Privacy Policy
Last updated:
Introduction
The controller responsible for your personal data is CraftLands Hosting S.R.L., CUI 50929471, Reg. Com. J2024043623000, with its registered office at Calea Moșilor 88, Sc. F, Ap. F1, Sector 3, 030152, București, Romania. For any privacy question, contact us at business@craftlands.host.
It covers craftlands.host, the client portal, the support chat and the game panel.
What personal information do we collect?
To buy, we need your name, email address and billing address (contract and tax law). Without them we cannot provide the service. Payment details go directly to the payment provider.
You also give us: phone number, country, and the tickets, messages, cancellation reasons and refund requests you send.
Collected automatically: IP address, browser type and version, device, pages opened and how you arrived. WHMCS, our billing software, stores this on servers we rent.
Payments: you enter card details with our payment providers, not with us. We receive the payment status, method type and a transaction ID.
Game server: your panel username and email, login history with IP address and browser, and your server’s files, databases, console output and backups.
Affiliate program: your referrals and coupon use.
Your players’ data (names, chat, IP addresses) is decided by the server owner. For it we act as a processor, under the Data Processing terms in our Terms of Service.
Payment Information and Transactions
Stripe processes checkout payments and runs its own fraud checks.
Depending on the method you pick, that method’s provider also receives your payment details: PayPal, Klarna, Revolut Pay, Apple Pay, Google Pay, Link (Stripe’s own), Satispay, TWINT, MobilePay, MB WAY, Multibanco, Bizum, UPI, or your bank for Bancontact, BLIK, EPS and iDEAL | Wero.
Older PayPal subscriptions renew directly through PayPal.
Stripe: https://stripe.com/privacy. PayPal: https://www.paypal.com/us/legalhub/privacy-full.
Why we use your data and on what legal basis
Create your account, sell and run your server, support you. Basis: contract (GDPR Art. 6(1)(b)).
Invoices, accounting records and tax reporting where the law requires. Paid invoices are reported to the Romanian tax authority (ANAF) through the national e-Factura system. Basis: legal obligation (Art. 6(1)(c)).
Keeping the service secure and preventing fraud and abuse (IP, browser, order, account and log data). Basis: legitimate interest (Art. 6(1)(f)), protecting our service and customers.
Fixing errors, answering you in the support chat, and learning why customers cancel. Basis: legitimate interest, improving the service.
Per order we store how you arrived (campaign, keyword, page), your IP address and browser. Basis: legitimate interest, counting ad sales and spotting abuse. Click IDs need marketing consent.
Basic page-view pings from Google Analytics and Microsoft, without cookies. Basis: legitimate interest, counting visits. See Cookies.
Showing the nearest game-server location (latency test on pricing, server and checkout pages). Basis: legitimate interest.
Analytics cookies, session recordings and heatmaps (Microsoft Clarity), and ad measurement (Google, Microsoft, Reddit, OpenAI; see Advertising data). Basis: consent (Art. 6(1)(a)).
Proof of your cookie choice. The cl_consent cookie holds the version, time and your three choices. For each order we also store your consent state and country. Basis: legal obligation and legitimate interest, proving consent.
We make no decision about you by automated means alone that has legal or similar effect. Unpaid services are suspended automatically under our Terms; paying restores them until the server is deleted (see our Terms).
Who receives your data
Service providers act on our instructions. Payment and advertising platforms also use data under their own terms, as independent controllers.
Payments: Stripe and the method providers listed above.
Hosting: game servers and our systems run in data centres in the EU, the USA and Singapore, on our own hardware and on rented servers. Pricing, server and checkout pages contact our game servers, which see your IP address.
Network and security: Cloudflare sees your IP address and requests, runs the firewall and Turnstile bot check on the panel login, and gives us your country for cookie defaults.
Email: Spacemail (Namecheap).
Support: our own Chatwoot system. The support chat widget loads on our website (except blog posts), client portal and panel login so you can reach us. Basis: legitimate interest. Discord, if you contact us there.
