Privacy Policy

What this policy covers

This Privacy Policy applies to every service run by Smile Corp ("we", "us"), including their dashboards, APIs, apps, and support channels:

Smile Hostingsmilehosting.tech
Smile VPSvps.smilehosting.tech
SmileMailmailing.smilehosting.tech
Smile Auth & the Smile appsauth.smilecorp.co.uk · extension · Windows, Android, iPhone
Xyloxylo.smilehosting.tech · Discord bot
Smile Corpsmilecorp.co.uk · docs · careers · our Discord

Two services have their own page with extra detail: Smile Auth privacy (the vault, the extension, and the apps) and SmileMail privacy. Those pages add to this policy.

1 Information we collect

Account information: full name, email address, optional username, and a securely hashed password. If you sign in with Discord, we store your Discord ID and username.
Passkeys & 2FA: if you set these up, we store a public key (never a private key or biometric data, which never leave your device) and, for an authenticator app, an encrypted-at-rest secret used only to verify your codes.
Payment information: handled entirely by Stripe. We receive confirmation that a payment succeeded and a reference ID, never your full card number.
Device & access information: IP address, a device cookie, and a browser/hardware fingerprint, recorded when you log in to or register on Smile Hosting. This exists specifically to enforce IP/device bans against abuse and fraud (see Section 3), not for advertising or tracking your activity elsewhere. Smile Auth also keeps a list of your signed-in devices and your security activity, so you can see them.
Support & ticket content: whatever you submit in a support ticket, and any reply thread that follows.
Hosted content: files, configuration, and console output for servers you create; the virtual machines you run on Smile VPS; and the mail in your SmileMail mailbox. We store these so the Services can run them. Your Smile Auth vault is stored end-to-end encrypted, and we can't read it. See Section 4 of our Terms of Service.
Xylo dashboard: when you log in with Discord, your Discord ID, name and avatar, a Discord login token, and the list of Discord servers you're in (with your permissions there), so the dashboard can show which ones you can manage. See Section 5 for how long this is kept.
Xylo in your server: the server's Xylo settings, and for its members: XP and level, coins (with when daily and work rewards were last claimed), and warnings (with the reason, the moderator who gave it, and when). Xylo doesn't store message text for levels. Auto-mod reads messages as they're sent to check them against the server's rules. If it deletes one and the server has a mod-log channel, the text (up to 500 characters) is posted in that channel, not kept by Xylo.
Xylo safety records: a blacklist of Discord user and server IDs barred from Xylo, with the reason, who added it and when; a log of actions taken by Xylo staff; and command usage totals (counts only, not per person).
AI features: the text you send to an AI feature, such as Smile Hosting's assistant or Xylo's ask, summarise, and translate commands. For a summary, that includes the recent messages in the channel being summarised. If our team hands a support ticket in the Smile Corp Discord to Xylo, the ticket conversation (up to its last 40 messages, with display names) is used to write replies, and while it's on the ticket Xylo keeps the customer's and staff member's Discord IDs, a reply count, a short summary for staff, and which help pages it used.
Adverts: if you buy an advert on smilecorp.co.uk, the name and email you give, the advert itself (title, text, link, and a copy of its picture), where its link really led when we checked it, its payments and any refund, the IP address it was ordered from (to stop abuse), and how many times it was shown and clicked - as totals, not who saw or clicked it. Your email is used for the receipt and updates about that advert. See Section 7 of our Terms of Service.

2 How we use this information

To create and operate your account, and provide the Services you've signed up for.
To process payments and send purchase/billing confirmations.
To send account-security emails (e.g. when a passkey or authenticator app is added or removed, a password is reset, or an IP ban affects your account) so you can tell if something wasn't you.
To respond to support tickets, including replies from our staff, which are emailed to you as they happen.
To run Xylo's features in your Discord server, and to answer AI requests you make.
To detect and prevent abuse: fraud, spam, account takeover attempts, and enforcement of IP/device bans.
To comply with legal obligations where applicable.

We do not sell your personal information, and we don't use it for third-party advertising.

3 Device/IP fingerprinting and bans

To keep the platform fair (stopping banned users from simply creating a new account, and stopping automated abuse), Smile Hosting computes a fingerprint from browser/device signals (canvas rendering, screen properties, timezone, and similar) alongside your IP address and a first-party device cookie. This is used only for the ban/fraud enforcement described in our Terms of Service, is never shared with third parties, and is not used to track you across other websites.

5 Data retention

We keep your account information for as long as your account exists. Deleting your Smile Hosting account (from your dashboard's Account settings) permanently removes your profile, servers, and hosted files. Smile Auth keeps deleted vault items in the bin for 30 days and security activity for a year; its privacy page has the details. A Xylo dashboard login (including its Discord login token and server list) is kept for up to 7 days, or until you log out.

Some records, such as billing history required for tax/accounting purposes, or logs tied to an active ban/fraud investigation, may be retained longer where we have a legitimate reason or legal obligation to do so.

6 Your rights

Access & correction: view and update your profile info any time from your dashboard.
Deletion: delete your Smile Hosting account and its data yourself from Account settings, or ask us at the email below to delete your data from any of the Services.
Security controls: add or remove a passkey or authenticator app any time from your dashboard's Security section.

To exercise any other privacy right available to you under your local law, contact [email protected].

7 How we protect your data

Passwords are hashed (never stored in plain text).
Optional passkeys (WebAuthn) and authenticator-app 2FA for stronger login security.
Your Smile Auth vault is encrypted on your own device before it reaches us.
Every security-relevant change (a passkey or 2FA being added or removed, a password reset, an account suspension) triggers an email so you can catch anything you didn't do yourself.
Staff access to account-security tools (like removing a passkey for account recovery) is permission-gated and logged.

No method of storage or transmission is 100% secure, but we work to use practices appropriate to the sensitivity of the data involved.

8 Children's privacy

The Services aren't directed at children under 13, and we don't knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we'll remove it.

9 Changes to this policy

We may update this policy from time to time. We'll update the "Last updated" date above when we do, and for material changes, we'll try to notify you directly.

10 Contact

Questions about this Privacy Policy or your data? Reach us at [email protected].