Data Processing Agreement

You are the controller and we are the processor for personal data contained in resources, worlds, databases, console output and associated server content that you upload or generate. We process that data only on your documented instructions and to the extent needed to provide the service.

We may process player identifiers, nicknames and messages stored in your server's resources, plus timestamps and technical metadata generated as your server runs. We do not use this data for our own purposes or for profiling.

We apply the measures described on our Security page — encryption in transit and at rest, role-based access, least privilege, backups and monitoring — to meet the requirements of Article 32 GDPR.

We rely on trusted sub-processors for cloud infrastructure, object storage and payment processing. Current sub-processors are published on our Security page. We review and update the list as providers change, and we keep each sub-processor under a written agreement with GDPR-level obligations.

Data may be processed in different regions. Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, or an adequacy decision where one applies.

If one of your players exercises a right under the GDPR (access, rectification, erasure, portability, restriction or objection), we will cooperate with you to fulfil it against the data we process on your behalf, within statutory timeframes.

Processing lasts for as long as your workspace exists and ends when you delete it or cancel the account. On termination we erase or return personal data per your instructions, unless the law requires us to keep it.