Privacy policy

Who is responsible for your data

ClanNode is run by the sole trader named below. In this policy, "we" means this business. We are the controller of your personal data, which means we decide why and how it is used.

Legal name

MUREA VLAD-GEORGE PERSOANĂ FIZICĂ AUTORIZATĂ (a Romanian authorised natural person, "PFA", that is, a sole trader)

Trading name

ClanNode

Address and phone

In our legal notice

Trade Register (ONRC) number

F2026004237006

Fiscal code (CUI)

53579699

Privacy contact

support@clannode.com

Website

clannode.com

We have not appointed a data protection officer. For any privacy question or request, email support@clannode.com, call us, or open a support ticket. You can also write to us at our registered office.

If you run a server with us: you are the controller of your players' data, such as player names, player IDs and the IP addresses in your game logs. We process it on your behalf, under our Terms. Please give your players your own privacy notice. If you play on a server hosted by ClanNode: the server owner controls your data, so contact them first. We use player data ourselves only for security, abuse reports and legal obligations, and for those uses this policy applies.

What we collect and why

We collect the data you give us, data created when you use our services, and some technical data your browser or game sends. Here it is, grouped by where it comes from.

Visiting clannode.com

• Request data. Like every website, ours receives your IP address, the page you ask for, the date and time, and your browser type. Our website hosting provider keeps these request logs for up to 1 day, to deliver the website and keep it secure.
• Your choices. If you choose a language or a currency, or close the trial banner, your browser remembers that choice: for 1 year if you allow preference storage in our cookie popup, otherwise only for your visit. See our Cookie policy.
• Connection test. When you open a server configurator, your browser sends a few small test requests to the game server location you are looking at (Poland or France) to measure how fast your connection to it is. This reveals your IP address, as any connection does. They carry no other identifying data, and we do not log them.
• Signing in. You sign in on clannode.com with your ClanNode account (the account you use in the client area). The website then receives your account identifier, name and email address, and keeps them only for your short signed-in session.
• Advertising measurement. We do not use analytics or statistics tools. Only if you allow marketing cookies, the TikTok Pixel loads to measure how our TikTok ads perform. See Advertising measurement with the TikTok Pixel. Likewise, only if you allow marketing cookies, the Google Ads tag loads to measure how our Google ads perform. See Advertising measurement with Google Ads. Our fonts and images are served from our own website.

Your ClanNode account and orders

Your account details, orders, invoices, stored card tokens and support tickets are kept in our billing system, on a server in Amsterdam, the Netherlands.

Payments

Card payments are handled by our payment processor, a regulated payment service provider. You enter your card details on its secure payment form, and the full card number never reaches our systems. We keep only a token that lets us charge the saved card, for example when your free trial ends and at each renewal. We also keep the card brand, the last four digits and the expiry date so you can recognise the card. For each payment, we record the amount, the date and whether it succeeded.

To prevent fraud, the payment processor checks payments automatically and may collect information about the device and browser you use on the payment pages. See Automated decisions.

If you pay with Bitcoin, a Bitcoin payment service shows you the amount to pay and watches for your payment. For each order, we keep the Bitcoin payment address, the transaction ID, the amount in bitcoin, the exchange rate and whether the payment was confirmed. Bitcoin transactions are public on the Bitcoin network. While you pay, your browser connects to the payment service, which sees your IP address. If we refund a Bitcoin payment, we also keep the account holder's name and the IBAN you give us for the transfer.

The game panel and your servers

• Panel account. When you order, we create your game panel account from your ClanNode account, with your name, email address and a username. You sign in to the panel through your ClanNode account.
• Activity logs. The panel records actions on your account and servers, such as sign-ins, file changes, backups and settings changes, together with the IP address used. This lets you and us see what happened and look into problems or misuse.
• Server content. Everything on your server: files, worlds, configuration, console output, logs and the backups you create. We store it to run your server.
• Location. Our game servers are in a data centre in Warsaw, Poland, or in France, depending on the location you choose. The game panel is in Warsaw. Backups of servers in Poland are in Warsaw; backups of servers in France are also kept in Warsaw.

Subusers and players

• Subusers. You can give other people access to your server in the game panel. To do this, you give us their email address and name. We use them to invite the person and to give them their own panel access. Their panel data is then covered by this policy. Please tell them before you add them, and point them to this policy.
• Your players. When people join your server, the server and its logs process their data, such as player names, player IDs, chat messages and IP addresses. We process this data on your behalf. We use it ourselves only to keep our systems secure, to handle reports of illegal content or abuse, and to meet a legal obligation, such as a lawful request from an authority. See Who is responsible for your data.
• Player lookups. The game panel shows who is online on your server. When you add players to an allow list, the panel may check their player names with the game publisher's official service.
• Public server lists. Depending on the game and your settings, the server name and description you set, together with your server's address, may appear in the game publisher's public server lists.

