Privacy policy

1. Controller

CraftingTech Wilms / CraftingHosting
Lucas Wilms
Lüdenscheider Str. 21
51688 Wipperfürth
Germany
[email protected] · +49 22676569938-400

See also imprint. For any questions about data protection and to exercise your rights, contact us at the email address above.

2. Hosting and access data

CraftingHosting runs the website, API, database, Pterodactyl panel, the Minecraft servers and the Discord bots itself on its own infrastructure in data centers in Germany (EU). No external hosting provider with access to your data is involved. The website’s database is an encrypted SQLite database on our own server in Germany.

When you visit the website, your IP address is processed technically to deliver the pages. To prevent abuse (limiting requests per IP address), it is kept in memory for at most 15 minutes. We do not keep a general access log of every page view; technical error logs do not contain IP addresses and are overwritten automatically. Section 6 describes the cases in which we store your IP address. The legal basis is our legitimate interest in secure and stable operation (Art. 6 (1) (f) GDPR).

3. Server request, waitlist and user account

To provide the service we store your email address, your server configuration (plan, server type, version, name), the time you accepted the terms of use and the language in which you use the website (for emails and notices). During the first launch phase (early access) we also store your spot on the waitlist and the time you joined. If you had already registered with CraftingHosting for the free offer before (e.g. in the previous system or via Discord), we carry this registration over to the waitlist with your email address and inform you by email; you can delete the spot at any time. The website does not use passwords – you sign in with an email link. The legal basis is the performance of a contract or pre-contractual measures (Art. 6 (1) (b) GDPR). In addition, we store the IP address used when registering and when last signing in (see section 6).

Unconfirmed requests are deleted automatically after 3 days, open requests without panel access after 14 days. You can delete your waitlist spot and your account yourself at any time under “My servers”.

4. Provision of the Minecraft servers and Discord bots (Pterodactyl)

To create your server, we create a user account in our Pterodactyl panel with your email address and the username and password you chose. The password is only passed to the panel and is not stored by the website. If a panel account with this email address already exists, the server is assigned to that account. We also process operating data of your server (status, runtimes, resource usage) to implement the fair-use system and the 30-day cycle (Art. 6 (1) (b) GDPR). If a server is not reactivated, it is deleted including world, files and backups 48 hours after the rest period ends.

For Discord bot hosting we process the same account, panel and operating data as for Minecraft servers. Your bot’s own data (code, files, databases) and the bot token live only on your bot’s server in the panel. We do not access them – except where this is necessary to investigate abuse. You are responsible yourself for the data your bot processes via Discord.

5. Emails

We send emails to confirm your address, with sign-in links and about important events of your server (e.g. server ready, unlocked from the waitlist, end of the 30 days approaching, upcoming deletion). The emails are sent via CraftingHosting’s own mail server; no external email service provider is used. The legal basis is Art. 6 (1) (b) GDPR. We do not send advertising emails.

Newsletter: if you subscribe to the newsletter (form on the website or checkbox when creating a server), we use your email address to send you news and offers from CraftingHosting.free and Crafting Hosting. The subscription only becomes effective once you confirm it via a confirmation link (double opt-in) or – for the checkbox in the order form – confirm your email address. As proof we store the time of the subscription and of the confirmation, the chosen language and the IP address at the time of subscription (encrypted). The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time – via the unsubscribe link at the end of every issue or by sending us a message. After unsubscribing you will no longer receive the newsletter; when you delete your account, the newsletter entry is deleted as well. Emails are sent via our own mail server, without open or click tracking.

Operational notices (e.g. about maintenance, migrations or changed terms) are sent to your account’s email address independently of the newsletter, as far as this is necessary to provide the service (Art. 6(1)(b) GDPR).

6. IP addresses, security and activity logs

To prevent abuse (e.g. multiple accounts, attacks), we store your IP address in the following cases:

• when you register and when you last signed in – in your user account, until the account is deleted;
• each time you sign in, together with the browser identifier (user agent), in the session data – until the session ends; expired sessions are cleaned up automatically;
• when you confirm the cookie notice, together with the time and browser identifier – 90 days;
• for security-relevant actions (e.g. sign-ins, server actions) in the activity log – 90 days.

IP addresses and browser identifiers are stored in encrypted form (AES-256-GCM); in addition, the entire database is encrypted. Only CraftingHosting administrators can view them in order to investigate abuse. The legal basis is our legitimate interest in preventing abuse and in secure operation (Art. 6 (1) (f) GDPR).

Server runtime data is deleted automatically after 90 days and notifications after 180 days. The status page only stores technical measurements without any personal reference.

7. Donations

Donations are processed via a SumUp payment link (SumUp Limited, Block 8, Harcourt Centre, Charlotte Way, Dublin 2, Ireland). When you click the donate button you leave our website; SumUp processes your payment data as an independent controller under its own privacy policy. We receive from SumUp the payment confirmation, the amount and the payer’s name as provided by SumUp – no card data. We use this information to process the donation, for bookkeeping and for refunds (Art. 6 (1) (b) and (f) GDPR) and keep it for the statutory retention periods.

8. Cookies

We only use technically necessary cookies: a session cookie for signing in, a cookie that remembers that you confirmed the cookie notice and – only if you switch the language – a cookie that stores your language choice. We do not use tracking or marketing cookies. See the cookie notice for details.

9. Fonts and external content

Fonts are loaded locally from our server – there is no connection to Google Fonts or other third parties. Links to Discord or to the CraftingHosting main website open external services with their own privacy policies; data is only transmitted when you click such a link.

10. Recipients, third countries and automated decisions

We do not pass on your data to third parties unless we are legally obliged to do so. There is no transfer to countries outside the EU. For donations, SumUp processes your payment data under its own responsibility (section 7). The fair-use system stops servers automatically according to fixed rules that are the same for everyone; there is no automated decision with legal effect within the meaning of Art. 22 GDPR.

11. Your rights

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR)
• Complaint to a supervisory authority (Art. 77 GDPR)

The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de. You can also contact the supervisory authority where you live.