Terms of service, AUP, SLA and privacy

1. Legal notice

Website publisher and service provider: FFxF, a sole proprietorship registered with the Registraire des entreprises du Québec (NEQ 2282145301), located at 4051 av. De Lorimier, Montréal (Québec) H2K 3X8, Canada. In this document, "FFxF" and "we" refer to that entity; "the customer" and "you" refer to the individual or legal entity holding the account.

General contact, billing, abuse reports and personal information requests: contact@ffxf.net.

Infrastructure: services are operated from Montreal, QC, on network AS402554, operated by FFxF. This website is hosted on that same infrastructure.

The website, its visual identity, its copy and its blog content belong to FFxF. Code samples published in the tutorials may be reused freely, without warranty of any kind.

2. Terms of service

2.1Purpose and acceptance

These terms govern the provision by FFxF of KVM virtual machines and related services. Together with the acceptable use policy (section 3), the availability commitment (section 4) and the plan descriptions published on ffxf.net, they form the entire agreement between the parties. In case of conflict, these terms prevail over any other communication.

2.2Customer account

The customer provides accurate contact details and keeps them current. FFxF may request identity or payment verification before activation, in particular where fraud is suspected, and may decline an order without stating a reason.

An account may hold up to five virtual machines at a time. That limit is raised on request from the console, at no charge. The customer is responsible for keeping their credentials confidential and for any action carried out from their account. Enabling two-factor authentication is strongly recommended.

2.3Prices, currency and taxes

Prices are set and invoiced in Canadian dollars (CAD), taxes included. The price shown is the price paid: no tax is added to it, neither at checkout nor on the invoice. Amounts shown in euros or US dollars on ffxf.net are indicative only, converted at a periodically frozen rate; they have no contractual value and do not predict the rate applied by your bank or card issuer.

2.4Billing and renewal

Services are prepaid. The virtual machine is provisioned once payment is received, usually within minutes. Renewal occurs on the anniversary date of the subscription, at the chosen frequency:

• hourly, at the listed hourly rate, under the terms below;
• monthly, at the listed price;
• annually, at the price of ten months for twelve months of service.

An annual payment is a firm commitment for the period: it does not give rise to a pro-rata refund if the customer terminates early, except under section 2.7.

Hourly rental works differently. It is billed from prepaid credit held on the account, hour by hour, each hour charged at its start. Any hour started is owed. Placing an hourly order requires credit covering at least 24 hours of the chosen plan, and the first hour is charged when the machine is created.

Deleting the machine stops the meter: the hour in progress remains due and no pro-rata refund applies to it. When the remaining credit no longer covers the next hour, the machine is stopped and the meter stops with it, so no debt builds up. The disk is kept for 7 days at no charge. A top-up within that window restarts the machine as it was. Without a top-up, the machine and its disk are permanently deleted at the end of the 7 days.

The customer may set a monthly budget from the console. Warnings are sent at 50, 80 and 100 percent of that amount. At 120 percent the hourly machines are stopped: nothing is deleted, nothing further is owed, and they restart as soon as the budget is raised or at the start of the following month. Without a budget set, nothing stops for this reason.

Hourly consumption is charged against prepaid credit, and it is the credit top-up that is invoiced. A monthly usage statement is available in the console: it details the hours consumed per machine and does not constitute an invoice. FFxF may, for certain accounts and at its discretion, replace prepaid billing with monthly invoicing of the hours consumed, payable on receipt of the invoice.

2.5Price changes

FFxF may change its prices. Any increase is announced at least 30 days in advance by email and applies only to subsequent billing periods: the price of a period already paid holds until its end. A promotional offer is valid for the announced duration; at its end the service moves to the current price unless explicitly stated otherwise.

2.6Non-payment

If payment is not received by the due date:

• a reminder is sent on the due date;
• the service is suspended from the 3^rd day overdue, the virtual machine is powered off, data is preserved;
• the virtual machine and its data, backups included, are irreversibly destroyed from the 14^th day overdue, and its IP addresses are reassigned.

