Hostinger Privacy Policy 2026: What India's Page Does Not Say

hostinger.in's privacy policy — the page an Indian customer reaches, which resolves to hostinger.com/in/legal/privacy-policy — is written to European law and says so plainly: "All personal data are processed in accordance with the General Data Protection Regulation (EU) 2016/679".

We counted the words. Across the entire document, "GDPR" appears 26 times. "India" appears zero times. "Digital Personal Data Protection" and "DPDP" appear zero times. The address given for withdrawing consent is gdpr@hostinger.com. Individual clauses are pegged to GDPR article numbers — marketing by email rests on "Art. 6(1)(f) of the GDPR", marketing by SMS on "Art. 6(1)(a)" — each carrying the qualifier "where applicable".

This is a statement about what the document says, and nothing more. A company can meet its obligations to Indian customers without naming an Indian statute in its privacy policy, GDPR-standard handling is a high bar wherever it is applied, and whether this or any policy complies with Indian law is a question for a regulator or a court rather than for this page. Nothing here alleges non-compliance with anything.

Why it is worth knowing anyway: the rights section tells you to take complaints to "the national Data Protection Agency in their country of residence", which is a sensible and jurisdiction-neutral instruction, and the practical route it points an Indian customer towards is an Indian one. If you ever need to exercise a right here, the vocabulary you will be met with is European.

This is the clause most likely to surprise someone buying a Rs. 749 domain. Under the heading "Identity verification information", the policy states that to comply with ICANN rules, "before the registration of the new domain name or thereafter, Hostinger may collect identity verification information (such as images of your passport, national ID card, valid driving license or other documents as required or permitted by applicable laws or regulations)".

The trigger is worth reading twice: "or thereafter". Identity documents may be asked for after the domain is already registered, not only at purchase. The policy adds that such information "may also be collected in other legitimate cases described in the legal acts, Terms of Service or this Privacy Policy", and a separate clause covers payment-fraud checks, where Hostinger "may request limited payment-source information or transaction documentation".

Then the part that is genuinely public. "The WHOIS database is a publicly accessible database that lists the domain name registration information for a particular domain name" — and in the retention section, domain registration data is listed among the things kept after account closure because "this information is shown in WHOIS directory and is public".

None of this is Hostinger's choice to make. Identity verification and WHOIS publication are ICANN requirements that apply to every accredited registrar, and the policy says so. Nothing improper is alleged. The reason to know it before you buy is practical: a domain purchase is an identity transaction in a way that a hosting purchase is not, and the contact details attached to it are published by design. Most registrars sell privacy protection for exactly this reason; check whether yours is included before you register in your own name.

The retention section is specific, and specificity here is a point in the policy's favour — vagueness is the usual failure mode. What it specifies, though, is that closure leaves a residue.

"After de-activation of Account, we will still retain ... profile with de-personalised information (we will change your email into user@deleted.com, erase you name, surname and contact information) like purchased services, login information, payment information, etc." The missing word in "erase you name" is the page's own and is reproduced as published.

Four further carve-outs follow. Log records "may remain in our database, but are disassociated from personal identifiers". "Residual copies of your personal information may not be removed from our backup systems for a limited period of time" — the period is not stated. "Forum posts or other publicly visible information may continue to be publicly available on the Hostinger Platform, even after your Hostinger Account is deactivated", though the policy adds that attribution to you is removed. And WHOIS data stays public.

There is also a sequencing detail worth knowing: "you will only be able to delete your email during de-activation of your Hostinger Account", and deactivation itself is done by writing in rather than by a button. Retaining records for tax, accounting, AML and legal-reporting obligations is required of businesses and is entirely ordinary; keeping backups is basic engineering. The honest summary is not that anything is wrong, but that "delete my account" and "delete my data" are different requests, and this policy is unusually clear about the gap between them.

Most privacy policies say data is kept "as long as necessary" and stop. This one does say that — and then gives real numbers for several specific categories, which is better practice than the norm and worth crediting.

Two of those deserve a shopper's attention. Calls and scheduled meetings are recorded — "such conversations will be recorded by Hostinger International Ltd. for quality management purposes" — and kept for 30 days. If you turn your camera on in a meeting, the policy treats that as consent to video recording.

And the marketing clocks run from your last interaction, not from your purchase. Email marketing can continue "for up to 90 days after your last interaction with us (e.g., subscription expiration or termination)" on legitimate interest; SMS and WhatsApp consent, once given, "will be valid for a period of 36 months after your last interaction", after which Hostinger says it will ask you to renew it. Three years is a long consent, and the policy is at least honest enough to put a date on when it expires rather than treating it as permanent.

This section matters to anyone running a business site, a shop or a newsletter on Hostinger, and it is easy to miss because it is written about "Users-of-Users".

Hostinger says it processes data about your site's visitors "solely on our Users' behalf and at their direction", which makes Hostinger the processor and you the controller. The consequence is spelled out: "The Users controlling and operating such User websites, shall be considered as the 'data controllers' of such information, and shall be solely, completely and fully responsible and liable for complying with all laws and regulations that may apply ... including all privacy and data protection laws of all relevant jurisdictions."

It repeats the point for security: the user is "solely, completely and fully responsible for the security, integrity and authorized usage of information related to visitors and users of their websites", and for "obtaining consents, permissions and providing any fair processing notices". Hostinger adds that it "has no direct relationship with the individual visitors".

This is the standard and correct allocation under data-protection law — a host is a processor, the site owner is a controller — and nothing about it is unusual or improper. It is flagged here because the practical reading is blunt: your hosting plan does not come with a privacy policy for your own site. The cookie banner, the consent records and the notices are yours to write, and the contract says so in three different sentences.

One: decide about the domain separately from the hosting. Registering a domain can involve identity documents and puts registration details into a public WHOIS record; buying hosting does not. If you do not want your name and contact details public, sort out privacy protection at the point of registration rather than afterwards. Two: if you are building a site for other people to use, budget for your own privacy policy. The terms make you the data controller for your visitors, "solely, completely and fully". Three: note the 36-month clock if you consent to SMS or WhatsApp marketing, and the 90-day one on email after your last interaction. Four: if you want to be deleted, say so. Deactivation leaves a de-personalised profile, residual backup copies, disassociated log records and public WHOIS data behind; erasure is a separate request, made to gdpr@hostinger.com.

Everything above is Hostinger's published text as it stood on 8 October 2026, and a published policy can be amended at any time. This page describes what a document says and expresses no view on whether any clause complies with Indian, European or any other law; nothing here is legal advice.