Privacy Policy
Last updated: 25 October 2026
1. Who We Are
Gravity Host is a trading name of GK Tools Ltd, a private limited company registered in England and Wales (company number 16434833), registered office 483 Green Lanes, London, N13 4BS, United Kingdom. GK Tools Ltd is the data controller for personal data processed through Gravity Host and is registered with the Information Commissioner's Office (ICO) under registration number ZB899192. We are a UK-based web hosting provider offering cPanel hosting, domain registration, and website services. Contact for anything in this policy: support@gravityhost.co.uk.
2. Data We Collect
We collect your name, email address, billing details, and website data as needed to deliver hosting and support services.
For the Website Builder waitlist, we collect the email address and optional name you submit, the licence tier you are interested in, and a fixed source label showing whether the request came from the public Website Builder page or your signed-in account. We do not keep the form referrer, browser user agent or raw IP address in the waitlist record. To prevent automated abuse, the request's network address is converted in memory into a keyed network pseudonym; only that pseudonym is written to the separate, short-lived rate-limit record.
3. How We Use Data
We use your data to manage your account, process payments, provide technical support, maintain our services, and record the Website Builder product interest you ask us to keep. We do not sell your personal data to third parties.
4. Lawful Bases for Processing
We process your personal data under the following lawful bases: Contract — to provide the hosting, domain and support services you purchase (account details, billing, service data). Legal obligation — to keep accounting and tax records. Legitimate interests — to secure our network and prevent fraud and abuse, and to know that the emails and texts we send you have arrived. Consent — when you ask us to record a Website Builder waitlist interest, and for optional Matomo measurement and Google Analytics cookies. You can withdraw consent at any time by contacting us, or use Cookie settings or Analytics settings in the footer for analytics.
5. How Long We Keep Data
We keep account and service data for as long as your account is active. After an account or service is closed, hosted data may be deleted after 30 days (see our Terms of Service). Billing and invoice records are kept for 6 years after the end of the relevant financial year, as required by UK tax law. Support correspondence is kept for as long as needed to handle your request and improve our service. Analytics data is anonymised as described below.
Website Builder waitlist names, email addresses, tiers and fixed source labels are kept for up to 12 months from the original submission, then removed by the hourly cleanup. Sending the same email and tier again does not extend that period or change the existing record. Separate rate-limit events contain only the keyed network pseudonym: they are deleted once more than 10 minutes old during normal waitlist traffic, with an hourly cleanup as a backstop.
6. Data Sharing
We share data only where necessary to deliver our services: with payment processors (to take payment), with domain registrars and registries (to register and manage your domains — your contact details form part of the domain registration record; some registries, including .uk and .eu, keep an individual's details out of the public WHOIS record by default), with our text-message provider, Esendex (formerly Voodoo SMS), run by Commify UK Limited (company 04217280), data stored in the UK, which receives your mobile number and the message when we text you a sign-in code or an account notice and keeps message content for 6 months and traffic data (including your mobile number) for up to 2 years, and with our upstream hosting infrastructure provider. Each provider acts under contract terms consistent with the UK GDPR, and we never sell your personal data.
7. Security
We protect your data with encryption in transit (TLS), access controls, and UK-based infrastructure. Portal passwords are stored as one-way hashes. No system is 100% secure, but if we become aware of a personal-data breach that risks your rights we will notify you and, where required, the ICO without undue delay.
8. Your Rights
Under the UK GDPR and the Data Protection Act 2018 you have the right to: access the personal data we hold about you; have inaccurate data corrected; have your data erased; restrict or object to our processing; receive your data in a portable format; and withdraw consent at any time where processing is based on consent (for example, Matomo or Google Analytics). To exercise any of these rights, email support@gravityhost.co.uk. We will respond within one month.
If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. We would appreciate the chance to resolve your concern first — contact us at support@gravityhost.co.uk.
9. Cookies
We use essential cookies for login and session management on the customer portal and to remember your analytics choice. Matomo and Google Analytics are optional: you can accept or reject them using our analytics choices. Rejecting stops both tools and clears historic analytics cookies from this site.
10. Analytics
We use two optional analytics tools on our public website and customer portal, only after you choose Accept:
Matomo (self-hosted, primary)
Matomo is an open-source analytics platform that runs entirely on our own infrastructure in the United Kingdom — your data is never shared with third parties or sent abroad. The Matomo script and collection endpoint are not contacted before consent, and Matomo remains cookieless after consent.
The data Matomo collects is limited and anonymised:
- Anonymous marketing-page and generic portal-section visits and engaged visit duration
- Referring site, with query strings removed (how you arrived here)
- Approximate location (country/region only; the last two octets of your IP address are discarded before storage)
- Browser, device type, and screen resolution (for compatibility checks)
- Scroll-depth milestones and views of important page sections
- Generic navigation, call-to-action, form-start and form-submit events, including which fixed hosting size was previewed or chosen
We never collect the contents of forms, search terms, names, email addresses, account identifiers, customer or searched domain names, invoice or ticket references, payment details, or URL query strings through Matomo. Private portal routes are reported only as fixed section names such as "Billing" or "Support".
