Privacy Policy

This policy explains how SLASHPLAY ApS ("SLASHPLAY", "we", "us") collects, uses, and protects your personal data when you use our website and game-server hosting service (the "Service"), and your rights under the EU General Data Protection Regulation (GDPR).

1. Who we are (data controller)

The data controller is SLASHPLAY ApS, a company registered in Denmark, CVR 44964988. For any privacy question or to exercise your rights, contact us at [email protected].

2. Data we collect

• Account data — when you sign in with Discord we receive and store your Discord user ID, username, avatar, and email address.
• Authentication — a session cookie that keeps you signed in.
• Payment data — when you buy tokens, payments are processed by Stripe. We do not see or store your full card details; we store a Stripe customer reference and your purchase/token history.
• Server & game data — the servers you create and their configuration and saved worlds. This may contain whatever you and your players put into it.
• Technical data — IP address, browser/device information, and usage logs, used to deliver and secure the Service.
• Analytics — if you consent, anonymous and identified usage analytics (see Cookies below).

3. How and why we use it (legal bases)

• To provide the Service — authenticating you, running and managing your servers, processing payments. Legal basis: performance of a contract.
• To keep it secure and working — preventing abuse and fraud, debugging, and improving the Service. Legal basis: our legitimate interests.
• Analytics — understanding how the Service is used. Legal basis: your consent.
• Legal/accounting — keeping records of transactions. Legal basis: legal obligation.

We do not sell your personal data, and we do not use it for advertising.

4. Cookies & similar technologies

We use strictly necessary cookies to run the Service, and — only with your consent — analytics cookies. You can accept or reject non-essential cookies the first time you visit, and change your choice any time using the cookie icon at the bottom-left of any page, or under Account → Cookies in your dashboard.

For the complete list of every individual cookie we set — including its maximum storage duration and type — see our Cookie Declaration.

5. Who we share data with (processors)

We use a small number of trusted providers to run the Service. They process data on our behalf under data-processing agreements:

• Discord — sign-in / authentication.
• Stripe — payment processing.
• Cloudflare — DNS, content delivery, and security.
• Hetzner — server hosting and data storage, in Germany (EU).
• PostHog — product analytics (only if you consent).
• Amazon SES — sending transactional emails.

6. International transfers

Your server data is hosted in the EU (Germany). Some providers (such as PostHog and Stripe) may process data outside the EU/EEA. Where that happens, transfers are protected by appropriate safeguards such as the EU Standard Contractual Clauses.

7. How long we keep it

We keep account data for as long as your account is active. Server data and saves are kept while the relevant server exists and may be removed after extended inactivity. Payment and accounting records are kept as required by law. Analytics data is retained for up to 12 months. When you delete your account, we delete your account data, servers, and saves.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased — you can delete your account yourself at any time under Account → Delete account in your dashboard;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent (e.g. for analytics) at any time;
• lodge a complaint with a supervisory authority — in Denmark, Datatilsynet (datatilsynet.dk).

To exercise any of these, contact [email protected].

9. Security

We take reasonable technical and organisational measures to protect your data, including encrypted connections, access controls, and isolated, sandboxed game-server containers. No system is perfectly secure, but we work to keep your data safe.

10. Children

The Service is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we'll remove it.

11. Changes

We may update this policy from time to time. We'll update the "last updated" date above, and for significant changes we'll do our best to notify you.

12. Contact

SLASHPLAY ApS · CVR 44964988 · [email protected]