Privacy Policy

The controller of your personal data is [Legal name], registration number [Registration number], address: [Address] (“DGuard”, “we”).

The terms “Service”, “Account”, “License key” and “Plan” have the meaning given in the Terms of Service.

For any privacy question, write to [Contact email] or contact support on the website.

Account data: your name or nickname, email address, password hash (we never store the password itself), interface language, sign-up date and email verification status.

Telegram: if you link Telegram to your account — your Telegram ID and username, so the bot can send notifications and receive support requests.

Server data: the names and addresses of the servers you add in the panel; the beginning and a hash of each license key; when each server last connected; and the technical information the Plugin sends to check the license and Plan limits — the Plugin, server software and Java versions, a per-start instance id, the number of players online and TPS. This information contains no nicknames or other player data.

Support requests: the subject, the conversation and anything you add to it. If you write without an account — the name and email you provide. If you write to the Telegram bot — your Telegram ID, username and chat ID.

Payment records: order number, Plan and period, amount and currency, payment method, status, dates and the provider's payment ID. We never receive or store card data — card number, expiry date, CVC: it is processed by the Payment provider PayHot.

Technical data: IP address and browser user agent, your list of active sessions (device, browser, IP and sign-in time), the session and language cookies, and server logs — request times and errors.

We do not collect sensitive categories of personal data or biometrics, and we do not use advertising trackers.

Creating and running your account and signing you in — to perform our contract with you (the Terms of Service).

Providing the Service: connecting servers, issuing and checking keys, enforcing Plan limits — to perform the contract.

Taking payments, keeping payment records, receipts and refunds — to perform the contract and to meet our legal obligations, including tax and accounting.

Support — to perform the contract, and for requests without an account, based on the consent you give by sending the request.

Security: protection against account takeover, password guessing and abuse, rate limiting and incident investigation — based on our legitimate interests, provided they do not override your rights.

Meeting legal requirements and lawful requests from public authorities.

Service messages: email verification, password reset, payment confirmations and receipts, plan expiry reminders and support replies. These are part of the Service and cannot be turned off while you keep an account. We send marketing emails only with your separate consent, and you can unsubscribe at any time.

PayHot — the Payment provider. It receives the details you enter on the checkout page and, from us, the order number, amount and purchase description. It only reports the payment status back to us. PayHot processes data under its own policies.

[Email delivery provider] — sends service emails. It receives the recipient's address and the content of the email.

Telegram — if you write to the DGuard Telegram bot or link Telegram to your account. Telegram processes data under its own policies.

[Hosting provider, country] — hosts the website and database.

Other panel users — if you sell configs, they see your account name as the author; if you review a config, they see your name next to the review. We don't show them your email or other account details.

Public authorities — only in response to a lawful request.

We do not sell personal data or share it with advertisers. We give service providers only the data they need for their task and require them to keep it confidential. Some providers may process data in other countries; where required, we use appropriate safeguards for such transfers.

Account and server data — for as long as your account exists. After you delete your account, we delete or anonymize it within 30 days, except for data we are legally required to keep.

Payment records — for as long as accounting and tax law requires. After account deletion they are kept without a link to the account.

Support requests — up to 3 years after the last message.

Server online history — 30 days. The punishment log, if you turn it on — 90 days.

Server logs — up to 12 months.

Sessions — until you sign out or the session expires. A Telegram link — until you unlink it in settings or delete your account.

We use only strictly necessary cookies: a session cookie that keeps you signed in and a cookie that remembers your chosen language.

There are no third-party advertising or analytics trackers on the website. If you block cookies in your browser, the website still opens, but you won't be able to sign in.

Depending on where you live, you have the right to access your data and get a copy of it, to have it corrected, to have it deleted, to restrict or object to its processing, to data portability and to withdraw consent where processing is based on consent.

You can do much of this yourself in the panel settings: change your name, view and sign out sessions, unlink Telegram and delete your account.

For anything else, contact support or write to [Contact email]. We reply within the time limits set by applicable law, usually within 30 days. To protect your data, we may ask you to confirm that the account is yours.

If you believe we are violating your rights, you can also complain to your local data protection authority.

Passwords are stored only as strong hashes. License keys are stored as hashes too — the panel shows only their beginning.

The website and API work only over encrypted TLS connections. Notifications from the Payment provider are verified by signature.

Only staff who need access for their work have it, and access is role-based. Sign-ins and sensitive actions are rate-limited to protect against brute-force attacks.

No system can rule out every risk. If a data breach occurs, we will notify the relevant authority and, where required, you, within the time limits set by law.

The Plugin analyzes player behavior on your server. That data — nicknames, evidence, reports and player records, including those in your MySQL database — stays on your infrastructure and is not sent to DGuard. The one exception is the punishment log: if you turn it on in the Plugin settings, the punished player's nickname and UUID, the time, the type of punishment, the check name and the report are sent to your panel. The log is off by default and entries are kept for 90 days. You, the team members you gave access to in the Team section, and DGuard support can see them.

Otherwise, we receive player data only if you send it to us yourself, for example by attaching a report or log to a support request. Such data is processed as part of that request.

You, as the server owner, are the controller of player data on your server. It is up to you to tell your players what data is collected and why.

The Service is built for server owners and administrators and is not intended for anyone under 16. We do not knowingly collect their data. If you learn that a child under 16 has signed up without a parent's consent, contact us and we will delete the account.

We may update this policy. The new version is published on this page with its update date. We notify you of material changes in advance by email or in the panel.

Controller: [Legal name], [Address].

Privacy and data requests: [Contact email].

Support: the support page on the website and the DGuard Telegram bot. News: https://t.me/dguard_mc.