Manage Matomo and Google Analytics:
Google Analytics (third-party)
After you choose Accept, we also use Google Analytics 4 to supplement our visitor data. Google Analytics is operated by Google LLC and may transfer data outside the UK. It sets cookies in your browser (e.g. _ga, _gid) to recognise returning visits.
The data Google Analytics collects includes pages visited, traffic source, approximate location, device and browser. It does not collect your name, email address, or any account information.
Withdraw analytics consent: choose Reject in our analytics banner or reopen Cookie settings or Analytics settings in the footer. This stops both Matomo and Google Analytics. You can also install the official Google Analytics Opt-out Browser Add-on or use browser-level tracking protection.
Where Google transfers data outside the UK, those transfers are protected by UK-recognised safeguards (such as the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Addendum). All other data we process is stored in the United Kingdom.
11. Emails and Texts We Send You
Our emails to you (invoices, reminders and other account emails) contain a tiny image loaded from gravityhost.co.uk, and their payment and billing links pass through gravityhost.co.uk on the way to the page. Links in our text messages work the same way. Replies to your support requests contain a similar tiny image and links that pass through core.gk.tools, the system our support team works in.
When you open one of these emails or click one of these links, we record that it happened, when, the app or browser used and your IP address (for support replies, the IP address is stored encrypted). This tells us our message reached you, so we know whether to try another way. We do not use it for advertising or to build a profile of you, and it is never shared or sold. The IP address and app or browser details are deleted after 90 days; the fact that the email was opened or a link clicked, and when, stays with the email record. If your mail app blocks images, opens are not recorded; links work the same either way.
12. Language Translation (Google Translate)
Our public pages offer an optional language switcher, powered by Google Translate. It is deliberately not loaded until you use it: on an ordinary visit no Google Translate code runs and none of the page you are reading is sent to Google. We built it this way so that simply reading our site does not send your reading to a translation service.
To be precise about what an ordinary visit does involve: our pages use web fonts hosted by Google, so your browser requests those font files from fonts.googleapis.com and fonts.gstatic.com on any visit. Those requests carry your IP address and browser details, as any request to any server does. They carry no cookie from us, no page content and no analytics identifier, and they happen whether or not you accept analytics.
If you do choose a language, two things happen. Your browser stores a googtrans cookie remembering the choice, and the text of the page you are viewing is sent to Google so it can be translated. Google is an independent controller for that processing and handles it under its own privacy policy; this may involve transfers outside the UK. Selecting English clears the cookie and no further requests are made.
Translations are machine-generated and provided for convenience only. The English text is the original and is the version that legally applies — please read our prices, hosting terms and Terms of Service in English before purchasing. The switcher is not offered inside the signed-in customer portal, so billing and invoice screens are never machine-translated.
13. Gravity AI Connect
If you choose to connect a compatible third-party AI service through Gravity AI Connect, we process the information needed to authorise and secure that connection. This includes your account identifier, the connecting application and return address, the permissions you approve, token and connection metadata, and a record of tool requests and their outcome. Access and refresh tokens are stored as cryptographic hashes rather than reusable plain-text tokens.
The AI service receives only the account, Builder or website-file information returned in response to tools you have approved. Website-file access is optional and separate from Builder access. Before an approved file change, we keep an encrypted safety snapshot for up to 14 days so the change can be verified or restored. Routine AI activity records are normally retained for up to 180 days; connection, revocation and suspected token-reuse security events for up to 400 days; and associated IP address and browser details for up to 30 days. We may retain a record for longer where required to investigate abuse, meet a legal obligation or resolve a support dispute.
Your chosen AI provider processes information under its own terms and privacy policy. Removing a connection stops future Gravity AI Connect access but cannot remove information the provider already received. We do not ask for or store your AI-provider password, and Gravity AI Connect does not use your cPanel password.
14. AI-Assisted Support Replies
When you contact our support team, we may use Claude, an AI service provided by Anthropic, to help our staff prepare a reply. To do this it receives your message thread and the account details needed to answer it, such as your name, your services, your domains and your invoices. It never receives your passwords or card details.
A member of our team reads every reply before it is sent; the AI never writes to you directly. Model training is switched off on our Anthropic accounts, so your messages are not used to train AI models. We do not use your messages for advertising, and we never sell or share them.
15. Address Suggestions (Google Maps Platform)
When you fill in your address on our order, checkout or account settings pages, we can suggest complete addresses as you type, using Google Maps Platform (address suggestions). This helps you enter an address that domain registries accept, with the postcode in the right format.
Nothing is loaded from Google until you click or tap into the address field. Your browser then loads Google's address-suggestion code, and only once you start typing in that field is the address text you have typed so far sent to Google to find matching addresses. If you pick a suggestion, Google returns that address and we fill in your street, town, postcode and country for you to check. Like any request to any server, these requests carry your IP address and browser details. We do not send Google your name, email address, account details or anything else on the form.
Using the suggestions is optional: you can ignore them and type your address yourself, and the form works the same either way. Google handles this data under its own privacy policy, and this may involve transfers outside the UK.
16. Changes to Policy
We may update this policy from time to time. We will post changes on this page and, for significant changes, notify account holders by email. This policy was last updated on 25 October 2026.
17. Contact Us
Questions about privacy? Email support@gravityhost.co.uk.