PRIVACY POLICY

Last updated: March 2026

This Privacy Policy explains how Kreyzon Hosting ("we", "Operator") collects, uses, and protects your personal data in compliance with the General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679.

1. Data Controller

The data controller is the individual operating Kreyzon Hosting. This is a personal, non-commercial project. For data-related requests, contact us via the email associated with the platform.

2. Data We Collect

Data	Why We Collect It	Legal Basis
Username	To identify your account and name your server on the game panel	Contract performance (Art. 6(1)(b) GDPR)
Email address	Account registration, email verification, password reset, OTP codes	Contract performance (Art. 6(1)(b) GDPR)
Password (hashed)	Authentication. Stored as a BCrypt hash — never in plain text.	Contract performance (Art. 6(1)(b) GDPR)
Server configuration	To provision and manage your Minecraft server	Contract performance (Art. 6(1)(b) GDPR)
IP address (if blocked)	Rate limiting and security. Only stored if an IP is flagged for abuse.	Legitimate interest (Art. 6(1)(f) GDPR)

We do not collect payment information. We do not use cookies for tracking or advertising.

3. How We Use Your Data

• To provide, operate, and maintain the Service
• To send transactional emails (verification codes, password resets)
• To detect and prevent abuse, fraud, or security incidents

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Third-Party Services

Your username, email, and a copy of your password (transmitted securely at login) are shared with Pterodactyl Panel — the game server management software running on our infrastructure. This software runs on servers we control and your data does not leave our infrastructure.

Outbound emails are sent via SMTP2GO. Your email address is transmitted to this service solely to deliver transactional emails. See SMTP2GO's Privacy Policy.

5. Data Retention

Your data is retained for as long as your account is active. When you delete your account, all associated personal data (username, email, hashed password, server records) is permanently deleted from our systems. IP abuse logs may be retained for up to 90 days for security purposes.

6. Your Rights Under GDPR

As a data subject in the European Union, you have the right to:

• Access — view your personal data via your profile page
• Rectification — update your username or email via profile settings
• Erasure ("right to be forgotten") — delete your account at any time from your profile page
• Restriction — request we limit processing of your data
• Portability — request a copy of your data in a structured format
• Object — object to processing based on legitimate interests

To exercise any of these rights, contact us via the email associated with the platform. You also have the right to lodge a complaint with your national data protection authority.

7. Security

We take reasonable technical measures to protect your data, including password hashing (BCrypt), HTTPS encryption in transit, rate limiting, and IP-based abuse prevention. However, no system is 100% secure. You use the Service at your own risk.

8. Children

The Service is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, contact us for immediate removal.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of the Service after changes are posted constitutes acceptance of the revised policy.

10. Contact

For any privacy-related requests or questions, contact the Operator via the email address associated with the platform.

---

This policy applies to all users of Kreyzon Hosting regardless of location, with particular attention to users in the European Union.