Privacy Policy
Version 1.2 · Last updated 24 October 2026
1. Who we are and what this covers
AYRAA is a website builder and hosting service operated in Nepal ("we", "us"). This policy explains what personal information we collect, why, who we share it with, how long we keep it, and the rights you have under Nepal's Individual Privacy Act, 2075 (2018) and the rules made under it.
It covers:
- the people who use the AYRAA admin panel: our clients and their staff ("you");
- people who contact us by email, phone or message, including about becoming a client;
- people who report misuse of a website we host (section 9).
It does not cover the visitors of our clients' websites. Each client's website has its own privacy notice, at the address /privacy on that website. For the messages those visitors send through a client's website, the client decides what happens to them and we store them on the client's behalf (section 6).
Questions about privacy: (email address to be confirmed).
2. What we collect
Your account
- your name and email address;
- your password, which we never store as written: we keep only a salted, one-way hash, so nobody, including us, can read it back;
- your role, and the business account you belong to.
When you sign in and use the admin panel
- a record of each open sign-in session, so that signing out ends it on our server. It holds no IP address, and it is removed when you sign out, or once it has gone unused for 24 hours;
- a security log of sign-ins, sign-outs and changes (who did what, and when), which includes the IP address of the device used;
- failed sign-in attempts, used to pause or lock an account under attack;
- our servers' logs, which record the IP address and the address of each page asked for, to keep the service working and secure.
What you put into your website
- the text, photos and settings you add. We remove location (GPS), camera and other hidden data from every copy of a photo shown on a website. We also keep the original file you uploaded, in private storage that is never shown publicly, for as long as the photo stays in your library.
Billing
- your business's name, address and PAN or VAT number if you give one, your invoices, and the payments you make (amount, date, method and reference). We do not receive or store card or wallet passwords.
When you contact us
- your name, contact details and what you write to us.
We do not ask for sensitive information such as health, religion, caste, political views or biometric data, and we ask you not to put any into the service.
3. Why we use it
| Purpose | Information | Why we may |
|---|---|---|
| Providing your account and your website | account, content | our agreement with your business, and your consent when you create the account |
| Keeping the service secure, stopping misuse, investigating incidents | sessions, security log, failed sign-ins, server logs | to protect you, other clients and the service, and our agreement |
| Billing, tax and accounting | billing records | the law (Nepal's tax law requires us to keep records), and our agreement |
| Support and messages about the service (outages, changes to our terms) | name, email, what you write | our agreement |
| Answering you before you become a client | what you write to us | your request |
| Enforcing our Acceptable Use Policy (section 9) | published content, connected domains, security log, enquiry counts, reports | to protect other businesses, visitors and the service; the law where an authority asks |
We use your information only for the purpose we collected it for. We do not use it for advertising, do not sell it, and do not use it to make automated decisions about you.
4. Consent
By creating an account, or by being given a login by your business, you consent to the collection and use described here. You may withdraw consent by asking your business's administrator to remove your login, or by asking us to close the account. Withdrawing consent does not affect what we did before, and we may keep what the law requires us to keep (section 8).
5. Who we share it with
Only with the providers who help us run the service, and only what each needs:
| Provider | What for | Where |
|---|---|---|
| Hostinger | runs our server: the admin panel, the database and the websites | India |
| Cloudflare | carries traffic to the websites and the admin panel, stores and delivers uploaded photos, serves the icons | worldwide |
| Google (Gmail) | sends the emails that tell our clients about an enquiry, and receives emails sent to us | worldwide |
| Backblaze | keeps an encrypted copy of the database each night, for recovery | United States or European Union |
| Google Fonts | supplies the typefaces of the admin panel, so receives the IP address of anyone using it | worldwide |
| Your bank, Fonepay, eSewa or Khalti | the payment you choose to make to us | Nepal |
We disclose personal information to anyone else only:
- with the consent of the person concerned;
- when an investigating authority asks in writing in a criminal matter, a court orders it, or another authority with legal power asks in writing on a specific matter;
- when it is needed to protect a person, the service or another business from fraud or serious harm;
- to a business whose name, domain, content or customers a client used in breach of our Acceptable Use Policy: what we found and what we did (Acceptable Use Policy, section 10). Clients agree to this when they accept our Terms.