Support and communications

• Support requests. When you contact us by ticket, email, the contact form on our website or phone, we keep your contact details, what you tell us and any files you attach, so we can help you and keep a record of what was agreed.
• Spam check on the contact form. The form on our website sends your message only if you tick the box that allows a spam check. Our spam protection provider then receives your IP address and information about your browser, your device and how you use the page, may set its own cookies, and tells us how likely it is that a person sent the message. We use that result only to decide whether to deliver the message, and we do not keep it. If you do not want the check, email us instead.
• Emails we send. We send emails about your account and services, such as order confirmations, invoices, messages when your server is set up and, for quarterly and annual plans, a reminder before the plan renews. Our email delivery provider records whether each message was delivered. Emails can get lost, so please also check your client area.
• Marketing. We do not send marketing emails unless you have agreed to receive them. You can withdraw your agreement at any time.
• Service review invitations. After your first hosting payment following a free trial, we may ask for an honest review through an independent review platform. We share only your name, email address and an order reference so it can send an invitation about a week later. We do this to understand and improve our service, based on our legitimate interests. We do not select customers by their opinion. You can object by contacting us or use the unsubscribe link in the invitation. The platform may retain invitation data for up to 3 years under its data processing agreement.
• Reports and complaints. If you report illegal content or abuse, or make a complaint, we keep your report, the contact details you give and what we did about it. If we act on your report, the statement of reasons we send to the customer concerned says that a report was made. We share your identity with them only where this is strictly necessary, or where the law requires it. See how to report illegal content.

Publisher tokens

Some games need a token from the game publisher to run a server, for example a Steam game server login token or a Klei cluster token. If you enter one when you order, we store it in our billing system and in your server's settings, and use it only to run your server. A token is linked to your account with the publisher, so keep it private. We delete it with the service or your account.

Game addresses

If your plan includes or offers one, you can choose an optional game address under play.clannode.com so players can find your server. It is published in public DNS together with your server's IP address and port, so anyone can look it up. Do not use a name that reveals personal details you want to keep private. We release the address when your service ends or when your plan no longer includes it.

Creator program

• Creators. If you take part in our creator program, we keep your code, the orders that used it, your commission and payouts, and the payment and tax details you give us for payouts.
• Customers who use a code. When you enter a creator's code at checkout, we record your order as that creator's referral. The creator sees the date, the plan, the amount paid, the commission and the status of each referral in their client area, but not your name, your contact details or your server's address. We do not use referral links or cookies for this.

Advertising measurement with the TikTok Pixel

We advertise on TikTok. To find out whether our ads bring visitors and customers, we use the TikTok Pixel, a measurement tool provided by TikTok, on clannode.com and on shop.clannode.com. It is off by default and loads only if you allow Marketing in our cookie popup. One choice covers both sites. Without your consent, nothing from TikTok loads. We do not use it in the game panel.

With your consent, the pixel sends the following to TikTok:

• What you do on our sites: the pages you view, including which game and plan pages you look at, and when you add a plan to the cart, start checkout and place an order, and whether the order was paid, with the order value and currency.
• Identifiers and technical data: a pseudonymous identifier for your browser, stored in TikTok's cookies, your IP address, your browser's user agent and, if you reached us through a TikTok ad, the click ID that TikTok adds to the ad link.
• Not sent: your name, email address, phone number, postal address and payment details.

Payments made later. If your payment happens after you leave our site, for example when a free trial ends, our shop sends the same payment information to TikTok from our server, using the identifiers stored when you ordered. We do this only for orders placed with your consent to marketing.

Who is responsible. For users in the EEA, TikTok means TikTok Technology Limited (Ireland) and TikTok Information Technologies UK Limited. We and TikTok are joint controllers for collecting this data with the pixel on our sites and sending it to TikTok. TikTok is responsible for its further processing, which is described in TikTok's privacy policy. From TikTok we receive only reports on how our ads perform, not data about you as an individual. You can use your rights with us or with TikTok, and we pass on to TikTok requests that concern its processing.

Legal basis. Your consent (Article 6(1)(a) GDPR). Storing TikTok's cookies on your device and reading them also requires your consent under Article 5(3) of the ePrivacy Directive and Article 4(5) of Romanian Law no. 506/2004. Our Cookie policy lists the cookies and how long they last.