Analytics and ads: Google; Microsoft, including Clarity; Reddit; OpenAI; Ahrefs Pte. Ltd. (Singapore). Stape runs our tracking server in the EU (eu.stape.io) and passes events to them.
On the client portal, Google Fonts load on every page (also inside the Stripe payment form) and the Google sign-in button on the login page; Google sees your IP address.
Gravatar (Automattic) shows your picture when you are logged in, using a hash of your email.
Errors (stack trace, page URL, browser; on the portal also your customer number, no name or email) go only to our own self-hosted Sentry server, software we run ourselves. We do not send them to an outside error-tracking company.
Both the main site and the portal bundle the error script themselves, so no outside company serves it or sees your IP address.
Advertising data
“Hashed” means scrambled into a SHA-256 code that cannot be read back. The platform uses it to match against its own users.
Page visits and shop steps (pages, plans viewed, cart, checkout, sign-up, login), with Marketing consent: Google Ads, Microsoft, Reddit and OpenAI get the page or event, your IP address, your browser type and, where they set one, their own browser ID. When you are logged in, this can include your email and phone as hashes.
Purchases, with Marketing consent: our tracking server (Stape, EU) passes on your order. Google Ads gets order value, order ID, items and coupon; Microsoft value and order ID; Reddit value, order ID and item count; OpenAI the order ID. Email hashed to all four; phone hashed to Google, Microsoft and Reddit. Google also gets your first and last name hashed, and postal code and region readable. Each platform also gets its ad click ID.
With Analytics consent too: your IP address and browser type, readable, and your customer number (readable to Reddit, hashed to Microsoft and OpenAI).
Without Marketing consent, Google Ads still gets every new order: value, order ID, items and coupon only, marked “no consent”. No contact details, click ID, IP address or browser type. Basis: legitimate interest, counting sales.
Our tracking server removes name, email, phone, address and ad click IDs from what it forwards to Google Analytics. Your browser also sends page views to Google Analytics directly.
We do not sell your personal data. We share the data above with ad platforms to measure our ads.
Transfers outside the EEA
Some recipients are in the USA, Singapore or other countries outside the EEA. For US transfers we rely on safeguards such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework, where the provider is certified. Elsewhere we rely on the Standard Contractual Clauses. Ask for details at business@craftlands.host.
How Long Is Data Kept For?
Invoices and accounting records: the period required by Romanian accounting and tax law.
Account data: kept while you have an account. Accounts are not deleted automatically; ask us and we delete or anonymise it, except what the law requires.
Order attribution data (IP, browser, traffic source): kept to prevent fraud and measure ads.
Support tickets and chat conversations are not deleted automatically; ask us to delete them.
Server files: kept and deleted as set out in Termination and Deletion in our Terms of Service.
Cookie choice: 12 months.
Data held by Google, Microsoft, Reddit, OpenAI and Ahrefs: per their own terms.
Your Rights Over Your Data
You have the right to access the personal data we hold about you, to have inaccurate data corrected, to have your data erased, to restrict or object to how we process it, and to receive it in a portable format. You can exercise any of these rights by opening a support ticket or by writing to business@craftlands.host.
To have your data deleted, open a support ticket or write to business@craftlands.host. We answer within one month. We delete or anonymise it, except what we must keep by law (such as invoices) or need to defend legal claims.
You can object at any time to processing based on legitimate interest, and to direct marketing.
We send marketing emails only with your consent. Emails about your account, orders, servers and changes to these terms are part of the service.
Where we rely on your consent, you can withdraw it at any time, as easily as you gave it, with the Cookie settings link in the footer.
Under 16, you need a parent’s or guardian’s permission, including for optional cookies. The Terms of Service set the age to buy: 13 or older, with parental permission until 18.
You also have the right to lodge a complaint with a data protection supervisory authority. Ours is the National Supervisory Authority for Personal Data Processing (ANSPDCP), 28-30 G-ral Gheorghe Magheru Bld., District 1, 010336 Bucharest, Romania. Complaints can be submitted at https://www.dataprotection.ro. If you live in another country, you may also complain to the supervisory authority where you reside.
Changes to this policy
We email account holders about material changes before they apply.
Last change: 31 October 2026.