Terms of Service

01 The agreement

These Terms of Service are the contract between VPSRento (“we”, “us”, “VPSRento”) and the person who controls the access token for an account (“you”). VPSRento has operated VPS hosting continuously since March 2021.

You accept these terms by deploying a VPS, paying an invoice, or adding credit to a balance. If you do not accept them, do not deploy. There is no click-wrap page because there is no signup form — the first paid invoice is the signature.

Four related documents are part of this agreement and incorporated by reference:

• the Acceptable Use Policy — what you may and may not run;
• the Privacy Policy — the little we store and the much we don’t;
• the Refund Policy — the 72-hour guarantee and why crypto refunds don’t exist;
• the Service Level Agreement — the 99.9% uptime commitment and automatic credits.

If these documents ever conflict, the more specific one wins: the SLA for availability, the Refund Policy for money, the AUP for content.

One consequence of anonymity deserves stating up front: because we hold no identity for any account, whoever holds the access token is the account holder as far as we can ever know. Keep that in mind as you read.

02 The service

VPSRento provides KVM virtual private servers in fifteen jurisdictions — Iceland, Switzerland, Panama, Moldova, Romania, the Netherlands, Russia, Tonga, the Cayman Islands, Seychelles, Belize, the Bahamas, Bulgaria, Ukraine, and Hong Kong — on Linux and Windows plans, plus related add-ons: daily offsite snapshots, additional IPv4 addresses, and L7 DDoS filtering.

The split of responsibility is simple. We provide the virtual machine, the storage, the network, the power, and the DDoS-protected edge. You are the administrator of everything above the hypervisor: the operating system, the software, the configuration, the data. We have no management agent inside your server, no backdoor account, and no way to read your disk while it is attached to a running VM.

Through the client area we can, at your request: reboot, reinstall (which wipes the disk), resize, set reverse DNS, suspend, and terminate. We do not log in to customer servers. Support that requires touching your OS is support we structurally cannot give.

Provisioning targets — a median of 55 seconds for Linux, about four minutes for Windows — are targets, not guarantees. The SLA covers availability, not deploy speed.

03 Your account is a token

Accounts at VPSRento are not identified by an email address, a username, or a name. Signup generates a 24-character access token in the format VPR-XXXX-XXXX-XXXX-XXXX. The token is displayed exactly once, at creation. We store only a one-way cryptographic hash of it.

There is no account recovery. We cannot reset what we never knew. If you lose the token, access to the account — every service on it and every dollar of balance on it — is unrecoverable, by you and by us. This is a feature, not an oversight: an account that can be recovered by “proving your identity” requires an identity on file to check against. We keep none.

The mitigations are in your hands and they are good ones: store the main token offline like a private key, and generate sub-tokens in Settings for daily use. Sub-tokens can be revoked individually without touching the main token.

You are responsible for everything done under a token you control. If you suspect a sub-token has leaked and you still hold access, revoke it immediately from Settings. If you have lost access entirely, there is nothing we can verify you by — and we will not invent a verification process on the spot, because that process would be the attack surface.

You may hold as many accounts as you like. One limit: creating chains of accounts to repeatedly harvest first-order benefits (the 72-hour guarantee) is abuse of the guarantee, and it voids them. See the Refund Policy.

04 Orders, payment & renewals

Prices are quoted in US dollars and payable in BTC, XMR, ETH, LTC, USDT (TRC-20 or ERC-20), or SOL, processed by Paymento. We do not accept cards, PayPal, or bank transfers, and never will. An order is accepted — and these terms bind — when the payment confirms on-chain and the service deploys.

If a payment arrives underpaid, the received amount is credited to your balance and the invoice stays partially open. If it arrives overpaid, the full received amount is credited and the surplus sits on your balance. Crypto sends what it sends; we account for what arrives.

Billing cycles are monthly, quarterly (−10%), six-month (−30%), and annual (−50%). Cycle discounts apply automatically at checkout; no promo codes exist.

Renewals work from balance. If auto-renew is enabled and your balance covers the invoice, it settles on the due date without you doing anything. Otherwise the invoice waits in the client area. The overdue timeline is fixed and automatic:

If you run services you care about, keep a buffer on the balance or enable auto-renew. Thirty days of grace is long enough for anyone paying attention, and we cannot stretch it for anyone anonymous — there is no identity to grant an exception to.

05 Suspension & termination

We may suspend a service when:

• an AUP violation is reported and verified by the abuse desk;
• a valid court order from the jurisdiction where the service runs requires it;
• the invoice is 7 or more days overdue (automatic, per §04);
• the service is actively attacking the network or other customers — outbound DDoS, a live spam run, exploitation in progress. Ongoing attacks can be suspended immediately, without prior warning, because the warning period is someone else’s outage.

