Terms of service, AUP, SLA and privacy

1. Legal notice

Website publisher and service provider: FFxF, a sole proprietorship registered with the Registraire des entreprises du Québec (NEQ 2282145301), located at 4051 av. De Lorimier, Montréal (Québec) H2K 3X8, Canada. In this document, "FFxF" and "we" refer to that entity; "the customer" and "you" refer to the individual or legal entity holding the account.

General contact, billing, abuse reports and personal information requests: contact@ffxf.net.

Infrastructure: services are operated from Montreal, QC, on network AS402554, operated by FFxF. This website is hosted on that same infrastructure.

The website, its visual identity, its copy and its blog content belong to FFxF. Code samples published in the tutorials may be reused freely, without warranty of any kind.

2. Terms of service

2.1Purpose and acceptance

These terms govern the provision by FFxF of KVM virtual machines and related services. Together with the acceptable use policy (section 3), the availability commitment (section 4) and the plan descriptions published on ffxf.net, they form the entire agreement between the parties. In case of conflict, these terms prevail over any other communication.

2.2Customer account

The customer provides accurate contact details and keeps them current. FFxF may request identity or payment verification before activation, in particular where fraud is suspected, and may decline an order without stating a reason.

An account may hold up to five virtual machines at a time. That limit is raised on request from the console, at no charge. The customer is responsible for keeping their credentials confidential and for any action carried out from their account. Enabling two-factor authentication is strongly recommended.

2.3Prices, currency and taxes

Prices are set and invoiced in Canadian dollars (CAD). Amounts shown in euros or US dollars on ffxf.net are indicative only, converted at a periodically frozen rate; they have no contractual value and do not predict the rate applied by your bank or card issuer. Applicable Quebec and Canadian taxes are added where relevant.

2.4Billing and renewal

Services are prepaid. The virtual machine is provisioned once payment is received, usually within minutes. Renewal occurs on the anniversary date of the subscription, at the chosen frequency:

• hourly, at the listed hourly rate, under the terms below;
• monthly, at the listed price;
• annually, at the price of ten months for twelve months of service.

An annual payment is a firm commitment for the period: it does not give rise to a pro-rata refund if the customer terminates early, except under section 2.7.

Hourly rental works differently. It is billed from prepaid credit held on the account, hour by hour, each hour charged at its start. Any hour started is owed. Placing an hourly order requires credit covering at least 24 hours of the chosen plan, and the first hour is charged when the machine is created.

Deleting the machine stops the meter: the hour in progress remains due and no pro-rata refund applies to it. When the remaining credit no longer covers the next hour, the machine is stopped and the meter stops with it, so no debt builds up. The disk is kept for 7 days at no charge. A top-up within that window restarts the machine as it was. Without a top-up, the machine and its disk are permanently deleted at the end of the 7 days.

The customer may set a monthly budget from the console. Warnings are sent at 50, 80 and 100 percent of that amount. At 120 percent the hourly machines are stopped: nothing is deleted, nothing further is owed, and they restart as soon as the budget is raised or at the start of the following month. Without a budget set, nothing stops for this reason.

Hourly consumption is charged against prepaid credit, and it is the credit top-up that is invoiced. A monthly usage statement is available in the console: it details the hours consumed per machine and does not constitute an invoice. FFxF may, for certain accounts and at its discretion, replace prepaid billing with monthly invoicing of the hours consumed, payable on receipt of the invoice.

2.5Price changes

FFxF may change its prices. Any increase is announced at least 30 days in advance by email and applies only to subsequent billing periods: the price of a period already paid holds until its end. A promotional offer is valid for the announced duration; at its end the service moves to the current price unless explicitly stated otherwise.

2.6Non-payment

If payment is not received by the due date:

• a reminder is sent on the due date;
• the service is suspended from the 3^rd day overdue, the virtual machine is powered off, data is preserved;
• the virtual machine and its data, backups included, are irreversibly destroyed from the 14^th day overdue, and its IP addresses are reassigned.

No credit or extension is granted for the duration of a suspension for non-payment. Amounts due remain payable.

2.77-day guarantee and refunds

A first VPS subscription may be refunded if the request is made from the console within 7 days of the first invoice being paid. This guarantee applies once per customer, across all accounts.

