Privacy Policy

The controller responsible for data processing is:

Email: privacy@nebulanodes.cloud

Our website, dashboard and game servers run on our own server in a data center in Eygelshoven, the Netherlands (EU). When you visit our website, our web server automatically processes:

• IP address
• Date and time of the request, requested page and HTTP status
• Browser type, operating system and referrer URL

Incoming traffic to our website and game servers is filtered for DDoS attacks by our network provider aurologic GmbH, Germany. This is necessary to deliver the website securely and protect it against abuse (Art. 6 (1) (f) GDPR). Web server log files are deleted after 14 days at the latest.

You log in with your Discord account (Discord Inc., 444 De Haro Street, San Francisco, CA 94107, USA). When you log in, Discord shares the following data with us, based on the permissions “identify” and “email”:

• Discord user ID, username and display name
• Avatar
• Email address
• Whether two-factor authentication is enabled on your Discord account

We use this data to create and identify your account (Art. 6 (1) (b) GDPR). We do not receive your Discord password, messages or servers. For each login we store a session with your IP address and browser (user agent) to keep you signed in and to detect misuse. You can see and end your sessions under Settings → Security. Sessions expire after 30 days. We use the two-factor status only to show you whether your account is well protected. Discord's privacy policy applies to the login on discord.com.

In your account settings you can optionally enter personal details: first and last name, company, street, postal code, city, country and phone number. All of these fields are voluntary. We use them to prefill invoices and for customer support (Art. 6 (1) (b) GDPR). You can change or delete them at any time in the dashboard.

We also store your account balance and a history of balance changes (top-ups, charges and renewals of paid servers, referral rewards, redeemed coupons and gift codes, refunds), as well as the billing details of your paid servers (size, price, paid-until date, renewal setting).

When you create a server, we process:

• Server settings, worlds, plugins, mods and files you upload or edit
• Backups you create, stored on a separate storage server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, as our processor
• Live status and resource usage (CPU, RAM, storage, number of online players) shown in the dashboard
• Data of players who join your server, as recorded by Minecraft itself: usernames, UUIDs, IP addresses in the server log, and operator, whitelist and ban lists

This is required to provide the service (Art. 6 (1) (b) GDPR). As the operator of your Minecraft server, you are responsible for the data of your players. When you delete a server, its files and backups are deleted immediately.

For every server we keep an activity log of actions such as starting and stopping the server, console commands, file changes, backups, player management and changes to users. Each entry contains the acting user, the action, the time and the IP address.

The log helps server owners see who changed what and protects against misuse (Art. 6 (1) (f) GDPR). IP addresses are only visible to the server owner. Activity entries are kept as long as the server exists.

SFTP. If you use SFTP, we store a hash of your SFTP password (never the password itself) and log each connection and a summary of the changed files with your IP address in the activity log. Failed logins are counted per IP address and username for 15 minutes to stop password guessing.

Notifications. The dashboard shows you notifications about events of your account and servers, for example ticket replies, finished or failed backups, crashes, renewals and balance top-ups. They contain the event, the server or ticket concerned and the time, are only visible to you and are deleted after 90 days (Art. 6 (1) (b) GDPR).

Discord bot and DMs. If you choose so in Settings → Notifications, our Discord bot sends you notifications of the selected categories as direct message; for this, the title and text of the notification and your Discord user ID are transmitted to Discord Inc. (USA, see section 15). You can turn this off at any time. When you use our slash commands on Discord (e.g. /servers), we process your Discord user ID to find your account and answer only you; staff commands are limited to our team (Art. 6 (1) (b) and (f) GDPR).

When you open a support ticket, we store the category, title, your messages and our replies. If you select a server, we attach a snapshot of it: name, plan, software, resources, status and the last 40 lines of its console. Console lines can contain player names and IP addresses of your players. Our staff see this data to answer your request; you see the name and Discord avatar of the staff member who replies.

You can attach screenshots. They are converted to a new image file, which removes hidden metadata such as location or camera details, and can only be viewed by you and our staff. Images that are uploaded but never sent are deleted after one day.

If enabled, a notification with the ticket title, category, your display name and the beginning of your message is posted to a private Discord channel of our team (Discord Inc., USA; see section 15). Tickets are processed to provide support (Art. 6 (1) (b) GDPR) and kept as long as your account exists.

When you use our withdrawal function, "Cancel contracts here" or the abuse report form, we store your name, email address, the contract or server concerned, your message, the time and your IP address, and give you a reference number. We need this data to process your request and to prove that we did (Art. 6 (1) (c) GDPR together with consumer law and the Digital Services Act). We keep it for three years after the end of the year of the request. Abuse reports may be passed on to authorities if the law requires it; the affected customer is told about the measure and the reasons, but not who reported it, unless the law requires otherwise.

To use the API, you request access with a short description of your project and, optionally, a link. We store the request, our decision and an optional note. For each API key we store its name, permissions, allowed servers, expiry date, the time and IP address of its last use, and a cryptographic hash of the key. The key itself is shown to you once and is not stored in readable form. Actions made with a key appear in the activity log with the key's name (Art. 6 (1) (b) and (f) GDPR).