Zero-tolerance categories — child sexual abuse material and botnet command-and-control — terminate immediately and take the account with them. See AUP §02.

Whenever we suspend, we say so via a client-area ticket, with the reason. The only exception is where a court order legally forbids disclosure.

You may terminate any service at any time from the client area. Termination wipes the disk promptly. Prepaid time beyond the 72-hour first-order guarantee is not refunded — the terms of that are in the Refund Policy.

Whether termination is your choice or ours, understand the mechanics: we destroy data on termination and we cannot restore what we have destroyed. Keep your own backups. The snapshots add-on exists for exactly this, and it survives nothing if the account itself lapses to the +30-day mark.

06 Acceptable use

The Acceptable Use Policy is part of this contract. The one-paragraph version: no spam, no botnets, no CSAM, no network attacks, no scanning or exploiting third parties, no phishing, no mining that steals CPU from neighbors. Tor relays and exits, VPN and proxy services, seedboxes, mirrors, game servers, and legal adult content are explicitly allowed under the conditions the AUP lists. We enforce it without exceptions, because one customer’s abuse is every other customer’s seized server and null-routed subnet.

07 Content & third-party complaints

Your content is your responsibility. We do not pre-moderate, and we could not if we wanted to — we have no visibility into a running server.

The DMCA is United States legislation. We operate no servers in the United States and answer to no US notice-and-takedown regime. DMCA notices are discarded unread; the industry term for the file they go to is /dev/null.

Two things do move us to act:

• a valid court order issued in the jurisdiction where the specific service is hosted;
• a verified violation of our own AUP, handled through the abuse process in AUP §05.

When a complaint about your service arrives and the abuse is not ongoing, the default is to forward the technical evidence to you via ticket and ask you to resolve it — not to suspend first and ask questions later. Privacy hosting that folds at the first angry email is not privacy hosting, and we have had five years of practice at telling the difference between an angry email and a court order.

08 Liability

The service is provided “as is” and “as available”. We commit to the SLA and to the policies linked from this document; beyond that we disclaim implied warranties to the maximum extent the governing law allows.

Our aggregate liability to you for any claim arising from a service is capped at the total amount you paid us for that service in the three months preceding the event. We are not liable for indirect or consequential damages: lost profits, lost revenue, lost data, lost goodwill, or the cost of substitute services.

Credits under the SLA are the sole and exclusive remedy for availability failures.

Specifically, and without limiting the above, we are not liable for: your data (keep backups); network paths outside our control; failures of Paymento, a blockchain, or your wallet software; a lost access token; or anything your server does to a third party — that one is yours in both directions.

Nothing in this section excludes liability that cannot be excluded under the governing law — for example, liability for willful misconduct.

09 Governing law & disputes

These terms are governed per service, not per account. The law governing a given service is the law of the jurisdiction where that service is physically hosted, and disputes about it belong to the courts of that jurisdiction. A VPS in Reykjavik answers to Icelandic law; one in Bucharest to Romanian law; one in Panama City to Panamanian law; and so on for all fifteen locations.

This is deliberate and we will not paper over it with a single convenient venue: it matches the reality of enforcement. A court order has to reach the rack, and the rack is in the jurisdiction.

Before either side files anything, there is a mandatory informal step: open a ticket and give us 30 days to resolve the dispute. Five years in, every dispute so far has been a misunderstanding that a real engineer could fix. Median first reply is 14 minutes.

Disputes are individual. No class actions, no representative proceedings.

10 Changes to these terms

We may revise these terms. Material changes take effect no sooner than 30 days after announcement, and announcement happens in exactly two places: the warrant canary page — PGP-signed and tamper-evident — and a site-wide banner. Those are the channels because they are the only ones that reach anonymous customers. There is no mailing list. There will never be a mailing list.

Continuing to use a service after the effective date of a change is acceptance of the change. If you disagree with a revision, your remedy is to stop renewing; prepaid terms run to their end under the version you accepted.

Version history, for the record: v1 in March 2021 (two pages), v2 in 2022 (the token system, written down properly), v3 in 2024 (seven jurisdictions), v4 in June 2026 (this text). Each revision has been longer than the last by less than the lawyers warned us it would be.

11 Contact

Questions about these terms: open a ticket in the client area — fastest, and it authenticates you by token. Abuse matters go to the Abuse department there too, not to a mailbox (there are none).

No phone. No live chat. Chat widgets are trackers, and a phone number is an identity.