Otherwise, amounts paid are non-refundable. The following are excluded:

• renewals and periods already started;
• add-ons (additional IPv4 addresses, automatic backups, out-of-plan traffic);
• any setup fees and fees retained by the payment processor;
• accounts terminated by FFxF for breach of section 3.

A payment made in cryptocurrency is refunded as account credit, never as currency.

2.8Billing disputes

Any dispute must be raised within 60 days of the invoice date; after that the invoice is deemed accepted. We would rather settle it directly: a chargeback opened without contacting us first results in immediate account suspension and an administrative fee of up to CAD 50, in addition to the amounts due.

2.9Termination by the customer

Termination is carried out from the console, before the renewal date. A request made after a charge takes effect at the end of the current period, which is not refunded. Plan to retrieve your data before the effective date: the destruction that follows is irreversible.

2.10Suspension and termination by FFxF

FFxF may suspend or terminate a service:

• for breach of section 3, under the process described there;
• for non-payment (section 2.6);
• where a court order or legal obligation requires it, or where the stability or security of the platform is at stake.

If a plan is commercially discontinued, FFxF gives at least 30 days' notice and refunds the unused portion of the period already paid.

2.11Resources, traffic and overage

The vCPU, memory and storage assigned to a virtual machine are dedicated to it: FFxF does not overprovision. The customer may therefore use them fully, including sustained use, subject to section 3.5.

Each virtual machine is connected at 1 Gbps. That figure is the rate of the link, not a guaranteed sustained throughput: transit is shared, and its lasting saturation falls under section 3.5.

Each virtual machine includes 1 TB of monthly traffic. Beyond that, traffic is billed at CAD 2 per started TB on the following invoice; the service is neither cut off nor throttled as a result.

2.12IP addresses

Each virtual machine receives one IPv4 address and a routed IPv6 /64 prefix, with configurable reverse DNS. These addresses are assigned for the duration of the service: they are neither sold nor portable, and cannot be retained after termination. FFxF may reassign an address where technically necessary, or change one whose reputation has been damaged by the use made of it.

2.13Backups and customer data

Each virtual machine includes up to 7 manual backups, triggered by the customer from the console. An automatic backup option is available at CAD 3 per month per virtual machine.

2.14Operating systems and licences

Linux images are provided as-is, under their respective licences. Windows Server instances are provided in evaluation mode: no licence is included. It is the customer's responsibility to apply a valid licence after deployment and to comply with the publisher's terms.

2.15Scope of support

Human support, reachable 24/7, covers what belongs to FFxF: hypervisor, network, storage, provisioning, IP addresses, reverse DNS, console, billing.

It does not cover the inside of your virtual machine: guest operating system administration, configuration or debugging of your applications, development, migration, third-party software, or support for your own users. Courtesy help may be offered on those topics, with no commitment as to time or outcome.

2.16Maintenance

Planned maintenance is announced at least 48 hours in advance on status.ffxf.net and by email, with its window and expected impact. Emergency work required by a security flaw or a hardware failure may be carried out without notice; it is documented afterwards.

2.17Content and absence of monitoring

The customer is solely responsible for the content they host, the processing they carry out and the services they expose. FFxF exercises no general monitoring of virtual machine content and does not access it in the course of normal operations; technical access takes place only at the customer's request, to meet a legal obligation, or to handle a security incident affecting the platform.

2.18Limitation of liability

The service is provided with the care of a diligent professional, without warranty of complete freedom from interruption or error. FFxF is not liable for the consequences of events outside its direct control, of a configuration made by the customer, or of a compromise stemming from the customer's own credentials or applications.

FFxF's total liability, all damages combined, is limited to the amounts actually paid by the customer for the service concerned during the three months preceding the triggering event. Indirect damages, loss of revenue, loss of business, reputational harm and loss of data are excluded.

Nothing in these terms excludes liability that cannot lawfully be excluded, in particular towards a consumer within the meaning of Quebec's Consumer Protection Act.

2.19Indemnification

The customer holds FFxF harmless against any third-party claim, and against the reasonable costs and fees arising from it, where that claim originates in the customer's use of the service, in the content they host, or in a breach of these terms.

2.20Force majeure

Neither party is liable for a failure caused by an event of force majeure, including a natural disaster, armed conflict, widespread failure of the power grid or of transit operators, a decision by a public authority, or a large-scale cyberattack against the infrastructure.

2.21Assignment

The customer may not assign their contract or account without FFxF's prior written consent. FFxF may assign the contract as part of a reorganisation or a transfer of business, after informing the customer.

