Privacy policy

Last updated: 2026-10-26

This privacy policy explains which personal data Vincent Support (the "support portal") processes when you use it, why we process it, how long we keep it and which rights you have. It is provided in accordance with Art. 13 and 14 of the General Data Protection Regulation (GDPR).

1. Controller
2. General information
3. Hosting and server logs
4. Cookies and local storage
5. Sign in with Discord
6. Sign in with Minecraft and account linking
7. Tickets, messages and attachments
8. Profile
9. Notifications and mentions
10. Ticket ratings
11. AI support through Groq
12. Staff area and statistics
13. Punishments and moderation
14. Audit log
15. Web fonts and avatars
16. Recipients of your data
17. Storage periods
18. Your rights
19. Security
20. Minors
21. Changes to this policy

1. Controller

The controller within the meaning of the GDPR is:

We have not appointed a data protection officer because we are not legally required to do so. For all questions about data protection, please contact us at the e-mail address above or open a "General Support" ticket.

2. General information

We only process personal data where this is necessary to provide the support portal, to handle your request, to protect the Minecraft server and its community from abuse, or where you have given your consent. We do not use your data for advertising, we do not sell it, we do not use tracking or analytics services, and we do not make automated decisions with legal effect on you (Art. 22 GDPR).

The legal bases we rely on are Art. 6 (1) (b) GDPR (performance of a contract or steps before entering into one: running your account and handling your tickets), Art. 6 (1) (f) GDPR (our legitimate interests: security, abuse prevention, moderation of the community, and improving the quality of support) and, where we ask for it, Art. 6 (1) (a) GDPR (consent).

3. Hosting and server logs

The support portal is hosted by skrime.eu. The hosting provider processes data on our behalf under a data processing agreement pursuant to Art. 28 GDPR.

Every time you access the portal, the web server automatically records the following data in access logs: your IP address, date and time of the request, the page requested, the HTTP status, the amount of data transferred, the referring page and the browser and operating system you use (user agent).

This data is needed to deliver the website to your device, to keep the service stable and secure, and to investigate attacks or misuse. Legal basis: Art. 6 (1) (f) GDPR. Server logs are deleted after -1 days unless they have to be kept longer as evidence of a specific security incident.

4. Cookies and local storage

The portal sets a single cookie, the session cookie (vtickets). It contains a random session identifier and nothing else. It is needed to keep you signed in, to carry status messages between pages and to protect forms against cross-site request forgery (CSRF). The cookie is marked HttpOnly and expires after 4 hours of inactivity or when you sign out.

In addition, your browser's local storage keeps two preferences: the colour theme (light or dark) and whether the notification sound is enabled. These values never leave your browser.

Both are strictly necessary for the service you have requested, so no consent is required (§ 25 (2) no. 2 TDDDG; Art. 6 (1) (f) GDPR). We do not use any cookies for tracking, advertising or analytics, which is why the portal shows no cookie banner.

5. Sign in with Discord

You sign in using your Discord account (OAuth2). When you do so, you are redirected to Discord, where you authorise the portal to read the following information from your Discord account (scopes identify, email and guilds.members.read):

• your Discord user ID, username, display name and avatar,
• the e-mail address registered with your Discord account,
• whether you are a member of our Discord server and which roles you hold there.

We store the user ID, username, display name, avatar identifier and e-mail address in your account. Your avatar image is loaded directly from Discord's content delivery network (cdn.discordapp.com) whenever you are signed in, which transmits your IP address to Discord. Your roles on our Discord server determine whether you are treated as a player, a member of the support team or an administrator. We store the resulting access role and the last confirmed server-booster status, with the times of their checks. We do not store the Discord access token after the sign-in has completed. Staff and the scheduled synchronisation may re-run the role check using our Discord bot.

The provider of Discord is Discord Inc., 444 De Haro Street, Suite 200, San Francisco, CA 94107, USA. Discord itself processes data about the authorisation (for example your IP address); its privacy policy applies: https://discord.com/privacy. Discord Inc. is certified under the EU-US Data Privacy Framework, so the transfer to the USA rests on the adequacy decision of the European Commission (Art. 45 GDPR).

