Privacy Policy
Version 2026-09-26.
The short version
- We collect what we need to run your servers and bill you. Nothing more.
- No ads, no tracking, no analytics. The only cookie keeps you logged in.
- We never sell your data.
- Email us and we'll show you or delete what we have about you.
1. Who is responsible
Guldborg Digital, , , Denmark, is the data controller. Contact: [email protected].
2. What we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email address | Your account, login links, receipts and important notices | Contract, art. 6(1)(b) |
| Discord or Google account ID, if you log in with them | Recognising you when you log in | Contract, art. 6(1)(b) |
| Your servers: names, game settings, IP address, status | Running the servers you ordered | Contract, art. 6(1)(b) |
| Payments and invoices (handled by Stripe; we see no card numbers) | Billing, and bookkeeping required by law | Contract and legal obligation, art. 6(1)(b) and (c) |
| When you accepted these terms | Proof of the agreement | Legal obligation and legitimate interest, art. 6(1)(c) and (f) |
| Emails you send us | Answering you | Contract and legitimate interest, art. 6(1)(b) and (f) |
What players do inside your game server (chat, player names, worlds) stays on that server, except the world save: we keep a copy of the world and its settings in Hetzner Object Storage in Germany, so it survives when the server is stopped. We don't read or use it for anything else, and it is deleted with the server. You are responsible for your players' data on your server.
3. Cookies
We use one cookie, wapid_session, which keeps you logged in for up to 30 days. During Discord or Google login, a second cookie lives for up to 10 minutes to protect the login. Both are strictly necessary, so we don't ask for consent. We use no analytics, advertising or tracking cookies.
4. Who else handles your data
| Company | What for | Where |
|---|---|---|
| Hetzner Online GmbH | Servers for wapid and your game servers, and storage for world saves | Germany |
| Cloudflare, Inc. | Delivering wapid.io securely, forwarding email to us | EU and USA |
| Stripe Payments Europe, Ltd. | Payments and invoices | Ireland and USA |
| Resend, Inc. | Sending login emails | EU (Ireland) and USA |
| Proton AG | Our support mailbox | Switzerland |
| Discord Inc. or Google LLC | Only if you choose to log in with them | USA |
Transfers to the USA rely on the EU-US Data Privacy Framework or the EU's standard contractual clauses. Switzerland has an EU adequacy decision.
5. How long we keep it
- Your account: until you ask us to delete it.
- A server and its world: until it is deleted, or 7 days after its subscription ends.
- Invoices and payment records: 5 years, as Danish bookkeeping law requires.
- Login links: they expire after 15 minutes. Sessions expire after 30 days.
6. Your rights
You can ask to see, correct, export or delete your data, and object to or restrict how we use it. Email [email protected] and we answer within 30 days. We may keep data we are required to keep by law, such as invoices.
If you think we handle your data wrongly, you can complain to Datatilsynet, the Danish Data Protection Agency (datatilsynet.dk).
7. Changes
If we change this policy in a way that matters to you, we email you before the change takes effect.