Privacy Policy

1. Which data

Account: e-mail address, display name, chosen language, password (only as a hash, unreadable to us). Per login session: IP address, browser and time.

Ordering and payment: plan, server name, payment status and dates. We never see card or bank details; those are processed by the payment provider.

Server: the files, worlds, backups and settings of your server, and the player names in whitelist, operators and bans. Friends you give access to: their e-mail address.

Contact: what you e-mail us.

2. Purposes and legal basis

To perform the contract: your account, order, server, e-mails about your subscription (confirmation, payment, cancellation) and support.

Based on our legitimate interest: security (sessions, preventing abuse), the log of administrative actions, and measuring capacity and outages.

Based on a legal obligation: the administration of payments. We do not use your data for marketing without your consent and never sell it.

3. Processors and transfers

Hosting of the portal and the servers: OVH (European Union). E-mail and backup storage: Amazon Web Services (regions in the European Union). The Pelican panel runs on our own server. Payments: our payment provider, which receives your e-mail address and the payment details.

Player names you add to the whitelist, operators or bans are sent to Mojang/Microsoft (to verify the name) and to mc-heads.net (the player head as an image). Those parties are outside the European Union and receive only the player name, never your account data.

Your account data and server files are processed within the European Union.

4. Retention periods

Account and login sessions: until you delete your account (possible in My account); a login session expires after 14 days. Payment data: seven years (statutory retention). The log of administrative actions (which administrator did what on which subscription) is kept for as long as the service exists.

Server and files: up to 14 days after the subscription ends; the final backup and backups you delete yourself for another 90 days. We keep encrypted backups of our database for up to 12 months; data of a deleted account may still be present in those. Technical logs are kept briefly, only for troubleshooting.

5. Cookies

We only use functional cookies: one for your login session and one for your language choice. There are no tracking or advertising cookies, so no cookie banner is needed.

6. Security

Connections use TLS. Passwords are stored only as a hash. You can view and log out your logged-in devices in My account. Access to customer servers is limited to what is needed for administration and support, and is logged.

7. Your rights

You have the right to access, rectify, delete, restrict, object to and transfer your data. You change your name, e-mail address and language yourself in My account; deleting your account is possible there too (once your subscription has ended).

For other requests e-mail support@caveservers.com; we respond within a month. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

8. Players on your server

You decide who plays on your server and which plugins or mods you install. You are responsible for the data you process about players with them (such as player names and chat); we only store it as part of your server files and backups.

9. Changes

We may update this policy. The date at the top shows the latest version; in case of a material change we inform you by e-mail.