Legal basis: Art. 6 (1) (b) GDPR (providing your account) and, for the role check, Art. 6 (1) (f) GDPR (restricting the staff area to authorised members). To protect the sign-in against automated attacks and spam we count sign-in attempts and newly opened tickets per IP address; these counters are deleted after 24 hours (Art. 6 (1) (f) GDPR).

6. Sign in with Minecraft and account linking

Our game servers receive your verified Minecraft UUID/name, linked Discord ID and confirmed booster status to recognise linked accounts and automatically grant or remove the in-game Booster group. After unlinking or deletion, the website retains the UUID without an account or Discord mapping as a revocation target, so a disconnected game server can remove an old grant when it returns. The last booster check is deleted with your website account; historical game-server records remain separate from that account.

You can also sign in without Discord, by proving that a Minecraft account is yours: the portal shows you a one-time code, you type it in chat on our game server, and the server tells the portal which account typed it. The same mechanism links a Minecraft account to an existing portal account.

For this we store the code, when it was issued, when it expires, your IP address at the time it was issued and - once the code has been used - your Minecraft UUID and the name that account currently goes by. Codes and their IP addresses are deleted a day after they expire; the UUID and name stay on your account for as long as it exists, because they are what the account is recognised by. The IP address is stored to make it possible to investigate abuse of the sign-in (Art. 6 (1) (f) GDPR); everything else rests on Art. 6 (1) (b) GDPR (providing your account).

A verified Minecraft account is shown to the support team on your tickets, marked as verified. That is the point of it: it is what tells staff that the person appealing a ban really is the player who was banned. You can unlink it on your profile page at any time, unless it is the only way you sign in.

7. Tickets, messages and attachments

When you open a ticket, we store the category, subject, the answers you give in the category's form, every message in the conversation, the time of each action and the ticket history (status, priority, assignment and category changes). Depending on the category the form asks for, among other things:

You may attach up to 10 files of 8 MB each (png, jpg, jpeg, gif, webp, pdf, txt, log, json, yml, yaml, zip). Attachments are stored on our server and are only accessible to you and, after you choose staff support or hand over an AI ticket, the support team. Please attach only what is needed and avoid uploading documents with sensitive data (for example ID cards or bank statements).

Virus scanning. Every uploaded file is checked for malware with VirusTotal, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC in the United States. We first send only the SHA-256 checksum of the file, which says nothing about its contents. Only if VirusTotal has never seen that checksum is the file itself transmitted for analysis, where it is scanned by the antivirus engines of the providers taking part and may be retained and made available to VirusTotal's security partners. Please keep this in mind when attaching documents, and do not upload anything more personal than your request needs. A file that is flagged is deleted from our server and can no longer be downloaded by anyone; staff are notified only for tickets already shared with them. Legal basis: Art. 6 (1) (f) GDPR - our and your legitimate interest in not passing malware between players and the support team. The transfer to the United States is covered by the EU standard contractual clauses concluded by Google (Art. 46 (2) (c) GDPR). If you would rather not have a file transmitted, please describe the problem in text or ask the team for another way to send it.

Data about other people. Player reports and some other tickets necessarily contain information about third parties, for example the name of the reported player, the time of an incident and evidence such as screenshots or recordings. We process this data on the basis of Art. 6 (1) (f) GDPR to enforce the server rules and to protect other players. Please only submit information that is relevant to the report.

Purchase-related tickets. For rank or custom title requests we ask for the transaction ID, the payment method and the checkout e-mail so that we can match your request to a purchase. We never ask for and you should never send full card or account numbers.

The support team can add internal notes to a ticket that are not visible to you. These serve the internal coordination of the team (Art. 6 (1) (f) GDPR) and are provided to you on request in line with Art. 15 GDPR as far as they contain your personal data.

Legal basis: Art. 6 (1) (b) GDPR for handling your request; Art. 6 (1) (f) GDPR for moderation, abuse prevention and dispute handling.

