Privacy Policy

Who is responsible

The controller of your personal data, in the sense of the EU General Data Protection Regulation (GDPR), is:

We have not appointed a data protection officer, because the law does not require one for what we do. Write to the email address above for anything about privacy.

Where this applies

This policy covers:

• this website, lethium.net;
• the license portal, license.lethium.net;
• the license checks that Lethium plugins make from your Minecraft server;
• the license and role bot on our Discord server;
• email you send us.

It does not cover BuiltByBit or Discord themselves. When you buy on BuiltByBit or use Discord, those companies process your data under their own privacy policies.

Visiting lethium.net

This website is a set of static pages. It sets no cookies, has no analytics, no advertising and no social media plug-ins. Fonts and images are served from our own server, so your browser contacts nobody else when you read these pages.

Like every web server, ours writes a log line for each request:

We do not combine these logs with any other data and do not use them to identify visitors.

The license portal

You use license.lethium.net to see and manage the license keys for what you bought. To do that we need to know which Discord account and which BuiltByBit account are yours.

We never receive your payment details. BuiltByBit handles the payment.

While you are logged in, the portal keeps your IP address and the page you are on in memory for about a minute, so our staff can see who is online. This is not written to disk. Changes that our staff make to licenses are recorded in an internal log.

Legal basis: performance of our contract with you, Art. 6(1)(b) GDPR, for your account and licenses. Legitimate interests, Art. 6(1)(f) GDPR, for the name history and the internal log: we need to prevent license abuse and be able to trace changes.

License checks

Lethium plugins confirm their license with our license server. Each check sends:

• the license key;
• the name of the plugin;
• a server fingerprint: a short hash made from a random value stored in the plugin's folder and basic system properties. It cannot be turned back into information about your machine, and it changes if you delete that stored value.

The check reaches us from your server's public IP address, which we also record. For each license we keep the list of IP addresses and fingerprints it was used from, with the first and last time we saw each, and a log of the checks with their result.

A license check never contains player names, player UUIDs, chat, commands, world data or files.

Why: to confirm that a license is valid, to apply the limit on how many servers one license may run on, and to detect leaked or pirated keys.

Legal basis: performance of the license contract, Art. 6(1)(b) GDPR, and our legitimate interest in protecting our software against piracy, Art. 6(1)(f) GDPR.

These checks are automatic. A key that is disabled, expired or used on more servers than its license allows is refused. No profiling takes place. If you think a check was refused wrongly, write to us and a person will look at it.

Our Discord server

If you link your accounts, our bot can give you the buyer roles that match your BuiltByBit purchases, and lets you claim or list your licenses with commands. For this we store your Discord user ID and name, your BuiltByBit member ID, the purchase reference and the roles we gave you.

Legal basis: performance of our contract with you, Art. 6(1)(b) GDPR.

If you post a review in the #reputations channel of our server, we may quote it with your Discord name on our Portfolio page. This rests on our legitimate interest in showing what clients say about us, Art. 6(1)(f) GDPR. Tell us and we remove your review from the website.

Everything else you do on Discord, including the messages you post in our server, is processed by Discord under its own privacy policy.

Email

If you write to us, we process your email address and what you tell us in order to answer. Our mailbox is hosted by Google. We keep the conversation for as long as it takes to deal with your request and for up to 24 months after the last message, in case there is a follow-up.

Legal basis: steps before or under a contract, Art. 6(1)(b) GDPR, or our legitimate interest in answering enquiries, Art. 6(1)(f) GDPR.

Cookies

We use no tracking or advertising cookies, which is why there is no cookie banner. A strictly necessary cookie does not need consent.

Who receives data

We do not sell personal data and do not share it for advertising. It is processed by:

We may also have to give data to a court or public authority when the law requires it.

Outside the EU

Our own servers are in Germany and our license database stays there. Discord, Google and BuiltByBit may process data outside the European Economic Area. They do this under the safeguards the GDPR accepts, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. Their privacy policies say which apply.

How long we keep it

We may keep data longer where we need it to establish, exercise or defend a legal claim, for example in a piracy case.

Your rights

Under the GDPR you can ask us to:

• tell you what data we hold about you and give you a copy;
• correct data that is wrong;
• delete your data;
• restrict what we do with it;
• hand it to you in a machine-readable format;
• stop processing that we base on legitimate interests.

Write to septyishere@gmail.com. We answer within one month and it costs nothing. The page Your GDPR rights explains each right and what we need from you.

You can also complain to a data protection authority: the one in the EU country where you live or work, or ours, the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP). The European Data Protection Board lists every national authority.

Security

The website and the portal are served over HTTPS only. Access to the license database is limited to the people who need it, staff passwords are stored hashed, and the answers of the license server are cryptographically signed so they cannot be forged. No system is perfectly secure. If a breach puts your rights at risk, we will tell the authority and you, as the GDPR requires.

Children

Our products are for people who run Minecraft servers. We do not knowingly collect data from children under 16. If you believe a child has given us personal data, write to us and we will delete it.

Changes

When we change how we handle data, we update this page and the date at the top. We announce important changes on our Discord server.