Skip to content
PLSetti

Legal document

Privacy policy

Last updated:

This document describes how PLSetti processes the personal data of users of the home page, server rental panel, plugin catalogue and plugin clubs, review forms, licences, and sign-in through Steam and Discord.

1. Data controller

The controller of the personal data is Karol Skupień, carrying on business under the name PLSETTI KAROL SKUPIEŃ, with the business address osiedle Kopernika 8B/2, 67-100 Nowa Sól, NIP 9252119656, REGON 368396406.

For matters relating to privacy and data protection, contact: [email protected] or write to the business address.

2. What data we process

The scope of the data depends on how you use the Service. In particular, we may process:

  • account data: display name, avatar, Steam ID, Discord ID, Discord username and the email address returned by Discord,
  • session and technical data: IP address, user agent, session identifier and activity timestamps,
  • data related to the server panel: server identifier, server address ip:port, Discord channel identifier, change history, access records, demo metadata, and operational data related to server management through the website and Discord,
  • data related to plugins: download logs, club access identifiers, ip:port licence assignments, API tokens and token IP restrictions,
  • data published by the user: review content, reviewer name and associated avatar,
  • analytics data and cookie identifiers, if you consent to analytics cookies.

3. Sources of data

We receive data:

  • directly from you when you use the Service, complete forms and manage your account,
  • from OAuth sign-in providers, namely Steam and Discord, to the extent made available by your account and the permissions you grant,
  • from the technical infrastructure of the Service, including security logs, the session system, reverse proxy, Pterodactyl panel and file services.

4. Purposes and legal bases of processing

  • Creating and managing an account, signing in, and linking Steam/Discord accounts — Article 6(1)(b) GDPR.
  • Providing electronic services in the server and plugin panels, including managing access, downloads, licences and configuration — Article 6(1)(b) GDPR.
  • Ensuring security, preventing abuse, and pursuing and defending claims — Article 6(1)(f) GDPR.
  • Meeting legal obligations, in particular those relating to security, accountability and the obligations of a data controller — Article 6(1)(c) GDPR.
  • Publishing and moderating reviews submitted through the Service — Article 6(1)(b) and (f) GDPR.
  • Google Analytics and analytics cookies — Article 6(1)(a) GDPR, only after obtaining your consent.

5. Whether providing data is mandatory

Providing the data needed to sign in and use an account is voluntary, but necessary to create an account and provide services that require authorisation. Consent to analytics cookies is voluntary, and refusing consent does not prevent you from using the Service.

6. Recipients of data

Data may be disclosed to service providers acting on our behalf, in particular:

  • hosting, database and infrastructure administration providers,
  • Google Analytics (Google Ireland Limited / Google LLC) — only after consent to analytics cookies has been given,
  • Cloudflare — as a reverse proxy and, for demos, as the R2 file storage service,
  • Discord and Steam — for sign-in and account integration,
  • Pterodactyl — for managing servers and configuration files,
  • Bunny Fonts — when external fonts are loaded in selected views,
  • UI Avatars — when a fallback avatar generated from the user name is displayed in the interface,
  • email or notification tool providers, if you enable such integrations.

7. Transfers of data outside the EEA

Because external providers are used, particularly Google, Discord, Steam or Cloudflare, data may be transferred outside the European Economic Area. In such cases, the transfer is based on mechanisms provided for by the GDPR, such as standard contractual clauses, an adequacy decision or another lawful mechanism used by the provider concerned.

8. Data retention period

  • account data — for as long as the account is held, and afterwards for the period necessary to defend against claims and meet legal obligations,
  • session data — for the duration of the session and the technical retention period in the session system,
  • plugin download logs, security logs, change history and token information — for the period necessary for accountability, security and claims,
  • reviews — until they are deleted, cease to be useful, or an effective objection or erasure request is made, if there is no other legal basis for further processing,
  • server demo metadata — as a rule, for up to 3 days after the record is created, in accordance with the technical policy of the Service,
  • analytics data — until consent is withdrawn or the retention period configured in Google Analytics expires; in the GA4 configuration, we recommend entering a specific period after verifying the account.

9. Cookies and Google Analytics

The Service uses essential cookies and similar technologies needed for sign-in, session maintenance, security and the proper operation of the website. These files do not require separate consent.

In addition, the Service may use Google Analytics to measure traffic and analyse how the Service is used. Analytics cookies are enabled only after obtaining your consent. You can withdraw or change your consent at any time using the Cookie settings button in the footer.

10. Visibility of data to other users

As part of the Service, some data may be visible to other authorised users, such as the account name, avatar, or Steam or Discord identifier when server access or plugin downloads are shared. Accepted reviews may be displayed publicly with the reviewer’s name or pseudonym and avatar.

11. Your rights

You have the right to:

  • access your data,
  • rectify it,
  • have it erased,
  • restrict its processing,
  • data portability, where the basis for processing permits it,
  • object to processing based on a legitimate interest,
  • withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal,
  • lodge a complaint with the President of the Personal Data Protection Office.

12. Automated decision-making

Personal data is not used to make decisions based solely on automated processing, including profiling, within the meaning of Article 22 GDPR.

13. Changes to the privacy policy

The Policy may be updated in the event of legal, organisational or technical changes. The current version is published in the Service together with the date of the last update.

Cookies

Choose your analytics cookie settings

We use essential cookies for sign-in, security and operation of the service. We enable Google Analytics only after you give consent. You can change your choice at any time using the “Cookie settings” button in the footer.