8. Profile

On your profile page you can add or change your Minecraft username, which is used to prefill ticket forms and to identify you on the server. Name, avatar and e-mail address come from Discord and are refreshed on every sign-in. No password is stored on this portal. Legal basis: Art. 6 (1) (b) GDPR.

9. Notifications and mentions

The portal keeps an inbox for you that collects replies from the support team and mentions (@name) in tickets you are involved in. Each entry stores who triggered it, the ticket it refers to and whether you have read it. While you are signed in, your browser polls the server periodically to show new notifications without reloading; these requests are covered by the server logs described in section 3. Notifications are automatically deleted 90 days after they are created. Legal basis: Art. 6 (1) (b) GDPR.

10. Ticket ratings

After a ticket has been resolved or closed you may rate it (1 to 5 stars) and leave a comment. The rating is stored with the ticket and is shown to the support team; average ratings appear in the staff leaderboard and analytics. Rating is voluntary. Legal basis: Art. 6 (1) (a) GDPR (consent, given by submitting the rating). You can change your rating as long as the ticket remains finished, and you can ask us to delete it at any time.

11. AI support through Groq

If you choose AI support, we send the ticket subject, category, all submitted form details and a limited public conversation to Groq to generate a response. Older conversation may be summarized by Groq and stored with the ticket to provide context for later replies. Text you type may contain personal information; please avoid secrets or unnecessary personal details. Submitted details include any contact information or purchase identifiers you enter. The latest active Minecraft ban and mute from your linked account, or from the submitted in-game name or profile name when no account is linked, may also be included with their reason, expiry and server scope. Internal notes, attachment files and other account records are not sent automatically. The AI cannot inspect screenshots or linked evidence.

Admins can always see the ticket. It remains hidden from other staff until you choose to hand it over. This shares its conversation, submitted details and attachments with staff and stops further AI responses. You may skip AI when opening a ticket. AI answers are stored in your ticket, included in your data export and deleted with the ticket. The AI does not impose punishments, lift bans or approve purchases/refunds.

Groq is an external recipient. Its processing is described in Groq’s privacy policy. Usage counters here contain only request times and token counts and expire after 24 hours when the queue next runs.

12. Staff area and statistics

Members of the support team can see all tickets, the user list (username, display name, e-mail address, role and access status) and statistics about support performance, such as ticket volumes, response times, ratings and per-member activity. Player data appears in these views only in so far as it is needed to handle tickets. The statistics about staff members themselves serve to organise the team and improve the quality of support; staff members are informed of this when they join the team. Legal basis: Art. 6 (1) (f) GDPR.

Whether a member of the support team is reachable right now is shown to everyone who is signed in: the top bar lists the team as online, away or offline. For this we store, on your account, when the portal last heard from one of your open pages and whether that page was in use at the time. No page views, no ticket contents and no other activity are recorded, each stamp overwrites the previous one, and signing out clears them. Members of the team can switch this off for themselves at any time ("Appear offline" on the profile page), after which they are always shown as offline and their last sighting is not published.

The same two stamps are kept for player accounts, and the support team - and only the support team - can see them: in the same panel, on the ticket they are answering and in the queue and user lists. This is so that staff know whether the person they are writing to is still reading, instead of waiting on an answer that will not come for hours. Players are never shown to each other, the state is dropped a quarter of an hour after your last open page, and you can object to it at any time under section 18. Legal basis: Art. 6 (1) (f) GDPR - our interest in handling support conversations efficiently.

Administrators can block an account from using the portal, for example in the case of abuse. The block is stored with your account. Legal basis: Art. 6 (1) (f) GDPR.

13. Punishments and moderation

Where a ticket is about a punishment - a ban appeal, or a report about another player - the support team can see that player's record from our punishment system (LiteBans) next to the ticket: the bans, mutes, warnings and kicks recorded against their Minecraft UUID, with the reason, the length, who issued each one and whether it is still in force. Staff can also issue or lift a ban or a mute from that panel.