No credit or extension is granted for the duration of a suspension for non-payment. Amounts due remain payable.

2.77-day guarantee and refunds

A first VPS subscription may be refunded if the request is made from the console within 7 days of the first invoice being paid. This guarantee applies once per customer, across all accounts.

Otherwise, amounts paid are non-refundable. The following are excluded:

• renewals and periods already started;
• add-ons (additional IPv4 addresses, automatic backups, out-of-plan traffic);
• any setup fees and fees retained by the payment processor;
• accounts terminated by FFxF for breach of section 3.

A payment made in cryptocurrency is refunded as account credit, never as currency.

2.8Promotional codes and credit codes

A promotional code applies to the order of a new virtual machine. It is entered when ordering, or applied automatically when the customer arrives through a link that carries one. Each code follows its own conditions, announced with it and prevailing over any other statement: eligible plans, validity period, total and per-account number of uses, and how long it applies (the first billing period only, or later periods as well).

One code per order; codes do not stack. A use counts even if the machine is later deleted. The discount applies to the price of the plan and eligible add-ons; it does not apply to hourly rental, to credit top-ups, or retroactively to an order already placed.

FFxF may withdraw a code or refuse its use in case of abuse, notably the creation of multiple accounts to circumvent a per-account limit. A discount obtained that way may be cancelled and its amount invoiced.

A credit code adds an amount to the prepaid credit of the account that enters it, in the billing currency. This gifted credit is spent before purchased credit; it pays for hourly machines, orders and renewals settled from credit; it can be neither refunded nor withdrawn. It may carry a use-by date, announced with the code: whatever gifted balance remains on that date is lost. Each code follows its own conditions (total and per-account number of uses, validity period, minimum prior top-up: the code applies only once that much credit has been bought and paid for), and the account's credit cap applies to purchased and gifted credit combined.

A trial credit may be offered to an account that saves a valid payment card in the console. Nothing is charged: the bank only confirms the card is valid, and the card stays saved as a payment method until the customer removes it. This credit follows the gifted credit rules above, with the use-by date shown in the console. It is granted once per account and once per card, even after an account is deleted; FFxF may refuse it to a prepaid card or a card the bank does not confirm, and cancel it if it was obtained by getting around these limits.

2.9Referral programme

FFxF opens a referral programme to customers it admits to it. The referrer receives a referral code and link, available in the console.

A new customer is attributed to the referrer whose link they followed (the link is remembered by the browser for 30 days) or whose code they entered as a promotional code on their first paid order. Attribution is single and permanent: it does not transfer, and a customer who is already attributed, or who has already paid an invoice, can no longer be attributed. No one may refer themselves, including through multiple accounts.

The referrer earns a commission equal to a percentage of the amount, before tax and after discounts, of the services invoiced to the referred customer. The rate is set by FFxF and may be specific to each referrer; it is shown in the console. The commission applies to every invoice of the referred customer, with no limit in time or number, for as long as the referrer remains in the programme. The following earn no commission: hourly rental drawn from credit, credit top-ups, and any invoice that is refunded or disputed. A commission stays pending for 24 hours after the invoice is paid and is cancelled if the invoice is refunded within that time.

Commissions are credited to the referrer's account and can be used for their own services. A payout in currency may be requested from the console from 10 CAD of earned balance; it is handled by ticket, through the payment methods offered, within 30 days. The referrer is solely responsible for any tax obligations attached to these amounts.

Referral alone gives the referred customer no right to a discount. A referrer may be given a promotional code bearing their referral code; that code is then governed by section 2.8.

FFxF may suspend or remove a referrer, and cancel unpaid commissions, in case of misleading or abusive practice: unsolicited messaging (section 3.3), use of the FFxF brand likely to cause confusion, bidding on the FFxF name as a keyword, self-referral or multiple accounts. FFxF may change or close the programme with 30 days' notice; commissions earned by that date remain due.

