asia Pacific region (India). Information you give us may therefore be stored and processed outside your own country, protected as described in this policy.
Data Retention
We retain information for as long as needed to provide services, maintain records, resolve disputes, prevent abuse, comply with obligations, and support operational continuity. When you close your account, we delete or anonymise your personal data, including any Google or GitHub sign-in link, except billing and legal records we are required to keep.
Your Rights and Choices
You can ask us to access, correct, export, or delete your personal information, or to stop using it, subject to service, billing, security, legal, registry, or operational retention requirements. You can update most account details yourself in the client portal, revoke Google access at myaccount.google.com/permissions or GitHub access in your GitHub settings at any time, and sign in with a password instead. We respond to requests within 30 days.
Children
Our services are intended for businesses and adults. We do not knowingly collect personal information from children under 16; if you believe a child has given us information, contact us and we will delete it.
Changes to This Policy
We update this policy when our practices change, and the "Last updated" date above shows the latest version. Before we change how we access, use, store, or share Google user data, we will update this policy and notify affected users by email and in the client portal, and we will ask for your consent again where a new use requires it.
Contact
Privacy questions and requests: [email protected], or +977-9803336672.
