Privacy Policy
Last updated: 2026-08-11
This Privacy Policy explains what personal data Martin Regec ("VoxelRun") collects, why we collect it, and what we do with it. VoxelRun acts as the data controller under the GDPR. The data controller is Martin Regec, Nové sady 988/2, Staré Brno, 602 00 Brno, Czech Republic, contact: [email protected].
1. Data we collect
Account data: email address, a chosen display name, and — if you choose to verify it — your phone number. Authentication data: a hashed password and short-lived JWT tokens. Billing metadata: a payment provider customer reference (Paddle Customer ID), the credit packs you have purchased, transaction IDs (we never see your card number). Usage data: server start/stop events, durations, allocated server size, and the IP address of the client that used the dashboard. Operational logs: minimal request logs retained for security purposes.
2. Why we collect it
To provide the Service, bill it, communicate with you about it, secure it against abuse, and comply with our legal obligations (accounting, tax records, fraud prevention).
3. Legal basis
Performance of a contract for account, server, billing and support data. Legitimate interest for security logs and abuse prevention. Legal obligation for invoicing and tax records. Consent for optional analytics or marketing communications, which you may withdraw at any time.
4. Sub-processors
MEVSPACE sp. z o.o. (PL) - bare-metal server hosting and network. Hetzner Online GmbH (DE) - backup object storage. Paddle.com Market Ltd (UK) - Merchant of Record, payment processing and tax compliance. Brevo / Sendinblue SAS (FR) - transactional email and SMS (phone verification). Cloudflare Inc. (US/IE) - DNS and DDoS protection where applicable. Anthropic PBC (US) - AI-assisted analysis of server logs for the optional crash-diagnostics feature, used only when you run a diagnosis. All sub-processors are bound by data protection agreements compliant with EU data protection law.
5. International transfers
Primary hosting data is stored within the European Union. Some sub-processors may incidentally transfer metadata outside the EU under Standard Contractual Clauses or equivalent safeguards. If you use the optional AI crash-diagnostics feature, the relevant server log excerpt is transmitted to Anthropic PBC in the United States for that analysis under Standard Contractual Clauses; this only happens when you run a diagnosis, and such logs may contain player names, IP addresses, or world details.
6. Retention
Account data: for the life of your account. Backups: unpinned backups 30 days after creation unless deleted or rotated earlier; pinned backups until you unpin or delete them. Billing records: for the period required by Czech accounting and tax law. Logs: 90 days. Marketing data: until you withdraw consent.
After account deletion, personal data is scrubbed from your account, but transaction and referral records are retained for the period required for accounting, tax and fraud-prevention purposes. To prevent repeated claims of the one-time welcome bonus, we also retain an irreversibly hashed record of phone numbers that have already claimed it; this hash is kept after account deletion and cannot be used to reconstruct the number. The verified phone number itself is removed from your account on deletion and becomes available for use with another account.
7. Security
We use appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit, operational logging, and limited access to production systems. No online service can guarantee absolute security, but we work to reduce risk and respond to incidents promptly.
8. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, port, and object to the processing of your data, and to lodge a complaint with the Czech data protection authority (Úřad pro ochranu osobních údajů). For privacy-related requests, write to [email protected].
9. Data Processing Addendum
If you use VoxelRun to process personal data on behalf of others, a Data Processing Addendum is available on request at [email protected].
11. Children
VoxelRun is not directed to children under the age of digital consent. We do not knowingly collect data from such users. If you believe a child has provided us with data, write to us and we will delete it.
12. Changes
Material changes to this Policy will be announced by email and reflected on this page.