Data Privacy Policy

Data Privacy Policy

Last updated: 5th of August 2026

Borna Smital (sole proprietorship)
operating as ManasMods
Lütticher Straße 155, 52074 Aachen, Germany
Email: contact@manasmods.com

This privacy policy explains how personal data is processed in connection with this website and related services (Tebex, Patreon, Discord, YouTube, Twitch).

This website is used exclusively for the presentation of ManasMods.
Personal data processed in connection with payments, purchases, or communication are handled through external, GDPR-compliant third-party providers. Personal data processed in connection with our Minecraft servers, in particular the data described in sections 4.4, 4.7, and 4.9, are processed on our own server infrastructure. .

Tebex Ltd.
All purchases, donations, and payments related to our Minecraft servers are processed through Tebex Ltd.
ManasMods does not process payment data directly.
Legal basis: Contract performance in accordance with Art. 6(1)(b) GDPR
Data transfers: governed by Standard Contractual Clauses (SCCs)
Data processed: name, email address, IP address, in-game username, transaction amount

Patreon Inc.
Memberships and support payments are handled through Patreon Inc.
Patreon acts as an independent data controller under the GDPR.
Legal basis: Contract performance in accordance with Art. 6(1)(b) GDPR
Agreement: Patreon Creator Privacy Promise (DPA)
Data processed: username, email address, membership tier, shipping address (if applicable)

PayPal Europe S.à r.l.
Payments to contractors are processed via PayPal, which acts as an independent data controller under the GDPR.
Data processing is carried out in accordance with PayPal’s privacy policy.

Discord, YouTube & Twitch
Community interactions and communication occur via these platforms.
They act as independent controllers and process data according to their own privacy policies:

• Discord Privacy Policy
   
• YouTube Privacy Policy
   
• Twitch Privacy Policy
   

This website uses only technically necessary cookies that are required for proper operation and functionality.
These include, for example:

• Session cookies to maintain navigation and security
   
• Cookies for storing language or display preferences
   
• Security cookies for protection against misuse (e.g. CSRF protection)
   

These cookies do not contain personal data that allow direct identification and are automatically deleted when the browser is closed.
Legal basis: Art. 6(1)(f) GDPR in conjunction with § 25(2) TDDDG (legitimate interest in secure and functional operation of the website)
Purpose: ensuring technical functionality, stability, and system security
Retention period: only for the duration of the session

When visiting this website, certain technical information is automatically stored in so-called server log files.
The following data may be collected:

• IP address
   
• Date and time of access
   
• Accessed pages or files
   
• Browser type and version
   
• Operating system used
   
• Referrer URL (previously visited page)
   

This information is used exclusively for technical monitoring, security, and troubleshooting.
No combination with other data or profiling takes place.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in system security and fault prevention)
Retention period: Log files are automatically deleted after a short period (usually under 90 days).

 No analytics, audience-measurement, or marketing cookies are used. Third-party tools for user analytics or advertising, such as Google Analytics or Meta Pixel, are not implemented. No profiling for advertising or analytics purposes takes place. This does not affect the use of Google reCAPTCHA described in section 4.6, which serves solely to protect the contact form against automated abuse. 

When connecting to our Minecraft servers, certain data are automatically processed for technical operation, security, and moderation purposes.
The following data may be collected:

• Minecraft username and UUID
   
• IP address and connection timestamps
   
• Chat messages and in-game interactions (for moderation and anti-cheat purposes)
   
• Playtime, statistics, inventory data, and progression
   

Purpose: ensuring server functionality, preventing abuse, maintaining fairness, and enforcing community rules.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a secure and fair multiplayer network).
Retention period: technical log data are automatically deleted or anonymized after a maximum of 90 days.  By way of exception, the longer retention periods stated in section 4.7 apply to the alt-account detection system (ManasIP) described there.
Disciplinary records (e.g., suspensions or bans) may be retained longer if necessary for the investigation of abuse cases.
Recipients: server hosting partners LilyPad (United Kingdom) and Hetzner (Germany) under Standard Contractual Clauses pursuant to Art. 46 GDPR.