2.22Changes to these terms

FFxF may amend these terms. Any material change is announced at least 30 days before it takes effect, by email and on this page, whose version number and date are updated. A customer who refuses a material change may terminate free of charge before it takes effect; continuing to use the service beyond that date constitutes acceptance.

2.23Severability and forbearance

If a clause is held invalid, the others remain in force. Not acting on a breach does not waive the right to act on it later.

2.24Language

The French version of these terms is binding. The English version is a courtesy translation, provided at the express wish of the parties, and does not prevail in the event of a discrepancy.

2.25Governing law and jurisdiction

These terms are governed by the laws applicable in the province of Quebec and the laws of Canada applicable therein. Any dispute falls under the courts of the judicial district of Montreal, without prejudice to mandatory consumer protection rules.

3. Acceptable use policy (AUP)

3.1Principle

You are free to do what you want with your virtual machine, as long as it stays legal and harms neither the network, nor other customers, nor third parties. This policy describes the limits of that freedom and how reports are handled. It applies to the customer as well as to their own end users, for whom the customer answers.

3.2Prohibited content and activities

• any use contrary to the laws applicable in Quebec or Canada, or intended to facilitate their violation;
• sexual exploitation of minors in any form. Such content leads to immediate termination without refund and a report to the competent authorities;
• content inciting hatred, violence or terrorism, threats and harassment;
• infringement of a third party's copyright, trademarks or trade secrets, including distributing works without the right to do so;
• phishing, identity or brand impersonation, malware distribution, operating command-and-control for compromised machines;
• fraudulent financial schemes, pyramid schemes and bogus investment offers.

3.3Email and messaging

Sending unsolicited commercial email is prohibited, as is hosting a service promoted that way from another platform. Any bulk sending requires verifiable consent and a working unsubscribe mechanism, in line with Canada's Anti-Spam Legislation.

Outbound port 25 is closed by default on new virtual machines. It can be opened on request, after a conversation about the intended use. Outgoing mail must be authenticated (SPF, DKIM, DMARC) and reverse DNS must match the announced hostname. An IP address landing on a major blocklist, or an abnormal complaint rate, results in immediate suspension of sending while the cause is addressed.

3.4Network security

The following are prohibited:

• accessing a system, account or data without authorisation;
• port scanning, penetration testing and vulnerability research against third-party systems without the written authorisation of the party responsible for them;
• taking part in a denial-of-service attack, whether as a relay or as the party ordering it, and operating a stress-test service;
• forging IP or email headers to mislead as to the origin of traffic;
• running an open service that exposes the network to amplification abuse: open recursive DNS resolver, open SMTP relay, publicly reachable and unrestricted NTP, memcached or SSDP server;
• intercepting other parties' traffic on the network.

Auditing your own infrastructure is of course permitted; let us know before a test that generates unusual volume, so our protections do not mistake it for an attack.

3.5Resource usage

Because a virtual machine's resources are dedicated to it, sustained CPU load is not in itself abuse: computation, continuous builds, language model inference, mining, you pay for those resources, they are yours. The limits concern what is shared:

• sustained saturation of transit links or network equipment;
• a disk I/O load heavy enough to degrade shared storage;
• opening outbound connections en masse, the signature of scanning or abuse;
• any attempt to bypass hypervisor isolation or reach another virtual machine's resources.

In such cases we contact you first to find a setting that works; a technical limit is applied only failing that, and in proportion to the disruption observed.

3.6Uses requiring prior agreement

Some perfectly legal uses expose the IP address, the prefix or the network to a high risk of attack or blocklisting, which then penalises other customers. They are allowed, but subject to written agreement obtained before they are set up:

• public IRC server or chat service open to anonymous use;
• Tor exit node, open proxy, reselling VPN access to third parties;
• legal adult content operated commercially;
• cryptocurrency mixing or transaction anonymisation service.

Tor middle relays and bridges, and a personal or corporate VPN for your own use, require no such step.

3.7Handling of reports

Any report sent to contact@ffxf.net is reviewed within 48 business hours. Enforcement is graduated:

• First breach, notice to the customer, with a deadline to fix it. A temporary suspension may accompany that notice if the abuse is ongoing.
• Second breach, suspension, then termination if the behaviour persists or recurs.
• Serious cases, sexual exploitation of minors, active participation in an attack, confirmed compromise of the machine, blocklisting of the prefix: immediate suspension without notice, with notification following as soon as possible.

