Data Processing Agreement
Last updated: March 5, 2026
1. Scope and Roles
This Data Processing Agreement ("DPA") governs the processing of personal data by Metabans ("Processor") on behalf of tenant organizations ("Controller") using the Metabans platform.
This DPA is incorporated into and subject to the Terms of Service.
2. Data Categories Processed
| Category | Data Elements | Data Subjects |
|---|---|---|
| Player Identity | Platform IDs (Steam, Xbox, PlayStation, Epic), in-game names, name history | Game server players |
| Connection Data | IP addresses, connection timestamps, session durations | Game server players |
| Game Activity | Chat messages, gameplay statistics (kills, deaths, playtime) | Game server players |
| Moderation Records | Bans, kicks, flags, staff notes, appeal records | Game server players |
| Staff Data | Email addresses, names, activity logs, IP addresses | Tenant staff members |
3. Processing Purposes
The Processor shall only process personal data for the following purposes:
- Providing the game server management platform as described in the Terms of Service
- Cross-tenant player intelligence (anonymized/aggregated reputation scoring)
- Technical operations (backups, security monitoring, error tracking)
- As otherwise instructed by the Controller in writing
4. Data Retention
- Tenant-specific data: Retained for the duration of the Controller's subscription, plus 30 days for data export
- Chat logs: 90 days by default (configurable by Controller)
- Global index data: Ban records retained for 1 year after tenant termination for cross-tenant intelligence integrity
- Backups: Purged within 90 days of data deletion
5. Sub-Processors
| Sub-Processor | Purpose | Location |
|---|---|---|
| Stripe, Inc. | Payment processing | United States |
| Sentry (Functional Software) | Error tracking | United States |
| Twilio SendGrid | Email delivery | United States |
| ProxyCheck.io | IP geolocation and reputation | United Kingdom |
The Processor shall notify the Controller of any new sub-processors at least 30 days before engagement.
6. Security Measures
- Encryption: TLS 1.3 in transit; AES-256 encryption for sensitive fields (RCON passwords)
- Isolation: Database-per-tenant architecture ensuring complete data separation
- Access control: Role-based access, IP allowlisting for admin panel, audit logging
- Infrastructure: Kubernetes cluster with network policies, automated security updates
- Incident response: 72-hour breach notification to Controllers and supervisory authorities
7. Data Subject Rights
The Processor shall assist the Controller in responding to data subject requests (access, rectification, erasure, portability) within reasonable timeframes. The Controller should direct data subjects to contact the Processor at [email protected] if the Controller's own channels are insufficient.
8. International Transfers
Data is processed in the United States. For EEA/UK data, appropriate safeguards (Standard Contractual Clauses) are in place.
9. Termination
Upon termination of the Controller's account, the Processor shall:
- Make data available for export for 30 days
- Delete all Controller-specific data within 30 days of the export period
- Provide written confirmation of deletion upon request
10. Contact
Data protection inquiries: [email protected]