MSPZERO
Privacy

What this site does with data

A description of what the software on this server actually does, written against the code that does it. It is not a legal document and does not pretend to be one.

Reading the site

These pages are measured with Matomo, self-hosted on our own server at analytics.agit8or.net. It records the page you looked at, roughly where you came from, your screen size and your browser. Your IP address is sent to it and is used to derive an approximate location.

It is configured not to set cookies. Nothing is stored in your browser and nothing follows you between visits — which is why this site has no cookie banner. The trade is ours to make: it means our own visitor counts are an estimate rather than a count, and we would rather have that than ask you to dismiss a box.

It is ours, not a service. Nothing is shared with Google, with an advertising network or with anybody else, and there is no advertising, no tag manager and no embedded social content anywhere on this site.

The web server writes an ordinary access log — your IP address, the page requested, the time, the status code, the referrer and the browser's user agent — as any web server does. It is used for diagnosing faults and nothing else.

Using the contact form

The form collects, because you typed them:

  • Your name and email address, both required.
  • Your company and phone number, if you choose to give them.
  • Which of the three subjects the enquiry is about, and optionally which project.
  • Your message.

When you submit it, in this order:

  1. It is checked The fields are validated, the form's signed timestamp is verified and spent so it cannot be replayed, and — where Cloudflare Turnstile is configured — the challenge token is verified with Cloudflare, which receives that token and your IP address. Rate limits are counted against your IP address and against your email address.
  2. It is written to this server A record of the submission is saved in a file on this server, outside the public web directory, before delivery is attempted. That is what makes it impossible for an enquiry to be lost to a timeout, and what stops a retry from filing the same enquiry twice.
  3. It becomes a support ticket The contents are sent over HTTPS to the MSP Reboot control panel at cp.mspreboot.com, which opens a support ticket carrying your name, email, company, phone, subject, project and message, labelled as coming from mspzero.com. Staff read and reply to it there.
  4. You are told what actually happened Confirmation is only shown when the panel confirms the ticket exists. If the result was uncertain, the page says so rather than claiming success.

What is deliberately not sent

The ticket carries what you typed and nothing else. Your IP address, your browser's user agent, the page you came from and any session identifier are not included in it: none of them helps answer your question.

Anti-spam records

Refused submissions are counted in a short log on this server. It holds the time, the reason for the refusal, and a keyed hash of the IP address and of the email address — truncated, so it can group repeat attempts from one source without being reversible into the address itself. It never holds your message, your name, your raw address or your email. Entries are deleted after 14 days.

Rate-limit counters hold timestamps under a keyed hash of the address or email they count, and are deleted after 48 hours.

How long things are kept

  • Delivered enquiries. The local copy is deleted 90 days after delivery. From the moment the ticket exists, the support system is the record — this server keeps a copy only so that a failure to deliver is recoverable.
  • Enquiries that could not be delivered. Kept until somebody deals with them, because nothing else holds them.
  • The support ticket. Held in the MSP Reboot control panel under that system's own retention.
  • Abuse log. 14 days. Rate-limit counters. 48 hours.

Third parties involved

  • MSP Reboot's control panel (cp.mspreboot.com) — receives your submission as a support ticket.
  • Matomo (analytics.agit8or.net) — receives the page you viewed, your IP address, referrer, screen size and browser. Run by us, on our own hardware, and configured to set no cookies.
  • Cloudflare Turnstile — only if it is configured on this site. The widget loads from Cloudflare and the verification call sends them the challenge token and your IP address. It is used to tell a person from a script, not to profile you. If you do not see a challenge on the contact page, it is not in use and nothing is sent to Cloudflare.

There is nobody else: no CDN in front of this site, no email marketing platform, no advertising network, and nothing is sold or shared. Matomo is listed above as a third party for honesty about where the request goes, but it is our own installation on our own server — the data does not leave this estate.

Cookies

One, and only on the contact page. A session cookie named mz_form. It holds a token that proves a submission came from the form on this site, and what you typed if a submission failed so you do not lose it. It expires when you close your browser and it is not used to track anything.

Analytics sets none: Matomo runs here with cookies switched off. Browsing this site leaves nothing in your browser at all, which is why there is no banner asking you about it.

Asking about your data

Email support@mspreboot.com to ask what has been kept about an enquiry, or to have it deleted.

The projects

The five projects listed on this site are software you download and run on your own servers. They send nothing to this site or to MSP Reboot, and nothing about your use of them is visible here.