If you contact us via the contact form provided on this website, the data you enter will be processed.

This includes in particular:

• Name 
• Email address 
• Message content 
• Any files submitted (attachments) 

The data is processed solely for the purpose of handling your request and any necessary follow-up communication.

Legal basis:
Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries)

The data will not be shared with third parties unless this is necessary to process your request.

Storage:
The data is stored either on the server of this website or within the associated email system.

Retention period:
The data will be deleted once your request has been fully processed, unless legal retention obligations apply.

To protect the contact form (4.5) against automated submissions and spam, we use Google reCAPTCHA. For users in the European Economic Area, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Data processed: reCAPTCHA evaluates various technical and behavioural signals in order to distinguish automated access from human users. These may include: IP address, browser, device and operating system information, screen resolution, time spent on the page, and mouse, keyboard, and touch movements. Cookies or comparable technologies may be set on or read from your device in this process.

Purpose: protection against abuse, automated requests, and spam.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting our systems against abusive automated use).

International transfers: Data may be transferred to Google LLC in the United States. Such transfers take place on the basis of Standard Contractual Clauses pursuant to Art. 46 GDPR.

Further information is available in Google's privacy policy at https://policies.google.com/privacy.

To detect multiple accounts ("alt accounts"), circumvention of bans ("ban evasion"), and other forms of abuse, we operate a purpose-built, purely server-side tool named ManasIP on our Minecraft servers. ManasIP is not installed on player clients; players are not required to download or install anything.

Data processed: When connecting to the server, the following is stored:

• Minecraft username
• Minecraft UUID
• current and previously used IP addresses
• timestamp of the first and the most recently recorded login

Purpose: exclusively server security, alt-account checks, and investigation of ban evasion. The data is not used for advertising, analytics, or profiling.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a secure, fair, and rule-compliant multiplayer network).

Storage: The data is stored locally on the respective server and is not shared with third parties. The only infrastructure recipients are the hosting partners named in section 4.4.

Access restrictions and permission tiers:
Access is tiered and limited to the minimum required in each case:

• Viewing stored IP addresses: only individuals with access to server files (currently approximately eight people).
• Comparison function (manasip.compare): authorised moderators and administrators (currently approximately ten people) can check two players against each other. No IP address is displayed - only whether a match exists.
• Single lookup (manasip.check): displays a player's most recently stored IP address. This requires a separate, more narrowly granted permission.

Regular players and unauthorised team members have no access.

Logging of every query: Every use of the comparison or lookup function requires a mandatory reason to be entered. Every successful query is logged. The log records the timestamp, the team member performing the action, the type of action, the affected players, the result, and the stated reason. The IP address itself is not written to the log.

Retention:

• Player records are deleted once the last login is more than six months in the past.
• The query log is retained for 6 months and deleted thereafter.

Your rights: The rights listed in section 8 apply, in particular the right of access (Art. 15 GDPR), erasure (Art. 17 GDPR), and the right to object under Art. 21 GDPR, as this processing rests on legitimate interest. Please direct requests to privacy@manasmods.com or via the main discord server's support tickets.

Data submitted through the contact form is typically forwarded to and processed within an email inbox.

For this purpose, Microsoft (e.g. Microsoft 365 / Outlook) is used as a data processor.

Processing is carried out solely on our behalf and on the basis of a data processing agreement in accordance with Art. 28 GDPR.

Data may also be processed in third countries (e.g. the United States). In such cases, data transfers are based on Standard Contractual Clauses pursuant to Art. 46 GDPR.

ManasCosmetics is a cosmetic content system used on Minecraft servers. How cosmetic data are handled depends on how and where the software is run:

On our own Minecraft servers: When you use cosmetic features on servers operated by ManasMods, the following data are processed for functionality:

• Minecraft UUID (to associate cosmetics with your account)
• Equipped cosmetic items and active cosmetic slots
• Saved cosmetic presets and loadout configurations
• Cosmetic entitlement records (which cosmetics you have unlocked or purchased)

Purpose: providing, rendering, and synchronizing cosmetic content; saving cosmetic configurations; and verifying entitlement to purchased or restricted items.