2.10Billing disputes

Any dispute must be raised within 60 days of the invoice date; after that the invoice is deemed accepted. We would rather settle it directly: a chargeback opened without contacting us first results in immediate account suspension and an administrative fee of up to CAD 50, in addition to the amounts due.

2.11Termination by the customer

Termination is carried out from the console, before the renewal date. A request made after a charge takes effect at the end of the current period, which is not refunded. Plan to retrieve your data before the effective date: the destruction that follows is irreversible.

2.12Suspension and termination by FFxF

FFxF may suspend or terminate a service:

• for breach of section 3, under the process described there;
• for non-payment (section 2.6);
• where a court order or legal obligation requires it, or where the stability or security of the platform is at stake.

If a plan is commercially discontinued, FFxF gives at least 30 days' notice and refunds the unused portion of the period already paid.

2.13Resources, traffic and overage

The vCPU, memory and storage assigned to a virtual machine are dedicated to it: FFxF does not overprovision. The customer may therefore use them fully, including sustained use, subject to section 3.5.

Each virtual machine is connected at 1 Gbps. That figure is the rate of the link, not a guaranteed sustained throughput: transit is shared, and its lasting saturation falls under section 3.5.

Each virtual machine includes 1 TB of traffic per month, whatever its plan (hourly, monthly or yearly): its traffic exchanged with the Internet, inbound and outbound added together. Traffic carried by one of the customer's private networks, between machines or with managed databases, is not counted; Internet traffic served by a load balancer is counted on its target machines. The traffic month follows the due date of a monthly or yearly service, and the creation date of an hourly service. Beyond 1 TB, traffic is billed at CAD 2 per TB, pro rata, at the end of each traffic month, and paid from the customer's credit if it covers it; the service is neither cut off nor throttled as a result.

2.14IP addresses

Each virtual machine receives one IPv4 address and a routed IPv6 /64 prefix, with configurable reverse DNS. These addresses are assigned for the duration of the service: they are neither sold nor portable, and cannot be retained after termination. FFxF may reassign an address where technically necessary, or change one whose reputation has been damaged by the use made of it.

2.15Backups and customer data

Each virtual machine includes up to 7 manual backups, triggered by the customer from the console. An automatic backup option is available at CAD 3 per month per virtual machine.

2.16Operating systems and licences

Linux images are provided as-is, under their respective licences. Windows Server instances are provided in evaluation mode: no licence is included. It is the customer's responsibility to apply a valid licence after deployment and to comply with the publisher's terms.

2.17Scope of support

Human support, reachable 24/7, covers what belongs to FFxF: infrastructure, network, storage, provisioning, IP addresses, reverse DNS, console, billing.

It does not cover the inside of your virtual machine: guest operating system administration, configuration or debugging of your applications, development, migration, third-party software, or support for your own users. Courtesy help may be offered on those topics, with no commitment as to time or outcome.

2.18Maintenance

Planned maintenance is announced at least 48 hours in advance on status.ffxf.net and by email, with its window and expected impact. Emergency work required by a security flaw or a hardware failure may be carried out without notice; it is documented afterwards.

2.19Content and absence of monitoring

The customer is solely responsible for the content they host, the processing they carry out and the services they expose. FFxF exercises no general monitoring of virtual machine content and does not access it in the course of normal operations; technical access takes place only at the customer's request, to meet a legal obligation, or to handle a security incident affecting the platform.

2.20Limitation of liability

The service is provided with the care of a diligent professional, without warranty of complete freedom from interruption or error. FFxF is not liable for the consequences of events outside its direct control, of a configuration made by the customer, or of a compromise stemming from the customer's own credentials or applications.

FFxF's total liability, all damages combined, is limited to the amounts actually paid by the customer for the service concerned during the three months preceding the triggering event. Indirect damages, loss of revenue, loss of business, reputational harm and loss of data are excluded.

Nothing in these terms excludes liability that cannot lawfully be excluded, in particular towards a consumer within the meaning of Quebec's Consumer Protection Act.

2.21Indemnification

The customer holds FFxF harmless against any third-party claim, and against the reasonable costs and fees arising from it, where that claim originates in the customer's use of the service, in the content they host, or in a breach of these terms.

