Privacy Policy

1. Overview

This Privacy Policy describes how Metabans ("we", "us") collects, uses, and protects personal data when you use our game server management platform at metabans.com.

We are committed to protecting the privacy of our users and the game server players whose data passes through our platform.

2. Data Controller and Processor Roles

Metabans as Data Controller: For account registration data, billing information, and cross-tenant aggregated data (global reputation scores, public banlist).

Metabans as Data Processor: For player data collected by tenant organizations through their game servers (player IDs, IP addresses, chat logs, play statistics).

Tenant Organizations as Data Controllers: Each tenant is responsible for their own players' data and must ensure they have appropriate legal basis for processing.

3. Data We Collect

Account Data

• Email address and name (registration)
• Organization/team name
• Payment information (processed by Stripe — we do not store card numbers)
• IP address and session data

Game Server Data (processed on behalf of tenants)

• Player identifiers: Platform IDs (Steam, Xbox, PlayStation, Epic), in-game names
• Connection data: IP addresses, connection times, session durations
• Game activity: Chat messages, kill/death statistics, playtime
• Moderation records: Bans, flags, staff notes, audit logs

Cross-Tenant Intelligence Data

• Anonymized/aggregated ban records across all tenants
• Global reputation scores derived from cross-tenant patterns
• Public player profiles (platform ID, name history, ban count)

4. How We Use Data

• Service operation: Providing RCON, monitoring, and player management features
• Cross-server intelligence: Calculating reputation scores, detecting ban evasion
• Public features: Server browser, player lookup, banlist
• Security: IP reputation checks, VPN/proxy detection, abuse prevention
• Communication: Service notifications, billing alerts, summary reports
• Analytics: Aggregate platform statistics (never sold to third parties)

5. Data Sharing

We do not sell personal data. We share data only with:

• Stripe: Payment processing
• Sentry: Error tracking (anonymized)
• SendGrid: Transactional email delivery
• ProxyCheck.io: IP reputation and geolocation
• Law enforcement: When required by valid legal process

6. Data Retention

7. Your Rights (GDPR)

If you are in the European Economic Area (EEA) or UK, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in a machine-readable format
• Restriction: Limit processing of your data
• Objection: Object to processing based on legitimate interests

To exercise these rights, contact [email protected]. We will respond within 30 days.

Note for players: If you are a game server player and wish to exercise your rights regarding data held by a specific server community, please contact that community's administrators directly. They are the data controller for server-specific data.

8. California Privacy Rights (CCPA)

California residents have the right to:

• Know what personal information is collected and how it is used
• Request deletion of personal information
• Opt out of the sale of personal information (we do not sell personal data)
• Non-discrimination for exercising privacy rights

9. International Data Transfers

Our servers are located in the United States. If you are accessing the Service from outside the US, your data will be transferred to and processed in the US. We ensure appropriate safeguards are in place for international transfers.

10. Security

We implement industry-standard security measures including:

• Encryption in transit (TLS) and at rest
• Database-per-tenant isolation
• RCON password encryption
• Role-based access controls
• Audit logging of all administrative actions
• Regular security assessments

11. Cookies

See our Cookie Policy for details on how we use cookies.

12. Children's Privacy

The Service is not directed at children under 13 (or 16 in the EEA). We do not knowingly collect personal data from children. If you believe we have collected data from a child, contact us immediately.

13. Changes to This Policy

We may update this Privacy Policy periodically. We will notify registered users of material changes via email and update the "Last updated" date.

14. Contact

For privacy inquiries: [email protected]