Legal

Privacy Policy

Last updated: 22 August 2026

Who controls your data

Ilona Zimmermann is the operator responsible for data processed by this website and game server. The postal contact address is provided in the Legal Notice. Privacy requests can be sent to support@crystalsmp.us.

Data we process

When you visit the website, Cloudflare processes technical request data needed for security and delivery. When you start checkout verification, we process your Minecraft username, a one-way hash of the verification code, timestamps, cart contents, a support reference and a salted one-way hash used for rate limiting.

Checkout ownership can only be verified in game. Successful verification stores your Minecraft UUID and creates an optional website account session. The separate Discord linking flow stores the Discord user ID and linked Minecraft account only when you choose to use it. Verification codes expire after 15 minutes.

Support tickets may contain your Minecraft username, Discord account identifier, contact email, category, subject, messages, attachments and operational timestamps. Discord ticket channels are private to the requester, invited participants and authorised staff. When a Discord ticket is closed, a text transcript is retained with its assignment, priority and audit history so the team can investigate complaints and support decisions. A website ticket access key is stored only as a one-way hash on the server. Staff replies, assignments, status changes, refund-review records and administrative actions are logged for accountability.

The game server may process account identifiers, IP and security logs, chat and moderation records, gameplay statistics, economy data and player-created content where needed to operate and protect the service.

Payments

Checkout is provided by Tebex Limited as Merchant of Record. Tebex processes payment, tax and transaction data under its own privacy terms. CrystalSMP does not receive card details and retains only the transaction reference, verified Minecraft account, purchased products, amount, currency and delivery status needed to deliver and support the purchase.

Purposes and legal grounds

Data is processed to provide requested website, verification, game, support and purchase services; protect accounts and infrastructure; enforce server rules; meet legal obligations; and handle disputes. Depending on the activity, processing is necessary for a contract, compliance with law or a proportionate legitimate interest in security and service operation.

Retention

Unused verification sessions are removed after no more than 30 days. Website account sessions expire after 30 days. Support, checkout and purchase audit records may be retained longer where needed for service, delivery, disputes, accounting or legal obligations. Security and moderation records are kept only while necessary for those purposes.

Recipients

Service data may be processed by Cloudflare for website hosting, authentication and protection; Discord for optional account linking; the Minecraft server host for game operation; and Tebex once payments are enabled.

Staff access

Authorised staff receive role-based access only to information needed for their work. Administrative actions are logged and access can be disabled without deleting the audit trail.

Cookies and browser storage

The website does not use advertising or cross-site tracking cookies. It uses necessary account sessions and local browser storage for the cart and private support-ticket access. Details are available in Cookies and Browser Storage.

Your rights

Depending on your location, you may have rights to access, correct, delete or restrict the processing of your personal data. Contact support@crystalsmp.us.

Security

Verification codes and ticket access keys are stored as one-way hashes. Codes are single-use and expire after 15 minutes. Staff APIs require a verified Cloudflare Access identity plus an active internal role.