2.22Force majeure

Neither party is liable for a failure caused by an event of force majeure, including a natural disaster, armed conflict, widespread failure of the power grid or of transit operators, a decision by a public authority, or a large-scale cyberattack against the infrastructure.

2.23Assignment

The customer may not assign their contract or account without FFxF's prior written consent. FFxF may assign the contract as part of a reorganisation or a transfer of business, after informing the customer.

2.24Changes to these terms

FFxF may amend these terms. Any material change is announced at least 30 days before it takes effect, by email and on this page, whose version number and date are updated. A customer who refuses a material change may terminate free of charge before it takes effect; continuing to use the service beyond that date constitutes acceptance.

2.25Severability and forbearance

If a clause is held invalid, the others remain in force. Not acting on a breach does not waive the right to act on it later.

2.26Language

The French version of these terms is binding. The English version is a courtesy translation, provided at the express wish of the parties, and does not prevail in the event of a discrepancy.

2.27Governing law and jurisdiction

These terms are governed by the laws applicable in the province of Quebec and the laws of Canada applicable therein. Any dispute falls under the courts of the judicial district of Montreal, without prejudice to mandatory consumer protection rules.

3. Acceptable use policy (AUP)

3.1Principle

You are free to do what you want with your virtual machine, as long as it stays legal and harms neither the network, nor other customers, nor third parties. This policy describes the limits of that freedom and how reports are handled. It applies to the customer as well as to their own end users, for whom the customer answers.

3.2Prohibited content and activities

• any use contrary to the laws applicable in Quebec or Canada, or intended to facilitate their violation;
• sexual exploitation of minors in any form. Such content leads to immediate termination without refund and a report to the competent authorities;
• content inciting hatred, violence or terrorism, threats and harassment;
• infringement of a third party's copyright, trademarks or trade secrets, including distributing works without the right to do so;
• phishing, identity or brand impersonation, malware distribution, operating command-and-control for compromised machines;
• fraudulent financial schemes, pyramid schemes and bogus investment offers.

3.3Email and messaging

Sending unsolicited commercial email is prohibited, as is hosting a service promoted that way from another platform. Any bulk sending requires verifiable consent and a working unsubscribe mechanism, in line with Canada's Anti-Spam Legislation.

Outbound port 25 is closed by default on new virtual machines. It can be opened on request, after a conversation about the intended use. Outgoing mail must be authenticated (SPF, DKIM, DMARC) and reverse DNS must match the announced hostname. An IP address landing on a major blocklist, or an abnormal complaint rate, results in immediate suspension of sending while the cause is addressed.

3.4Network security

The following are prohibited:

• accessing a system, account or data without authorisation;
• port scanning, penetration testing and vulnerability research against third-party systems without the written authorisation of the party responsible for them;
• taking part in a denial-of-service attack, whether as a relay or as the party ordering it, and operating a stress-test service;
• forging IP or email headers to mislead as to the origin of traffic;
• running an open service that exposes the network to amplification abuse: open recursive DNS resolver, open SMTP relay, publicly reachable and unrestricted NTP, memcached or SSDP server;
• intercepting other parties' traffic on the network.

Auditing your own infrastructure is of course permitted; let us know before a test that generates unusual volume, so our protections do not mistake it for an attack.

3.5Resource usage

Because a virtual machine's resources are dedicated to it, sustained CPU load is not in itself abuse: computation, continuous builds, language model inference, you pay for those resources, they are yours. The limits concern what is shared:

• sustained saturation of transit links or network equipment;
• a disk I/O load heavy enough to degrade shared storage;
• opening outbound connections en masse, the signature of scanning or abuse;
• any attempt to break the isolation between virtual machines or reach another machine's resources.

In such cases we contact you first to find a setting that works; a technical limit is applied only failing that, and in proportion to the disruption observed.

Cryptocurrency mining is prohibited on all FFxF services, whatever the method (proof of work, of space or of storage), solo or in a pool, directly or through software that mines in the background. A machine that mines is handled under section 3.7; since the abuse is ongoing, it may be suspended as soon as you are notified.