Withdrawing consent. You can withdraw your consent at any time, as easily as you gave it, with Cookie settings at the bottom of every page on clannode.com or on our Cookie policy page. The pixel then stops, and we delete TikTok's cookies on our sites at the latest when you open the next page on clannode.com or shop.clannode.com. Withdrawing does not affect processing that took place before.

Advertising measurement with Google Ads

We also advertise on Google. To find out whether our Google ads bring visitors and customers, we use the Google Ads tag, a measurement tool provided by Google, on clannode.com and on shop.clannode.com. Like the TikTok Pixel, it is off by default and loads only if you allow Marketing in our cookie popup, and one choice covers both sites. Without your consent, nothing from Google Ads loads. We do not use it in the game panel.

With your consent, the tag sends the following to Google:

• What you do on our sites: the pages you view and, when you place an order on shop.clannode.com, the order value, the currency and the order number.
• Identifiers and technical data: the pseudonymous identifiers stored in Google's cookies, your IP address, information about your browser and device and, if you reached us through a Google ad, the click identifier (gclid) that Google adds to the ad link.
• Not sent: your name, email address, phone number, postal address and payment details.

Who is responsible. For users in the EEA, Google means Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We and Google are joint controllers for collecting this data with the tag on our sites and sending it to Google. Google is responsible for its further processing, which it carries out as an independent controller and describes in Google's privacy policy and in Google's privacy information for businesses. From Google we receive only reports on how our ads perform, not data about you as an individual. You can use your rights with us or with Google, and we pass on to Google requests that concern its processing.

Legal basis. Your consent (Article 6(1)(a) GDPR). Storing Google's cookies on your device and reading them also requires your consent under Article 5(3) of the ePrivacy Directive and Article 4(5) of Romanian Law no. 506/2004. Our Cookie policy lists the cookies and how long they last.

Transfers outside the EEA. Google may transfer this data to Google LLC in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, and Google also relies on the European Commission's standard contractual clauses. See Transfers outside the EEA.

Withdrawing consent. You can withdraw your consent at any time, as easily as you gave it, with Cookie settings at the bottom of every page on clannode.com or on our Cookie policy page. The tag then stops, and we delete Google's cookies on our sites at the latest when you open the next page on clannode.com or shop.clannode.com. Withdrawing does not affect processing that took place before.

Our legal reasons for using your data

Data protection law lets us use personal data only when we have a legal basis. The table shows the basis for each thing we do.

What you must give us

To create an account and order, you must give us your name, email address, postal address and country, and a payment card when the order needs one. We need these details to provide the service and to issue the invoices the law requires. Some games also need a publisher token or your acceptance of the publisher's licence terms. The forms show which fields are required. If you do not give us this information, we cannot create your account, accept your order or set up that server. Your company name and VAT number are optional.

Who we share your data with

We do not sell your personal data. We share it only with the service providers we need to run ClanNode, with TikTok and Google if you allow marketing cookies, with others when the law requires it, and with people you choose. Our service providers process data on our behalf, only to provide their service to us, unless we say otherwise below.

The payment processor also uses some payment data for its own purposes, such as preventing fraud and meeting its own legal obligations. For those purposes it is a separate controller, and its own privacy notice applies.

Game publishers and other third-party services

• Game publishers' services. Your server connects to the game publisher's services when the game needs them, for example to check a publisher token, verify players or appear in public server lists. The publisher then receives data such as your server's address, name and token, and handles your players' data under its own terms.
• Server status service. On some games, the game panel asks a server status service in the United Kingdom who is online. Your browser sends it your server's address, and the service sees your IP address.
• Player avatar and profile services. To show player pictures and look up player IDs, your browser sends Minecraft player names or IDs to a player avatar service and a player profile service, which see your IP address.
• Icon library. The game panel loads icons from a public content delivery network, which sees your IP address.
• Log sharing. A log sharing service receives a server log only when you choose to share it from the panel. Logs can contain player names and IP addresses, so check a log before you share it.
• Mod and plugin repositories. When you install mods, plugins or modpacks through the panel, our servers download them from third-party repositories. We do not send your account details to them.

Others

• Accountants and advisers. We share data with our accountant or a lawyer when we need them for our accounts, taxes or legal matters. They must keep your data confidential.
• Authorities and courts. We share data with tax authorities, the police, courts or a data protection authority when the law requires it, or to report suspected crimes that threaten someone's life or safety.
• People you choose. The subusers you add to your server can see and manage it in the game panel. Game addresses and public server listings can be seen by anyone.

