Privacy Policy

Who is responsible

C2lyn Studios, based in Alabama, USA, is the controller for the personal data described here. Contact (email only): email support@c2lyn.com, or use the support page at https://c2lyn.com/support/?product=elementium.

Hosting is on Hetzner servers in Germany (EU). The site is fronted by Cloudflare.

What we store, and why

• Your Discord account: your user id, username and the servers you can manage (ids and names), to sign you in and show your servers. Your Discord access token is stored encrypted for at most 7 days, for your sign-in only.

• Your settings: editor preferences, onboarding progress, and the functions you save to your library.

• Per server: everything the server's managers build (flows, panels, messages, images, templates, module settings), run logs, transcripts, levels and XP, moderation cases, application answers, and the server's secrets (encrypted; never shown back).

• Members' data the bot handles for a server's features: ids, names, messages in tickets, answers to forms, XP, strikes. The server's managers decide which features are on; ask them about their use of your data.

• Minecraft servers: when the plugin asks for a pairing code, and about once a minute once it is paired, it sends the dashboard the server's Minecraft version, the plugin's version, the list of installed plugins, the permissions those plugins declare, whether LuckPerms is installed, how many Elementium roles the server has, the server-list message, the online-mode setting, the number of players online, TPS, how long the server has been up, the plugin's own recent error messages (with IP addresses removed) and the blocks the plugin supports. We use this to pair the server and show it to you. Setting api-url to empty in the plugin's config.yml stops all contact with the dashboard.

• Minecraft run records: for each flow run the plugin sends which flow ran, success or failure, how long it took, the short result of each step (which can include text the flow handled, like a chat line a filter looked at) and the name of the player who started it. Shown in your run log; kept as run logs are, below. Player IP addresses and client details are not sent, and flows cannot read them.

• Minecraft roles: the roles you make for a server keep the Minecraft names, and UUIDs when known, of the players you or the Discord link put in them, and send them to that server.

• Minecraft resource packs: if you add one, we keep its name and the file, or the link you gave and its checksum. We fetch a linked pack to check it, and players download it from that link, so that site sees them as any download would. Players download an uploaded pack from us; we count downloads per pack per day, and that count does not say who downloaded it.

• Minecraft players have no account with us. The server's owner decides what runs on the server and is responsible for telling their players. If a server links to Discord, a player who links their account has their Minecraft name, UUID and Discord id kept while the link lasts, and the join, leave, death and chat lines the owner chose are passed through us to that Discord channel.

• The Minecraft founder list: your email, your server's size if you give it, your age group and, if you are under 18, a parent or guardian's email, to tell you when it opens and to take payment from the right person.

• Feedback you choose to send us: your answers and your Discord id, so we can improve the product and follow up. We keep it until you ask us to delete it.

• Billing: your Stripe customer id, subscription and plan state, invoice amounts and dates. Card details are held by Stripe, never by us.

• Custom bots: the bot token you paste, encrypted, used only to run your bot.

• If you arrive through a tracked link (?ref=…), we note which link it was when you sign in. Nothing is stored on your device for this.

Who processes it for us

• Discord (the platform the bot runs on).

• Stripe (payments).

• Hetzner (hosting, Germany).

• Cloudflare (proxy and protection for the website).

• The AI provider (Groq): only the text sent to AI features (descriptions, ticket messages where ticket AI is on, FAQs). We do not use your data to train models.

Legal basis

Performing our contract with you (running the bot and the dashboard), our legitimate interest in keeping the service safe (abuse limits, logs), and your consent where you turn an AI feature on.

How long

Run logs and transcripts are kept for the retention period of the server's plan (7 days to 2 years, see the pricing page). Sign-ins end after 7 days. Payment records are kept as long as accounting law requires. A server's data is deleted 30 days after the bot leaves it, or earlier on request; payment and billing records stay, as above. If the bot is added back within those 30 days, everything is still there. Removing a Minecraft server from the dashboard stops it syncing at once and forgets its secret; to have what was saved for it deleted, write to us at the contact above, and we do it within 30 days.

Your rights

You can export everything we keep about you from the Account tab (/api/me/export) and delete it with Delete my data on the same tab, which also removes your Minecraft servers, their roles and resource packs, and your place on the founder list (a running plan is cancelled first; payment records stay, as above). In the EU you also have the rights to access, correct, restrict and object, and to complain to a supervisory authority. Write to us at the contact above.

We never sell personal data, and we never share Discord data with anyone except the processors above.

Children

The service is for people aged 13 and over (Discord's minimum, higher in some countries). We do not knowingly keep data about younger children; tell us and we delete it.