We use account, billing, security and station information to provide and protect your service. We do not sell personal information and we do not store full card details. This policy explains our providers, automated service actions, international transfers, actual retention periods and your UK data-protection rights.
Who controls your personal information
Unlimited Radio Hosting Management (URH, we, us or our), 4 Collage Avenue, Belfast BT1 6BD, United Kingdom, is the controller of personal information used to operate this billing website and manage customer relationships.
Privacy enquiries and rights requests can be sent to office@unlimitedradiohosting.com. Billing and account enquiries can be sent to billing@unlimitedradiohosting.com.
This policy is written for the UK General Data Protection Regulation and the Data Protection Act 2018, as amended from time to time, including relevant changes made by the Data (Use and Access) Act 2025.
Scope and our different data roles
This policy covers the public website, registration, customer and administrator accounts, orders, subscriptions, invoices, support, security monitoring, notification emails and the connection of your account to AzuraCast or MediaCP radio services.
URH is normally the controller for account, contact, subscription, payment-status, support and platform-security information. When you operate a station, you decide what is broadcast, uploaded or collected from presenters, listeners and other people. For that station content and any personal information within it, you or your organisation will usually be the controller and URH will process it to host and transmit the service on your instructions. You are responsible for your own lawful basis, notices and rights handling for that information.
Third-party websites and control panels may publish their own privacy information. This policy does not control unrelated processing performed independently by those parties.
Information we collect
| Category | Examples |
|---|---|
| Identity and account | Name, email address, account role, customer status, email-verification state and account preferences. |
| Authentication and security | Password hash, multi-factor settings and encrypted secret, trusted-device record, session identifier, login attempts, IP address, browser or user-agent details, security events and password-reset records. |
| Orders and billing | Selected package, trial and subscription dates, price, currency, invoice and payment status, billing events, Stripe or PayPal subscription and transaction references, and limited payment-method details returned by your chosen provider. We do not receive or store your full card number, security code or PayPal password. |
| Radio service | Station name, backend and server assignment, package limits, provision and automation status, control-panel username, encrypted temporary access credentials where required, stream endpoints, ports, mount points, technical status and usage. |
| Station content | Audio, playlists, artwork, metadata and configuration hosted or transmitted for your station, together with operational information needed to deliver it. |
| Communications | Support requests, account and service emails, notification delivery status, administrator notes, consent choices and records of actions taken. |
| Technical and monitoring | Request time, IP address, route, response or failure information, job-queue events, server health, capacity, audit activity and diagnostic logs. |
Where information comes from
Most information comes directly from you when you register, order, configure a station, contact support or use the control room. An authorised administrator may create or update an account on your behalf.
We also receive payment and subscription events from Stripe or PayPal, depending on your chosen payment provider; delivery and failure events from our email provider; station, usage and service-state information from connected AzuraCast and MediaCP servers; and security or technical information generated automatically by browsers, servers and monitoring tools.
Why we use information and our lawful bases
| Purpose | Information | UK GDPR lawful basis |
|---|---|---|
| Create and administer an account | Identity, contact, verification and authentication data | Contract; legitimate interests in controlled account administration and security |
| Take orders and manage payment | Order, invoice, subscription, tax and payment-status data | Contract; legal obligation for accounting, tax and consumer records |
| Provision and operate radio services | Account, package, station, credentials, content and usage data | Contract; processing on a broadcaster’s documented instructions where URH acts as processor |
| Send essential notices | Contact, account, billing, service and security data | Contract; legal obligation; legitimate interests in reliable service communication |
| Provide support and handle complaints | Identity, communications, account and diagnostic data | Contract; legitimate interests in resolving issues and improving service |
| Prevent fraud, spam, abuse and intrusion | Authentication, IP, device, request, payment-status and security-event data | Legitimate interests in protecting customers and infrastructure; legal obligation where applicable |
| Monitor reliability and improve operations | Health, capacity, job, error and aggregated usage data | Legitimate interests in maintaining, diagnosing and improving the platform |
| Establish or defend legal rights | Relevant account, billing, content, communication and audit records | Legitimate interests; legal obligation; legal claims |
| Optional marketing or non-essential technologies | Contact details and consent or preference records | Consent, or legitimate interests only where applicable law permits; you may opt out at any time |
Our legitimate interests include securing accounts, preventing abuse, running an efficient hosting platform, communicating about the requested service and protecting legal rights. We balance those interests against the impact on individuals and use proportionate safeguards.
Fields marked as required, together with payment and service configuration needed for the selected package, are necessary to enter or perform the contract. Without them, we may be unable to create the account, process an order, verify identity or provide the station.
Automated service and security processes
For a verified account without a radio service or active subscription, we send an unused-account warning and allow at least 30 days before deleting account access. Adding a service cancels this countdown. We recheck service, billing and support activity before deletion. Historical invoices and necessary audit records are preserved; the former login email is released so you can register a new account. Dashboard announcements also store your individual read and dismissal choices.
Rules in the platform automatically allocate suitable server capacity, provision a station, react to payment events, change a service to past due or suspended, restore an eligible paid service, execute a requested end-of-period cancellation, terminate an expired service, delete unverified registrations after 24 hours, and rate-limit repeated or suspicious requests.