3.6Uses requiring prior agreement

Some perfectly legal uses expose the IP address, the prefix or the network to a high risk of attack or blocklisting, which then penalises other customers. They are allowed, but subject to written agreement obtained before they are set up:

• public IRC server or chat service open to anonymous use;
• Tor exit node, open proxy, reselling VPN access to third parties;
• legal adult content operated commercially;
• cryptocurrency mixing or transaction anonymisation service.

Tor middle relays and bridges, and a personal or corporate VPN for your own use, require no such step.

3.7Handling of reports

Any report sent to contact@ffxf.net is reviewed within 48 business hours. Enforcement is graduated:

• First breach, notice to the customer, with a deadline to fix it. A temporary suspension may accompany that notice if the abuse is ongoing.
• Second breach, suspension, then termination if the behaviour persists or recurs.
• Serious cases, sexual exploitation of minors, active participation in an attack, confirmed compromise of the machine, blocklisting of the prefix: immediate suspension without notice, with notification following as soon as possible.

No credit is due for the duration of a suspension issued under this policy. Investigation time made necessary by confirmed abuse may be billed at up to CAD 75 per hour. Facts that may constitute an offence are passed to the competent authorities.

A machine compromised without its owner's knowledge is not treated as malice: we warn you, we isolate it if necessary, and we give you time to regain control.

4. Availability commitment (SLA)

FFxF commits to 99.9% monthly availability per virtual machine. Availability is measured on what belongs to FFxF: the virtual machine running and reachable from the network. Service status is published in real time on status.ffxf.net.

4.1Exclusions

The following are not counted:

• planned maintenance announced in accordance with section 2.18;
• downtime attributable to the guest system, applications or customer configuration;
• suspensions issued under section 2.6 or section 3;
• force majeure and failures of transit operators outside our network;
• mitigation measures applied during a denial-of-service attack aimed at the customer.

4.2Credits

A credit request is submitted from the console within 30 days of the end of the month concerned, listing the downtime observed. The credit is applied to the customer account and offset against a subsequent invoice; it is not paid out in currency and is capped, for a given month, at 100% of the affected virtual machine's monthly fee. This credit is the agreed remedy for failing to meet the target.

5. Privacy

FFxF processes personal information in accordance with Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25, and with the federal PIPEDA where it applies.

5.1Privacy officer

Florian Mauduit, privacy officer (responsable de la protection des renseignements personnels), reachable at contact@ffxf.net. You may address any question, access request or complaint about the processing of your information to them.

5.2Information collected and purposes

• Account, name, email address, contact details, and possibly a verification document during a fraud check. Purpose: opening and managing the account.
• Billing, order and invoice history. Card data is handled by the payment processor and is never stored by FFxF.
• Technical logs, IP addresses, timestamps, sign-in events for the console and the infrastructure. Purposes: security, diagnostics, abuse handling.
• Support exchanges, the content of requests and any attachments provided. Purpose: handling the request.
• Pre-registration, email address, chosen machine configuration and IP address, when a visitor without an account sets an order aside. Purposes: sending the link to pick it up, and a single reminder two days later. No other solicitation follows.

FFxF does not access the content of your virtual machines and does not process the information you host there on its own behalf. You are the controller of that information; we are its host.

5.3Retention

• technical logs: 12 months;
• pre-registrations not followed by an order: 90 days;
• accounting records and invoices: the period required by tax law, currently 7 years;
• account data: deleted within 30 days of the account being closed, except items subject to a retention obligation;
• virtual machine content and backups: destroyed on the timelines set out in sections 2.6 and 2.11.

5.4Disclosure to third parties

Your information is not sold, rented, or passed on for advertising purposes. It may be disclosed to the providers strictly necessary to the service, payment, transactional email delivery, domain name registration, limited to what their role requires, or to an authority where the law requires it. Some of these providers process data outside Quebec; the list and the countries involved are available on request. The hosting infrastructure itself is located in Canada.

