Last updated: August 17, 2026

This policy explains what information Erothots collects, why it is collected, how long it is kept and what you can ask us to do with it. It covers this website and the configuration work we carry out for clients.

We have tried to write this in plain language rather than the usual legal wall. Where something is unusual about our business, it is spelled out rather than hidden behind a general phrase.

1. Who we are

Erothots provides configuration and setup services for servers, VPNs, firewalls, cloud environments and self hosted applications. The work is carried out remotely on hardware and hosting accounts that belong to our clients.

For the purposes of data protection law, Erothots is the controller of the information described in this policy. Our contact details are:

Erothots, 3230 Pike Street, San Diego, California 92103, United States
Telephone: +1 858 630 9723
Email: info@erothots.tech

2. What this policy covers

This policy applies to three separate groups of people and the information involved is different for each:

Visitors to erothots.tech who read pages and do not contact us.
People who make an enquiry through the contact form, by email, by telephone or through a messaging application.
Clients whose systems we are engaged to configure, where we are given access to servers, accounts or network equipment.

Each is dealt with separately below, because the third group involves far more sensitive information than the first two.

3. Information we collect

3.1 Information you give us

When you use the contact form, send an email or message us, we receive whatever you choose to include. That normally means:

Your name
Your email address
Your telephone or messaging number, if you provide one
The category of work you selected on the form
Whether you marked the enquiry as urgent
The description of your setup and the problem you are trying to solve
Any attachments you send, such as screenshots, error messages, configuration exports or log extracts

Configuration exports and log files often contain more than people expect, including internal addresses, hostnames, user names and occasionally credentials. Please review anything you attach before sending it and remove passwords and keys where you can.

3.2 Information collected automatically

Like nearly every website, our hosting and security layer records technical information about requests made to the site. This typically includes:

Your IP address.
The browser and operating system reported by your device.
The pages you requested and the time of each request.
The page or search result that referred you, where your browser sends it.

This information is generated by the server rather than by us and it is used to keep the site running, investigate errors and identify abusive traffic such as automated scanning or attempted intrusion.

3.3 Information we receive during an engagement

If you become a client, the work itself requires access to systems that belong to you. Depending on the job, that may include:

Login credentials, keys or tokens for servers, hosting accounts, control panels, firewalls or cloud platforms.
Configuration files, rule sets, address ranges and network diagrams.
Log files needed to diagnose a fault.
The names and email addresses of your staff, where accounts are being created for them.

This is the most sensitive category of information we handle and section 6 explains how it is treated.

4. What we do not collect

Being specific about the absences matters as much as listing the collections:

We do not operate a VPN service. We configure servers that belong to our clients. We do not run a network that carries anybody’s traffic and there is therefore no browsing activity, connection log or traffic record for us to hold.
We do not keep copies of client credentials after handover. See section 6.
We do not run a mailing list. Contacting us does not subscribe you to anything and we do not send marketing email.
We do not sell, rent or trade personal information to anyone, in any circumstances.
We do not use advertising networks or place advertising trackers on this site.
We do not knowingly collect information from children. See section 13.

5. Why we use this information

We use information only for the purposes below. Where data protection law requires a lawful basis, the basis is given alongside each purpose.

Purpose	Why and the lawful basis
Answering your enquiry	To reply, ask follow up questions and tell you whether we can help. Steps taken at your request before entering a contract or our legitimate interest in responding to people who contact us.
Preparing a quote	To assess what the work involves and what it should cost. Steps taken at your request before entering a contract.
Carrying out the work	To configure, repair or hand over the systems you have engaged us to work on. Performance of a contract.
Handover documentation	To produce the written notes describing what was done. Performance of a contract.
Keeping the site running	To operate the website, fix errors and block abusive traffic. Our legitimate interest in a secure and functioning website.
Accounting and records	To issue invoices and keep records required for tax and accounting. Compliance with a legal obligation.
Resolving disputes	To establish, exercise or defend a legal claim if one arises. Our legitimate interest in defending our position.

We do not use your information for automated decision making or profiling.

6. Credentials and access to your systems

This section describes the most sensitive part of what we do and it sets out commitments rather than generalities.

6.1 We ask for the least access that will do the job

Wherever the work allows it, we begin with read only access. Diagnosis of a firewall, a network or a cloud environment can almost always be carried out without the ability to change anything. Access is widened only when a change has been agreed and only for that piece of work.

6.2 Credentials are held only while the work is live

Credentials you provide are used for the engagement and nothing else. They are not shared with anyone outside the work, not used for any other client and not retained once the job is complete.

6.3 You change the passwords at handover

At the end of every engagement you are expected to change the administrative credentials and the handover notes say so. That is not a formality. It is the only way you can be certain that access has ended, rather than taking our word for it.

6.4 Configuration data

Configuration exports, rule sets and diagrams are kept only for as long as the engagement and any agreed support period require. Where we retain a copy for a support arrangement, that is agreed with you in writing and the copy is deleted when the arrangement ends.

6.5 What we will not do

We will not use access granted for one purpose to look at anything else on your systems.
We will not install monitoring, remote access or any other software that reports back to us, unless it is part of the work you asked for and you have been told about it.
We will not leave an account behind for our own convenience after handover.