If you want to know the name of a specific provider, ask us at support@clannode.com.

Transfers outside the EEA

Most of your data stays in the European Economic Area (EEA). Our game servers and their backups are in Poland or France, our game panel is in Poland, our billing system is in the Netherlands, and our email delivery provider is in the EU.

Some data leaves the EEA:

• United States. Our website hosting and content delivery provider, our DNS and network security provider, our spam protection provider and the payment processor's group companies are based in the United States. We rely on the EU-U.S. Data Privacy Framework where a provider is certified under it. The Framework is under legal review and could change, so we also rely on the European Commission's standard contractual clauses.
• United Kingdom. The server status service used by the game panel is in the United Kingdom. The European Commission has decided that the United Kingdom protects personal data adequately.
• Singapore. Our Bitcoin payment service is based in Singapore, which has no EU adequacy decision. When you pay with Bitcoin, your browser connects to it directly, and it receives your IP address and the payment address of your order. The service states that it relies on the European Commission's standard contractual clauses for such transfers. Where they do not apply, the transfer takes place because it is needed for the Bitcoin payment you chose.
• Review invitations. The independent review platform may process invitation data in the United Kingdom, United States and Australia. Its data processing agreement requires appropriate safeguards for transfers outside the EEA, such as an adequacy decision or the European Commission's standard contractual clauses.
• TikTok. If you allow marketing cookies, the data the TikTok Pixel collects goes to TikTok in Ireland and the United Kingdom. The European Commission has decided that the United Kingdom protects personal data adequately. TikTok states that it may also transfer data to companies in its group and to other partners in countries outside the EEA, and that it relies on the European Commission's standard contractual clauses where those countries have no adequacy decision.
• Google. If you allow marketing cookies, the data the Google Ads tag collects goes to Google Ireland Limited and may be transferred to Google LLC in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, and Google also relies on the European Commission's standard contractual clauses.
• Icon library. The public content delivery network that delivers the game panel's icons is run by a provider based in the United States. We rely on the EU-U.S. Data Privacy Framework where that provider is certified under it.
• Player avatar and profile services. These services may be located outside the EEA. Your browser connects to them directly when the game panel shows Minecraft players, and they receive your IP address and the player names or IDs shown. Where no adequacy decision or other safeguard applies, the transfer takes place because it is needed to show you the player information you asked the game panel for.
• Game publishers' services may be located outside the EEA. Your server connects to them because the game you ordered needs them to run. Where the country has no adequacy decision and the publisher is not certified under the EU-U.S. Data Privacy Framework, we rely on the transfer being necessary to provide the server you ordered.

To get a copy of the safeguards we rely on, contact us at support@clannode.com.

How long we keep your data

When we delete data from our live systems, copies can remain in our encrypted system backups for up to 90 days.

Where the table gives no fixed period, we keep data only as long as we need it for the purpose we collected it for. If we need records to establish or defend a legal claim, or to handle a report or an appeal, we keep them until the matter is closed or a claim can no longer be brought. The payment processor keeps its own payment records for as long as the law requires it to.

Your rights

Your right to object: you can object at any time, for reasons relating to your situation, to any use of your data based on our legitimate interests. We then stop, unless we have compelling legitimate reasons that override your interests, rights and freedoms, or we need the data to establish, exercise or defend a legal claim. You can always object to marketing, and we will stop.

You have these rights over your personal data:

• Access. You can ask for a copy of the data we hold about you and how we use it.
• Rectification. You can ask us to correct data that is wrong or incomplete. You can update most account details yourself in the client area.
• Erasure. You can ask us to delete your data. We will delete it unless we must keep it, for example invoices the law requires us to keep or records we need for a legal claim.
• Restriction. You can ask us to limit how we use your data, for example while we check a correction you asked for.
• Objection. You can object to any use based on our legitimate interests, as explained above.
• Portability. You can receive the data you gave us in a common, machine-readable format, or ask us to send it to another provider where this is technically possible. You can also download your server files yourself through the game panel, SFTP and backup downloads.
• Withdraw consent. Where we rely on your consent, such as for keeping your language, currency and banner choices for 1 year or for the TikTok Pixel and the Google Ads tag, you can withdraw it at any time, as easily as you gave it. For cookies, use Cookie settings at the bottom of any page on clannode.com. This does not affect what we did before you withdrew it.