6. Information we hold for our clients
When a visitor writes through a client's website, we store their name, email, phone number, message (including the answers a booking form asks for), the page they sent it from, the time, their IP address and browser details, and we email the message to the client.
For that information the client decides what happens to it, and we act only on the client's behalf, as set out in our Terms of Service. We keep it while the client's account is active and delete it when the account's data is deleted (section 8); a client can delete an enquiry sooner from their admin panel, or ask us to. A visitor who wants to see or delete their message should contact the business they wrote to. They may also write to us, and we will pass the request on.
7. Information outside Nepal
Our server is in India, and some providers in section 5 handle information in other countries. We choose providers that publish their own security and privacy commitments, and we send each one only what it needs. By using the service you consent to this transfer.
8. How long we keep it
| Information | Kept for |
|---|---|
| Your account, website content and photos | while your business's account is active, then up to 90 days after it ends, so the business can come back or ask for a copy; then deleted |
| Enquiries we hold for a client | the same as the client's account, unless the client deletes one sooner |
| Sign-in sessions | a session ends after 8 hours without use, and at most 24 hours after you signed in with your password; its record is removed when you sign out, or once it has gone unused for 24 hours |
| Security log (email address, IP address) | up to 5 years, then deleted |
| Server logs (IP address, page asked for) | a short time, normally about two weeks |
| Billing records | at least 5 years after the end of the income year they belong to, as Nepal's Income Tax Act requires |
| Messages you send us | up to 2 years after our last exchange |
| Misuse reports and what we did about them | up to 2 years after the matter is closed |
| Backups | our nightly copies of the database are replaced within about 30 days |
9. Checking for misuse
Our Acceptable Use Policy says each website is for one business, and forbids, among other things, building pages for another business, and pointing or redirecting another business's domain or visitors to a website we host. To enforce it:
- We look when there is a reason: a report, a complaint, a request to connect a domain, unusual use, or an authority's request. We may also check at random. We do not monitor anyone continuously.
- What we look at: the client's published pages and earlier versions, the domains connected to the website and public records about them, where the website's links lead, the security log, and how many enquiries the website received and when.
- Enquiry contents: we read them only to investigate a specific report, or when the law requires it.
- If you report misuse to us, we keep your name, contact details and report, and use them only to deal with it. We may tell the client what the report says, but not who made it, unless you agree or the law requires.
- What we keep: a record of what we found and what we did, including copies of the pages concerned, for the period in section 8. We share it only as section 5 allows.
10. How we protect it
- connections to the admin panel and the websites use HTTPS;
- passwords are hashed, never stored as written and never sent by email;
- each client's information is kept separate, and every admin screen checks that you belong to that client;
- signing out ends your session on our server, not just in your browser;
- sign-ins are slowed and accounts locked after repeated failures;
- only the people who run the service can reach our servers.
No system is perfectly secure. If a breach puts your information at risk, we will tell the businesses affected without undue delay, and the authorities where the law requires.
11. Cookies
The admin panel uses only the cookies it needs to work:
- a sign-in cookie, which keeps you signed in; it expires after 8 hours without use, and in any case 24 hours after you signed in with your password;
- a security cookie that protects forms against cross-site request forgery;
- a message cookie, which carries a confirmation (such as "Page saved") from one screen to the next and is deleted once shown.
There are no advertising or analytics cookies, and no tracking, in the admin panel.
12. Your rights
Under Nepal's Individual Privacy Act, 2075, and, where it applies to you, the European Union's or the United Kingdom's data protection law, you may ask us to:
- tell you what personal information we hold about you and why;
- give you a copy of it;
- correct what is wrong;
- delete it, where we no longer need it and the law does not require us to keep it;
- stop using it for a purpose you did not agree to.
Write to (email address to be confirmed). We will reply within 30 days, and may first need to confirm who you are. Your business's administrator can also correct or remove your admin login.
If you suffer loss because we broke the law on privacy, you may claim compensation as the Act allows, and you may complain to the authorities responsible.
13. Age
The admin panel is for businesses. You must be at least 18 to use it. We do not knowingly collect information about anyone younger.
14. Changes to this policy
We will publish every update on this page with a new version number and date, and email the businesses we serve at least 30 days before a significant change takes effect.
15. Contact
AYRAA · Email: (email address to be confirmed)
Our Terms of Service and Acceptable Use Policy are on the pages beside this one.