• To protect against attacks and abuse, we count requests per IP address, account and API key for a few minutes to an hour (rate limiting). These counters are only kept in memory.
• After repeated failed logins via SSH or SFTP, the IP address is blocked in our firewall for one hour (fail2ban). For this, the IP address and the time of the failed attempts are kept in our server logs for a few days (Art. 6 (1) (f) GDPR).
• Our status page (status.nebulanodes.cloud) only shows automatic checks of our own systems and announced incidents. It contains no personal data and sets no cookies; server logs as described in section 2 apply.
• When you order a paid server or an upgrade, we store your confirmation that the service should start immediately (time, version of the text, IP address) as proof under consumer law (Art. 6 (1) (c) and (f) GDPR).
• Actions of our staff with elevated rights (for example changes to balances, suspensions, coupons, API access decisions and actions on customer servers) are logged with the staff member, time and IP address.

Top-ups are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland (“Stripe”). When you top up, you are redirected to Stripe's checkout page. We pass your account ID, the amount and, if provided, your name, email, address and phone number to Stripe. Payment details such as card numbers are entered directly at Stripe and never reach us.

We store the amount, status and the invoice and receipt links returned by Stripe. Invoices are retained for 10 years to comply with tax law (Art. 6 (1) (b) and (c) GDPR). Stripe may transfer data to the USA; see section 15. More information: stripe.com/privacy.

If you open a referral link (/r/…), we set the cookie nn_ref for 30 days so the sign-up can be credited to the referrer. To count link clicks, we store a one-way hash of your IP address and browser per referrer and day; the hash cannot be turned back into your IP address.

If you sign up, we store who referred you and the IP address of your sign-up. To prevent abuse, we compare it with the referrer's session IP addresses and check the age of your Discord account. The referrer only sees a partially hidden version of your username and the status of the referral (Art. 6 (1) (f) GDPR).

You can optionally link further accounts in the dashboard (Art. 6 (1) (a) GDPR):

• GitHub (GitHub, Inc., USA): user ID, username, profile picture, profile link and number of public repositories.
• Microsoft / Xbox / Minecraft (Microsoft Corporation, USA): Xbox user ID and gamertag, and, if you own Minecraft: Java Edition, your Minecraft username and UUID.

We do not store access tokens. You can unlink these accounts at any time; the stored data is then deleted.

To provide certain features, we use the following services:

• Modrinth (Rinth, Inc., USA): the plugin, mod and modpack browser searches Modrinth and downloads files from it via our server. Modpacks may also download individual files from GitHub or GitLab, as listed in the modpack; this is done by our server, too. Project icons are loaded from cdn.modrinth.com in your browser, which transmits your IP address to Modrinth.
• GeyserMC: the one-click add-ons download Geyser and Simple Voice Chat from Modrinth and Floodgate from download.geysermc.org via our server. No personal data of yours is transmitted.
• mc-heads.net: player heads are loaded from mc-heads.net in your browser, which transmits your IP address and the displayed player names or UUIDs to this service.
• Discord CDN: avatars are loaded from cdn.discordapp.com in your browser, which transmits your IP address to Discord.
• Mojang / Microsoft: Minecraft servers check players' logins with Mojang's authentication servers, as with any online-mode Minecraft server.
• Software downloads: server software and version lists are fetched from PaperMC, PurpurMC, FabricMC, Minecraft Forge, NeoForged and Mojang by our server.

These services are used to provide the features you request (Art. 6 (1) (b) and (f) GDPR).

We only use technically necessary cookies and do not use tracking or advertising cookies:

• __Host-nn_session (formerly nn_session): keeps you signed in (30 days)
• nn_oauth_state, nn_connect_*: protect logins and account linking against forgery (10 minutes)
• nn_ref: remembers a referral link (30 days)

Your browser's local storage remembers dashboard preferences such as collapsed menu sections. Consent is not required for these (§ 25 (2) TDDDG).

Discord (login and, if enabled, support notifications), Stripe, GitHub, Microsoft and Modrinth may process data in the USA. Transfers are based on the EU–U.S. Data Privacy Framework, where the provider is certified, or on the EU Standard Contractual Clauses (Art. 45 and 46 GDPR).

We keep account data as long as your account exists. When your account is deleted, we delete your servers, backups, personal details, linked accounts, API keys, notifications and support tickets, and remove your name and IP address from activity logs of other servers. Invoices, payment records and balance bookings are kept, linked to an anonymised account, for the statutory retention period of 10 years, and proof of consents for as long as claims can arise.

For disaster recovery we create a daily backup of our platform database (accounts, balances, payments, tickets) on the storage server of Hetzner Online GmbH. These backups are kept for 30 days, so deleted data disappears from them at the latest 30 days after deletion.

Under the GDPR, you have the right to:

• Access the personal data we hold about you (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure of your data (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Object to processing based on legitimate interests (Art. 21)
• Withdraw your consent at any time with effect for the future (Art. 7 (3))

You can download a copy of your data as a JSON file (Art. 15 and 20) and delete your account (Art. 17) yourself at any time under Settings → Your data in the dashboard. For all other requests, or if you cannot log in anymore, email privacy@nebulanodes.cloud. You also have the right to lodge a complaint with a data protection supervisory authority.

We may update this policy when our service changes. The current version is always available on this page.