Privacy Policy

Baseline Web Hosting ("we", "us") provides web hosting and domain registration to customers in Canada and abroad. We keep this policy short and specific: it describes what actually happens on this website and in our billing system, not a generic template.

01Who we are

Baseline Web Hosting is a web hosting and domain registration provider based in Toronto, Ontario, Canada, operating the website webhostingbaseline.com and the client portal hosted on the same domain. We are the party responsible for the personal information described in this policy.

For any privacy question or request, write to billing@webhostingbaseline.com.

02What information we collect

We only collect what we need to open your account, bill you, register your domain and support your service.

Information you give us when you sign up

• Name — first and last name, and a company name if you enter one.
• Contact details — email address, phone number, and optionally a recovery email address.
• Billing address — street address, city, province or state, postal code and country. This is required by our payment processor and by domain registries.
• Tax ID — optional, only if you enter one for your invoices.
• Password — stored only as a cryptographic hash. We cannot read or recover your password.

Information created by using the service

• Billing records — your invoices, payments, receipts, credits and the services on your account.
• Support messages — anything you write to us in a support ticket or by email, including attachments.
• Technical logs — your IP address, browser type, date and time, and the pages or actions requested. These are produced automatically by our web server and control panel, and are used for security, abuse prevention and troubleshooting.

03Payment information

Card payments on this site are processed by Stripe, a PCI-DSS Level 1 certified payment processor. Your card details are transmitted to Stripe and are never written to our own database.

If you choose to keep a card on file for automatic renewal, that card stays with Stripe and we hold only the token that lets us charge it for your invoices. You can remove a stored card at any time from your client portal, or by asking us.

Stripe processes your payment data as an independent controller under its own privacy policy. Refunds, chargebacks and disputes are handled through Stripe and your card issuer.

04Domain registration and WHOIS

Registering a domain is not private by nature — it is a public record system with rules set by ICANN and by each country's registry. When you register or transfer a domain through us:

• Your registrant contact details (name, organisation, address, email, phone) are sent to our domain registrar and to the registry operating that extension — for example CIRA for .ca domains and Verisign for .com.
• Those parties are required to keep this data and may publish parts of it in the public WHOIS / RDAP directory, or disclose it where their rules require.
• For .ca domains, CIRA automatically withholds the personal contact details of individual registrants from public WHOIS. This protection does not apply to domains registered to a business or organisation.
• You must keep your registrant details accurate. ICANN rules allow a domain to be suspended if contact information is knowingly false and is not corrected.

We cannot delete data from a registry's records — that is outside our control. If you want a domain's public contact data changed, contact us and we will submit the change to the registrar.

05Your website, email and files

Your hosting account stores whatever you put in it: website files, databases, mailboxes and backups. That content belongs to you, and it may itself contain personal information about your visitors or customers — for that data, you are responsible and we act only as a service provider storing it on your behalf.

We do not read, use, mine or sell the contents of your hosting account. Our staff access it only when one of these applies:

• you ask us to, for support or migration;
• we must investigate a security incident, malware, spam or resource abuse originating from the account;
• we are legally required to, by a valid Canadian legal order.

06Cookies and tracking

The only cookies we set are the ones the site needs to function:

Cookie	Purpose	Life
Session	Keeps you logged in to your client portal and secures forms against cross-site request forgery.	Until you log out or the session expires
Preference	Remembers basic choices such as staying signed in, if you select that option.	Up to 30 days

Because these cookies are strictly necessary to deliver a service you asked for, we do not show a consent banner for them. You can block or delete cookies in your browser, but you will not be able to log in to the client portal without the session cookie.

07Who we share information with

We do not sell, rent or trade personal information. We never share it for someone else's advertising. We share only what a given provider needs to do its job:

Who	What they get	Why
Stripe	Card data, name, billing address, amount, email	To process your payment and store your card securely
Domain registrar & registry	Registrant name, address, email, phone	Mandatory to register or renew a domain
Infrastructure provider	Data stored on the server, including your hosting account	The physical servers our platform runs on
Email delivery	Your email address and message contents	To send invoices, receipts and support replies
Legal authorities	Only what is legally compelled	Valid court order, subpoena or law enforcement demand

If our business is ever sold or merged, customer accounts would transfer to the new operator. You would be told before that happens, and this policy would continue to apply until you are given a new one.

08Where your data is stored

Our billing system and hosting servers are operated on infrastructure that may be located outside Canada, including in the United States. Stripe and our domain registrar also process data outside Canada.

This matters legally: while your information is in another country, it is subject to that country's laws, and may be accessible to its courts and law enforcement. By using our service you understand that your data may be stored and processed outside Canada. We use providers that offer contractual and technical protections comparable to what PIPEDA requires.

09How long we keep it

• Billing and tax records — kept for six years after the transaction, because Canadian tax law requires businesses to retain financial records for that period. This applies even after you close your account.
• Account and contact details — kept while your account is open, and for the retention period above where they form part of a billing record.
• Hosting content and mailboxes — deleted after a service is cancelled, once the standard backup rotation has cycled out. Ask us if you need it removed sooner.
• Support tickets — kept up to three years, so we have the history if a related issue returns.
• Server logs — typically weeks to a few months, then overwritten automatically.
• Stored cards — removed as soon as you delete the payment method or close your account.

10How we protect it

• The whole site and client portal are served over HTTPS/TLS, so data is encrypted in transit.
• Passwords are stored as one-way hashes, never in readable form.
• Card numbers are tokenised by Stripe and never stored on our systems; sensitive billing fields we do keep are encrypted at rest.
• Administrative access to the billing system is limited to the people who run the service and is protected by strong authentication.

11Emails we send you

There are two kinds, and they follow different rules under Canada's anti-spam legislation (CASL):

• Service emails — invoices, receipts, renewal notices, service and security alerts. These are part of the service you bought and are sent for as long as you have an active account. They are not marketing and cannot be switched off while your account is open.
• Marketing emails — offers or news. These are sent only if you tick the opt-in box when signing up or ask us to add you. Every one of them has an unsubscribe link, and you can opt out at any time by replying or emailing us.

12Your rights

Under PIPEDA you may:

• Access the personal information we hold about you, and be told how it has been used and who it was shared with.
• Correct anything inaccurate or incomplete — most fields you can edit yourself in the client portal.
• Withdraw consent for optional uses such as marketing email, at any time.
• Request deletion of your data. We will delete what we are not legally required to retain — billing records must stay for the tax period described above.
• Complain to us first, and then, if you are not satisfied, to the Office of the Privacy Commissioner of Canada.

Email billing@webhostingbaseline.com with your request. We answer within 30 days, free of charge. We may need to verify your identity before releasing information — that protects your account.

13Children

Our services are sold to businesses and to adults. We do not knowingly market to or open accounts for children under 18. If you believe a child has given us personal information, contact us and we will remove it.

14Changes to this policy

If we change how we handle personal information, we will update this page and change the date at the top. For a change that materially affects you, we will also email account holders. Continuing to use the service after a change means you accept the updated policy.

15Contact us

Questions about this policy, or want to exercise any of the rights above? Reach us directly — a real person answers.

This policy is written to describe our actual practices in plain language. It is not legal advice. Last updated July 23, 2026.