These processes use package, capacity, account, payment and security-event data. They do not create behavioural advertising profiles or credit scores. Some actions can significantly affect access to a paid service. If you believe an automated action is wrong, email billing@unlimitedradiohosting.com to request human review, explain your position and contest the outcome.
International transfers
Our business is based in the United Kingdom, but providers and radio servers may process information in the UK, European Economic Area, United States, Canada or another region selected for the service. A transfer outside the UK takes place only where a lawful transfer mechanism is available.
Depending on the recipient and destination, safeguards may include UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework for an eligible organisation, the UK International Data Transfer Agreement, or the UK Addendum to approved standard contractual clauses, together with supplementary technical and organisational measures where appropriate.
Contact office@unlimitedradiohosting.com if you want further information about the safeguard used for a particular provider or a copy of its relevant terms, subject to permitted redactions.
How long we keep information
We keep information only as long as needed for the purpose collected, including contractual, security, accounting, tax and legal requirements. Current operational periods include:
| Record | Typical period |
|---|---|
| Unverified registration | Deleted after 24 hours if email verification is not completed. |
| Password-reset and used email-verification records | Expired or used records are routinely cleaned after approximately 7 days. |
| Sessions and trusted devices | Expired sessions after 7 days; revoked session records after 30 days; remembered MFA devices expire after 7 days unless revoked sooner. |
| Login-attempt records | Approximately 1 day. |
| Security events | Approximately 180 days, longer where an active investigation or legal claim requires it. |
| Website and server monitor checks | Approximately 90 days. |
| Completed background jobs | Approximately 30 days; failures may remain while investigated or retried. |
| Account and service records | For the customer relationship, then only as needed to close the account and meet legal, fraud-prevention or dispute requirements. |
| Orders, invoices and material payment records | Generally 6 years after the relevant financial year or transaction, where needed for UK accounting, tax and legal claims. |
| Station media and configuration | For the active service, then deleted or de-identified following termination subject to operational backup cycles, disputes and legal holds. |
| Support, notification and audit records | For as long as reasonably needed for account history, delivery evidence, security, service quality or a legal claim, with content minimised where possible. |
Backups are isolated and access-controlled. Information deleted from active systems may remain in a backup until that backup is securely overwritten under its normal cycle; it is not restored for ordinary use. We may anonymise records so they no longer identify anyone and retain those statistics for longer.
How we protect information
Measures used according to risk include encrypted transport, one-way password hashing, encryption of API keys and temporary radio credentials, secure and HTTP-only cookies, cross-site request-forgery protection, role-based access, optional multi-factor authentication, login and request rate limits, email verification, session expiration and revocation, audit records, health monitoring and restricted administrative access.
Payment credentials are handled by your selected provider, Stripe or PayPal, rather than stored in the billing database. We do not collect your PayPal password. Temporary passwords and sensitive credentials are excluded or redacted from ordinary email logs where the workflow permits.
No internet service can guarantee absolute security. You should use a unique password, enable multi-factor authentication, protect your email account and notify us promptly of suspicious activity. If a personal-data breach creates a legally reportable risk, we will notify the ICO and affected people as required.
Your UK data-protection rights
Depending on the circumstances, you may ask us to:
- give you access to personal information and a copy of it;
- correct incomplete or inaccurate information;
- erase information;
- restrict how information is used;
- provide certain information in a portable format;
- stop processing based on consent by withdrawing that consent; or
- provide human review of a qualifying solely automated decision.
You may object to processing based on our legitimate interests. You have an absolute right to object to direct marketing. We will stop unless we have compelling lawful grounds to continue, or the processing is needed for legal claims.
Email office@unlimitedradiohosting.com to exercise a right. We may ask for information needed to verify identity and locate the record. Requests are normally free and answered within one month, although the law permits an extension for a complex request and a reasonable fee or refusal for a manifestly unfounded or excessive request.
Please contact us first if you have a concern so we can try to resolve it. You can also complain to the Information Commissioner’s Office, the UK supervisory authority, or call its helpline on 0303 123 1113.
Service messages and marketing
We send messages required to run your account, including verification, password, security, invoice, payment, provisioning, suspension, termination and service-status notices. These are not marketing and may be necessary while you hold an account or subscription.
If we send optional promotional messages, you can opt out using the unsubscribe method in the message or by contacting us. Opting out of marketing does not stop essential account communications. We do not sell contact details or use them for third-party behavioural advertising.
Children
The billing and radio-hosting service is intended for people aged 18 or over and is not directed to children. Do not create an account or provide us with a child’s personal information without a valid legal basis and any necessary parental authority. If you believe a child has registered, contact us so we can investigate and delete the account where appropriate.
Changes and contact
We may update this policy to reflect changes in law, providers, technology or the service. The current version and effective date will always be published here. We will give a prominent notice or direct communication where a change materially affects how we use personal information.
Questions, complaints and rights requests can be sent to office@unlimitedradiohosting.com or posted to: Unlimited Radio Hosting Management, 4 Collage Avenue, Belfast BT1 6BD, United Kingdom. For an account-specific request, use your registered email address where possible.