No credit is due for the duration of a suspension issued under this policy. Investigation time made necessary by confirmed abuse may be billed at up to CAD 75 per hour. Facts that may constitute an offence are passed to the competent authorities.

A machine compromised without its owner's knowledge is not treated as malice: we warn you, we isolate it if necessary, and we give you time to regain control.

4. Availability commitment (SLA)

FFxF commits to 99.9% monthly availability per virtual machine. Availability is measured on what belongs to FFxF: the virtual machine running on its hypervisor and reachable from the network. Service status is published in real time on status.ffxf.net.

4.1Exclusions

The following are not counted:

• planned maintenance announced in accordance with section 2.16;
• downtime attributable to the guest system, applications or customer configuration;
• suspensions issued under section 2.6 or section 3;
• force majeure and failures of transit operators outside our network;
• mitigation measures applied during a denial-of-service attack aimed at the customer.

4.2Credits

A credit request is submitted from the console within 30 days of the end of the month concerned, listing the downtime observed. The credit is applied to the customer account and offset against a subsequent invoice; it is not paid out in currency and is capped, for a given month, at 100% of the affected virtual machine's monthly fee. This credit is the agreed remedy for failing to meet the target.

5. Privacy

FFxF processes personal information in accordance with Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25, and with the federal PIPEDA where it applies.

5.1Privacy officer

Florian Mauduit, privacy officer (responsable de la protection des renseignements personnels), reachable at contact@ffxf.net. You may address any question, access request or complaint about the processing of your information to them.

5.2Information collected and purposes

• Account, name, email address, contact details, and possibly a verification document during a fraud check. Purpose: opening and managing the account.
• Billing, order and invoice history. Card data is handled by the payment processor and is never stored by FFxF.
• Technical logs, IP addresses, timestamps, sign-in events for the console and the infrastructure. Purposes: security, diagnostics, abuse handling.
• Support exchanges, the content of requests and any attachments provided. Purpose: handling the request.

FFxF does not access the content of your virtual machines and does not process the information you host there on its own behalf. You are the controller of that information; we are its host.

5.3Retention

• technical logs: 12 months;
• accounting records and invoices: the period required by tax law, currently 7 years;
• account data: deleted within 30 days of the account being closed, except items subject to a retention obligation;
• virtual machine content and backups: destroyed on the timelines set out in sections 2.6 and 2.9.

5.4Disclosure to third parties

Your information is not sold, rented, or passed on for advertising purposes. It may be disclosed to the providers strictly necessary to the service, payment, transactional email delivery, domain name registration, limited to what their role requires, or to an authority where the law requires it. Some of these providers process data outside Quebec; the list and the countries involved are available on request. The hosting infrastructure itself is located in Canada.

5.5Your rights

You may request access to your information, its correction, its deletion where the law allows, the withdrawal of your consent, and the communication of the information you provided to us in a structured, commonly used technological format. We respond within 30 days. If you disagree with our response, you may refer the matter to the Commission d'accès à l'information du Québec.

5.6Cookies and analytics

Audience measurement on ffxf.net relies on a self-hosted tool that sets no cookie. Your display currency is kept locally in your browser and is never sent to a server; your language choice is kept in the ffxf_lang cookie, read by this website alone. The console uses a cookie strictly necessary to keep your session open. None of these require your consent.

To measure the effectiveness of its advertising campaigns, the website uses the Reddit and X pixels. The Reddit pixel sets the _rdt_uuid and _rdt_cid cookies and sends Reddit, Inc. the page you visited, your IP address and technical characteristics of your browser. This information is used solely to link a visit to the website to an ad seen or clicked on Reddit; Reddit processes it in accordance with its privacy policy, and X in accordance with its own.

These pixels only load once you have accepted them in the banner shown on your first visit. Decline and they stay inert: no advertising cookie is set, and the website works exactly the same. Your answer is kept in the ffxf_consent cookie for six months, after which the question is asked again. You can change your mind at any time from the Cookies entry at the foot of any page — withdrawing your consent erases the advertising cookies already set and reloads the page.

5.7Privacy incidents

FFxF keeps a register of privacy incidents. Any incident presenting a risk of serious injury is reported to the Commission d'accès à l'information and to the individuals concerned as soon as possible.