How to use your rights

Email support@clannode.com, open a support ticket or write to us at our registered office, and tell us which right you want to use. It is free. If a request is clearly unfounded or excessive, for example because it keeps being repeated, we may charge a reasonable fee or refuse it, and we will explain why.

We reply without undue delay and within one month. If a request is complex or you send many requests, we can extend this by up to two more months. If we do, we tell you within the first month and explain why.

To protect your data, we first check that the request really comes from you. We may ask you to write from the email address on your account, to sign in to the client area or to confirm details only you would know. We ask only for what we need for this check.

If your request is about data on a game server hosted by ClanNode, such as your data as a player, the server owner controls that data. We forward your request to them.

Complaints

If you think we have not handled your data properly, please tell us first so we can try to put it right. You also have the right to complain to a data protection authority. The authority in Romania, where we are established, is:

Authority

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Address

B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 București, Romania

Website

www.dataprotection.ro

Email

anspdcp@dataprotection.ro

You can also complain to the data protection authority in the EU country where you live or work, or where you think the problem happened. You can find it on the European Data Protection Board website.

Automated decisions

Our payment processor screens payments automatically to detect fraud. Based on signals such as the card, the payment details and the device used, this screening can decline a payment without a person looking at it. We use this automatic screening because it is necessary to enter into and carry out our contract with you safely.

If a payment is declined and you think this is wrong, contact us. A person at ClanNode will review what happened, you can give us your point of view, and you can contest the decision.

Our billing system applies the non-payment rules in our Terms automatically: it can suspend a server when a charge fails and terminate the service if the amount stays unpaid, which deletes the server and its files. It also refuses a new order when your account has reached its server limit. We need these steps to perform our contract with you. If you think one of them was wrong, contact us: a person at ClanNode will review it, you can give us your point of view, and you can contest the decision.

We make no other decisions about you by automated means alone that have a legal or similarly significant effect on you. We do not profile you for marketing ourselves. If you allow marketing cookies, TikTok may use the data it receives through the TikTok Pixel as described in its privacy policy, for example to measure and personalise ads. Google may do the same with the data it receives through the Google Ads tag.

Cookies and similar storage

We use cookies and similar storage to run the website, the client area and checkout, to remember choices you make and, only if you allow it, to measure our TikTok and Google ads. We do not use analytics or statistics cookies.

• Strictly necessary storage, such as the sign-in, session, checkout and security cookies, is always on, because our services cannot work without it. The law does not require consent for it.
• Preference storage on clannode.com keeps your language, currency and trial banner choices. It lasts 1 year if you allow it in our cookie popup, otherwise only for your visit.
• Marketing storage is off unless you allow it in our cookie popup. With your consent, the TikTok Pixel and its cookies are used on clannode.com and shop.clannode.com. See Advertising measurement with the TikTok Pixel. The Google Ads tag and its cookies are used in the same way. See Advertising measurement with Google Ads.
• The spam check on our contact form runs only if you tick its box when you send a message. Only then does our spam protection provider load in your browser and set its own cookies.
• You can change your choice at any time with Cookie settings at the bottom of every page on clannode.com. Your choice applies to clannode.com and shop.clannode.com.

Our Cookie policy lists every cookie and similar storage we use on clannode.com, shop.clannode.com and panel.clannode.com, what each one does and how long it lasts, and explains the rules we follow.

How we protect your data

• Connections to our website, client area and game panel are encrypted, and file transfers to your server use SFTP, which is also encrypted.
• Passwords are stored only as secure hashes. Full card numbers are handled by our payment processor and never stored by us.
• The system backups we make of our databases and systems are encrypted.
• Access to our admin systems is limited to the people who run ClanNode and protected with two-factor authentication.

No system is perfectly secure, so we cannot promise that your data will never be accessed without permission. You can help by using a strong, unique password and by turning on two-factor authentication in the game panel.

If a data breach puts personal data at risk, we report it to the data protection authority as the law requires, where possible within 72 hours of learning about it. If the breach is likely to put your rights and freedoms at high risk, we also tell you without undue delay.

Children

You must be at least 18 to create a ClanNode account. We do not knowingly accept account holders under 18. If we learn that an account holder is under 18, we may close the account and delete their data, except what the law requires us to keep.

Players who join a server can be any age. If you run a server, your community is your responsibility. As the controller of your players' data, you must follow the rules that protect children's data where they apply.

Changes to this policy

We update this policy when our services, our providers or the law change. When we do, we change the "Last updated" date at the top of this page. If a change is significant, we also tell you by email and in the client area. Previous versions are available on request.