7. Cookies and similar technologies

This website is built on WordPress. The following categories of cookie may be set:

Strictly necessary cookies. Set by the website software and it’s security layer to keep the site working, protect forms against automated abuse and remember a session if you log in as an administrator. These cannot be switched off without breaking the site.
Preference cookies. Used to remember choices such as a dismissed notice, where such a feature is present.
Analytics cookies. Used to understand which pages are read and how people arrive at the site, in aggregate. These are not used to build a profile of an individual.
Third party cookies from embedded content. The map on our contact page is embedded from Google Maps and Google may set cookies when that map loads. That is governed by Google’s own privacy policy rather than ours.

Most browsers allow you to block or delete cookies through their settings. Blocking strictly necessary cookies may prevent parts of the site from working correctly.

8. Third parties we rely on

We keep the number of third parties small. The ones involved in running this site and this business are:

Third party	What they do and what they see
Website hosting provider	Stores and serves the website and it’s database, including any enquiry submitted through the contact form. Has technical access to server logs containing IP addresses.
Google Maps	Provides the embedded map on the contact page. Receives a request from your browser when that page loads, which includes your IP address.
Email provider	Delivers and stores the email correspondence between us, including enquiries forwarded from the contact form.
Payment processor	Where a payment is taken, the processor handles the card or account details directly. We do not receive or store full payment card numbers.
Accounting records	Invoices and payment records are retained as required for tax purposes and may be shared with an accountant or tax authority where the law requires it.

Where hosting, licences or cloud services are needed for your project, those accounts are opened in your name and billed to you directly by the provider. We do not act as a reseller and do not sit between you and them.

9. How long information is kept

Information	Retention
Enquiries that do not become work	Kept for up to twelve months in case you come back, then deleted. You can ask for deletion sooner.
Correspondence with clients	Kept for the duration of the engagement and for up to two years afterwards, so that questions about work we did can be answered.
Credentials and access details	Deleted at the end of the engagement. You should also change them, as described in section 6.
Configuration data and handover notes	Kept for the engagement and any agreed support period, then deleted unless you ask us to hold a copy.
Invoices and accounting records	Kept for as long as tax and accounting law requires, which is generally several years.
Website and server logs	Retained by the hosting provider for a short period, typically weeks rather than months, then rotated out automatically.

10. How information is protected

We apply the same practices to our own systems that we recommend on our service pages:

Accounts protected with strong, unique credentials and multi factor authentication where the service supports it.
Encrypted connections for the website and for administrative access to any system.
Access limited to the people who need it, which on a small team means very few.
Devices kept patched, with disk encryption enabled.
Client credentials kept in a password manager rather than in email, notes or spreadsheets.

No arrangement is perfect and we would rather say so than promise otherwise. If we ever become aware of a breach affecting your information, we will tell you and the relevant authority within the timeframes the law requires.

11. Sharing and disclosure

We do not sell, rent or trade personal information. We share it only in these situations:

With the providers listed in section 8, to the extent needed for them to perform their function.
With your instruction or consent, for example where you ask us to speak with your hosting provider or another contractor on your behalf.
Where the law requires it, such as a valid court order, subpoena or lawful request from a public authority. Where we are legally permitted to tell you about such a request, we will.
To establish or defend a legal claim, if that becomes necessary.

12. International transfers

We are based in the United States and our clients are in many countries. Information you send us may therefore be processed in the United States and in any country where our hosting or email providers operate.

Where information is transferred out of the United Kingdom or the European Economic Area, we rely on the safeguards available under applicable law, which in most cases means standard contractual clauses entered into by the providers concerned.

13. Children

This site and these services are intended for businesses and adults. We do not knowingly collect personal information from anyone under sixteen. If you believe a child has provided us with information, contact us and it will be deleted.

14. Your rights

14.1 If you are in the United Kingdom or the European Economic Area

You have the right to:

Ask what personal information we hold about you and receive a copy.
Have inaccurate information corrected.
Ask for your information to be deleted, where we have no continuing reason to keep it.
Ask us to restrict how we use it or object to our use of it where we rely on legitimate interests.
Receive information you gave us in a portable format.
Withdraw consent at any time, where we relied on consent.
Complain to your national data protection authority.

14.2 If you are a California resident

Under the California Consumer Privacy Act as amended, you have the right to:

Know what categories of personal information we have collected, the purposes and the categories of third party we disclose to.
Request a copy of the specific pieces of personal information we hold about you.
Request deletion of personal information, subject to the exceptions in the statute.
Request correction of inaccurate personal information.
Not be discriminated against for exercising any of these rights.

We do not sell personal information and we do not share it for cross context behavioral advertising, so there is no opt out of sale or sharing to offer.

14.3 How to exercise any of these rights

Email us at the address in section 1 and say what you would like. We will respond within the timeframe the applicable law sets, which is one month under UK and EU rules and forty five days under California rules. We may need to confirm your identity before acting, particularly where the request concerns credentials or client systems.

There is no charge for a request unless it is manifestly unfounded or excessive.

15. Changes to this policy

If this policy changes, the updated version will be published on this page with a new date at the top. Where a change materially affects how we handle information belonging to an active client, we will tell that client directly rather than relying on them noticing.

16. Contacting us

For any question about this policy or to make a request about your information:

Email: info@erothots.tech
Telephone: +1 858 630 9723
Post: Erothots, 3230 Pike Street, San Diego, California 92103, United States

If you contact us about a privacy matter and are not satisfied with the response, you are entitled to raise it with your data protection authority. In the United Kingdom that is the Information Commissioner’s Office and in the European Economic Area it is the supervisory authority in your country of residence.

Privacy Policy