Zásady ochrany osobních údajů
This Privacy Policy explains how MineBuff (“we”, “us”, “our”) collects, uses, shares, and protects personal data when you use MineBuff (the “Service”). It is intended to meet transparency requirements under the EU/UK GDPR and similar laws where they apply. By using the Service you acknowledge this Policy. Where we rely on consent, you may withdraw it at any time without affecting prior lawful processing.
1. Data controller
The data controller is MineBuff. Contact for privacy requests: [email protected]. Establishment details: Address available on request. If we appoint a data protection officer or EU/UK representative, we will publish those details on this page.
2. Personal data we collect
Depending on how you use MineBuff, we may process:
- Account data: email address, username, display name, password hash (if you set a password), language, timezone, bio, avatar URL, and account status.
- OAuth identifiers: Discord and/or Google user IDs, and basic profile fields those providers share when you connect (such as email or avatar), subject to your settings with those providers.
- Listing and community content: server listings, media you upload, reviews, votes (including Minecraft username you enter when voting), reports, and support messages.
- Technical and security data: IP address, approximate location derived from IP, user agent, device/browser type, timestamps, cookies or similar identifiers, CSRF tokens, and rate-limit/security logs.
- Payment-related data: subscription status, plan type, sponsored slot, amounts, currency, period end, and PayPal subscription/plan identifiers. Card numbers are processed by PayPal — we do not store full payment card details.
- Usage and delivery metrics: pages viewed in aggregate, Premium impression counts, and diagnostic events needed to operate listings and promotions.
3. Sources
We collect data directly from you, automatically from your device when you use the Service, from OAuth providers you choose to connect, from PayPal for subscription events, and from automated Minecraft server pings (which return public server status such as MOTD, version, and player counts — not private player inventories).
4. Purposes and legal bases
We process personal data to:
- Provide and secure the Service (accounts, listings, votes, reviews, abuse prevention) — contract performance and legitimate interests in running a trustworthy directory.
- Authenticate you via email/password or OAuth — contract performance and legitimate interests.
- Process Premium/Sponsored subscriptions and prevent fraud — contract performance and legitimate interests / legal obligation (tax/accounting where applicable).
- Send transactional messages (password resets, security notices, billing confirmations) — contract performance and legitimate interests.
- Comply with law, respond to lawful requests, and establish or defend legal claims — legal obligation and legitimate interests.
- Improve reliability and features using aggregated or de-identified analytics where feasible — legitimate interests. We do not sell your personal data.
5. Cookies and similar technologies
We use essential cookies or local storage for session authentication, CSRF protection, language preference, and similar strictly necessary functions. These are required for the Service to work. If we introduce non-essential analytics or advertising cookies, we will update this Policy and request consent where required by law.
6. Sharing and processors
We share personal data only as needed to operate the Service:
- Public display: listing content, reviews, and usernames you choose to publish are visible to visitors.
- Infrastructure providers: hosting, databases, email delivery, CDN, and security vendors acting as processors under our instructions.
- Discord and Google when you use OAuth login or account linking.
- PayPal for subscription checkout, billing, and webhooks.
- Authorities or advisors when required by law or to protect rights, safety, and security.
- A successor entity if we transfer the Service in a merger, acquisition, or asset sale, subject to appropriate safeguards.
7. International transfers
We and our providers may process data in countries outside your own, including outside the EEA/UK. Where required, we use appropriate safeguards such as Standard Contractual Clauses or rely on an adequacy decision. You may contact [email protected] for more information about safeguards.
8. Retention
Account data is kept while your account remains active and for a reasonable period afterward for security, dispute resolution, and legal compliance. Password-reset tokens expire automatically (typically within one hour). Vote integrity records (such as IP-based uniqueness hashes) are kept as needed for anti-abuse and may be pruned. Subscription and invoice-related records are retained as required for accounting and chargeback defense. Backups are rotated on a limited schedule. When data is no longer needed, we delete or irreversibly anonymize it.
9. Your rights
Depending on your location, you may have the right to:
- Access your personal data and receive a copy.
- Rectify inaccurate data.
- Erase data (“right to be forgotten”) in certain cases.
- Restrict or object to processing, including objection to processing based on legitimate interests.
- Data portability for data you provided where processing is automated and based on consent or contract.
- Withdraw consent where processing is consent-based.
- Lodge a complaint with a supervisory authority in your country of residence or work.
To exercise rights, email [email protected] from the address on your account where possible. We may need to verify your identity. You can update many profile fields and delete your account from the dashboard. Some data may be retained where we have a lawful basis (for example, to complete transactions, prevent abuse, or meet legal obligations).
10. Children
The Service is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child under 13 provided personal data, contact [email protected] and we will take appropriate steps to delete it.
11. Security
We implement technical and organizational measures appropriate to the risk, including HTTPS, hashed passwords, CSRF protections, rate limiting, and access controls. No method of transmission or storage is completely secure; you use the Service at your own risk. Notify [email protected] promptly of any suspected account compromise.
12. Automated processing
We use automated systems for spam/abuse detection, vote cooldowns, rate limits, server status checks, and promotional impression counting. These systems help operate the directory and do not produce legal or similarly significant decisions about you solely by automated means without human involvement where such decisions would require it under applicable law.
13. Changes to this Policy
We may update this Privacy Policy by posting a revised version on this page with an updated effective date. Significant changes will be highlighted when practicable. Continued use of the Service after the effective date constitutes acknowledgment of the updated Policy.
14. Contact
Privacy requests and questions: [email protected]. Controller: MineBuff. Address available on request. [email protected]