This data is not created by the support portal. It belongs to our game servers and is processed there to enforce the server rules; the portal only reads it, and writes to it when a member of staff takes an action. Legal basis: Art. 6 (1) (f) GDPR - our interest in enforcing the rules of our servers and in handling appeals on the basis of what actually happened rather than what either side remembers.

A punishment issued from a ticket is recorded as an internal note on that ticket and in the audit log described below. The reason a member of staff writes is shown to the punished player in game.

14. Audit log

Actions by staff and administrators that would otherwise leave no trace are recorded in an audit log: blocking or unblocking an account, re-running a role check, creating or editing a ticket category, issuing or lifting a punishment, linking a Minecraft account, and exporting or deleting an account. Each entry holds who acted, what they did, which account or player it concerned, a short description, the IP address and the time.

The log exists so that the use of these powers can be checked afterwards, which is also why it cannot be edited or cleared from within the portal. Entries are visible to administrators only and are deleted automatically after two years. If you delete your account, entries you caused keep their description but no longer name you. Legal basis: Art. 6 (1) (f) GDPR.

15. Web fonts and avatars

The typefaces used on this portal (IBM Plex Sans and IBM Plex Mono) are stored on our own server and delivered from there. No connection to Google Fonts or any other font provider is made. Apart from the Discord avatar described in section 5, and the picture of a player's Minecraft skin, which is fetched from crafthead.net using only the Minecraft UUID and therefore discloses your IP address to that service, the portal embeds no content from third-party servers.

16. Recipients of your data

• Support team. Volunteer members of our Discord server who hold the staff or admin role. They are bound to confidentiality and may only use ticket data to handle tickets and moderate the server.
• Hosting provider (section 3), as a processor under Art. 28 GDPR.
• Discord Inc. (section 5), for authentication and role checks.
• Google Ireland Limited / Google LLC (VirusTotal) (section 7), for the malware check on uploaded files.
• Groq (section 11), for ticket text submitted to AI support.
• Authorities, where we are legally obliged to disclose data, for example on a valid request from law enforcement.

No other third parties receive your data. We do not transfer data to countries outside the EU/EEA except as described in section 5 and section 7.

17. Storage periods

18. Your rights

Under the GDPR you have the following rights with regard to your personal data:

• Access (Art. 15): to know which data we hold about you and receive a copy.
• Rectification (Art. 16): to have inaccurate data corrected. You can change your e-mail address and Minecraft name yourself on the profile page.
• Erasure (Art. 17): to have your data deleted, subject to the retention periods in section 17.
• Restriction (Art. 18): to have processing restricted in certain cases.
• Data portability (Art. 20): to receive the data you provided in a machine-readable format.
• Objection (Art. 21): to object to processing based on our legitimate interests, on grounds relating to your particular situation.
• Withdrawal of consent (Art. 7 (3)): where processing is based on consent, you may withdraw it at any time with effect for the future.

Self-service. On your profile page you can download a complete copy of your data (account, tickets, messages, history and notifications as JSON) and delete your account together with all your tickets at any time, without contacting us.

For everything else, contact us at vincentvanillanetwork@gmail.com or open a ticket. We may ask you to confirm your identity, usually by contacting us from the Discord account concerned. We answer within one month (Art. 12 (3) GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. A list of the German supervisory authorities is available at bfdi.bund.de.

19. Security

The portal is delivered over an encrypted connection (HTTPS). Access to tickets is limited to the ticket owner and the support team; attachments are stored outside the web root and served only after an authorisation check. No passwords are stored; sessions are protected against fixation and forms against cross-site request forgery. Despite these measures no transmission over the internet is completely secure, so please do not send more than the support team needs.

20. Minors

Discord requires its users to be at least 13 years old (16 in some countries), so the same applies to the support portal. If you are under 16 and live in the EU, please ask a parent or guardian before submitting personal data. If we learn that we have collected data from a child without the required consent, we will delete it.

21. Changes to this policy

We will update this policy when the portal changes or when the law requires it. The current version is always available at this address; the date of the last update is shown at the top.