When a new virtual machine of yours is ready, FFxF passes your name, your email address and a service reference to Trustpilot A/S, a review platform based in Denmark, so that it can invite you by email, about a week later, to review the service. Nothing else is passed on: neither the access details of the machine nor your invoices. Trustpilot processes this information in accordance with its privacy policy. To stop these invitations, write to contact@ffxf.net and no further machine will lead to one; you can also ignore an invitation, or ask Trustpilot to delete your information.

5.5Your rights

You may request access to your information, its correction, its deletion where the law allows, the withdrawal of your consent, and the communication of the information you provided to us in a structured, commonly used technological format. We respond within 30 days. If you disagree with our response, you may refer the matter to the Commission d'accès à l'information du Québec.

5.6Cookies and analytics

Audience measurement on ffxf.net relies on a self-hosted tool that sets no cookie. Your display currency is kept locally in your browser and is never sent to a server; your language choice is kept in the ffxf_lang cookie, read by this website alone. The console uses a cookie strictly necessary to keep your session open. None of these require your consent.

To measure the effectiveness of its advertising campaigns, the website uses the Reddit and X pixels. The Reddit pixel sets the _rdt_uuid and _rdt_cid cookies and sends Reddit, Inc. the page you visited, your IP address and technical characteristics of your browser. This information is used solely to link a visit to the website to an ad seen or clicked on Reddit; Reddit processes it in accordance with its privacy policy, and X in accordance with its own.

To understand how the website is used, FFxF also uses Google Analytics, loaded through Google Tag Manager. It sets the _ga and _ga_* cookies, which identify your browser across visits, and sends Google LLC the pages you visit, how you reached them, your IP address and technical characteristics of your browser. Google processes this information in accordance with its privacy policy.

FFxF also uses PostHog, a product analytics service operated by PostHog, Inc. in the United States, on the website and in the console. On the website, until you accept cookies, PostHog only counts the pages you view and how you move between them, and writes nothing to your device: to link the pages of a single visit, PostHog's servers derive a pseudonymous identifier from your IP address and browser, with a key renewed every day, so you cannot be recognised from one day to the next. Once you accept, it sets the ph_* cookie and a matching local storage entry, which recognise your browser across visits and between ffxf.net and console.ffxf.net, and it may record your sessions with form fields masked. In the console, PostHog is linked to your account through its identifier and email address so that FFxF can understand how customers use it. PostHog sends PostHog, Inc. the pages you visit, your interactions, your IP address and technical characteristics of your browser, and processes them in accordance with its privacy policy.

These pixels, Google Analytics and Google Tag Manager only load once you have accepted them in the banner shown on your first visit. Decline and they stay inert: no advertising or analytics cookie is set, and the website works exactly the same. Your answer is kept in the ffxf_consent cookie for six months, after which the question is asked again. You can change your mind at any time from the Cookies entry at the foot of any page. Withdrawing your consent erases the advertising and analytics cookies already set, PostHog's included, and reloads the page; PostHog then goes back to counting pages without writing anything to your device.

When you reach the website from a Google ad, its address carries an ad click identifier (gclid, gbraid or wbraid). This identifier follows your visit in the address of the pages and of the links to the console. Until you accept cookies, it is not written to your device; once you accept, Google Ads keeps it in a cookie (_gcl_aw). If you create an account, the console keeps it with your account. It is sent to Google Ads, together with your hashed email address, only if you have accepted cookies, on the website or in the console, and only to link your sign-up or purchase to the ad. It is erased 90 days after the click. Like any page address, it also appears in our technical logs; PostHog receives the address of the pages you visit, with or without consent, but the identifier is masked there. Your choice, kept in the ffxf_consent cookie, applies to both ffxf.net and console.ffxf.net; a choice made on the website before this change is carried over on your next visit to the website.

5.7Privacy incidents

FFxF keeps a register of privacy incidents. Any incident presenting a risk of serious injury is reported to the Commission d'accès à l'information and to the individuals concerned as soon as possible.