Legal basis: Art. 6(1)(f) GDPR for freely available cosmetic functionality, and Art. 6(1)(b) GDPR for content linked to a purchase.

Storage: Cosmetic data on our servers are stored locally within the respective server instance. These data are not transmitted to ManasMods as a separate recipient and are not centrally collected, aggregated, or used for any purpose beyond operating the cosmetic features on that server.

Important: software used on third-party servers. Where the ManasCosmetics software is installed and operated by independent third parties on their own Minecraft servers, those server operators determine independently how cosmetic data are stored and processed (for example, locally or in a database of their own choosing). In those cases, the respective server operator is the data controller for any such processing. ManasMods does not receive, collect, or have access to cosmetic data from third-party servers and is not responsible for the data processing carried out by independent operators.

Retention period: On our servers, cosmetic configuration and entitlement data are retained while your account remains active on our network. Purchase-linked records required for accounting are retained per the statutory periods in Section 9.

This website is operated on GoDaddy infrastructure and built using the GoDaddy Website Builder. GoDaddy provides the web space, page delivery, the technically necessary cookies described in 4.1, and the server log files described in 4.2, and acts as a data processor on our behalf in this respect.

Data processed: in particular IP address, time of access, pages accessed, browser type and version, operating system, referrer URL, and the information submitted through the contact form (4.5), which initially passes through GoDaddy's systems before being forwarded to our email inbox (4.8).

Purpose: technical operation, delivery, and security of the website.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a stable and secure web presence).

Basis of processing: data processing agreement pursuant to Art. 28 GDPR (GoDaddy Data Processing Addendum).

International transfers: As GoDaddy.com, LLC is established in the United States, personal data is transferred to a third country. GoDaddy.com, LLC is certified under the EU-U.S. Data Privacy Framework. Transfers therefore take place on the basis of the European Commission's adequacy decision pursuant to Art. 45 GDPR. Where a transfer does not take place under the Data Privacy Framework in an individual case, GoDaddy additionally relies on Standard Contractual Clauses pursuant to Art. 46 GDPR.

Processor: GoDaddy.com, LLC, 100 S. Mill Ave, Suite 1600, Tempe, AZ 85281, USA
legal@godaddy.com

Personal data such as name, Discord tag, PayPal address, and billing information are processed for the administration of staff and contracted work.
Legal basis: contract performance (Art. 6(1)(b) GDPR) and legal recordkeeping obligations (Art. 6(1)(c) GDPR)
Storage: data are stored in Google Drive (Ireland) with encryption and two-factor authentication.
Retention: 10 years in accordance with § 147 AO and § 257 HGB.

Services such as Patreon, PayPal, and Discord may process data outside the EU (e.g., in the United States or the United Kingdom).
These transfers are carried out only under recognized safeguards, particularly Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR.

All accounts (Google, Patreon, Tebex, Discord) are protected by two-factor authentication (2FA).
Access to personal data is restricted to Borna Smital  and a narrowly limited group of expressly authorised team members, who are granted access rights only to the extent required and only for their specific area of responsibility. Access to particularly sensitive data, in particular IP addresses within the alt-account detection described in section 4.7, is logged.
Data are only shared with third parties on a valid legal basis.
This website uses SSL/TLS encryption for secure data transmission.

Under the GDPR, you have the following rights:

• Access to your stored data (Art. 15)
   
• Rectification of incorrect data (Art. 16)
   
• Erasure (“right to be forgotten”, Art. 17)
   
• Restriction of processing (Art. 18)
   
• Data portability (Art. 20)
   
• Objection to processing (Art. 21)

•  Withdrawal of consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal (Art. 7(3))
   

You also have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates data protection law (Art. 77 GDPR).

Supervisory Authority:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
P.O. Box 20 04 44
40102 Düsseldorf
Website: https://www.ldi.nrw.de

To exercise your rights, please contact: privacy@manasmods.com

Business and payment records are retained in accordance with legal requirements for up to 10 years and are then deleted or anonymized.

This privacy policy may be updated in response to legal, organizational, or technical changes.
The most current version is always available on this website.

Last updated: 5th of August 2026