1. Controller and contact
SpawnBoost (company registration in progress), Hungary, email [email protected]. Company details are added here once registration is complete.
Supervisory authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9-11, https://naih.hu. You may also complain to the authority in your EU country of residence.
2. What we collect, why, and on what legal basis
| Data | Source | Purpose | Legal basis (GDPR Art. 6) | Retention |
|---|---|---|---|---|
| SteamID64 | Steam sign-in (OpenID 2.0) | Account, sign-in, linking gameplay to your account | Contract (6(1)(b)) | Account life + 24 months (fraud/claims) |
| Steam profile name, avatar URL, profile visibility, account creation date | Steam Web API (GetPlayerSummaries, retrieved when you sign in) |
Display; fraud checks (account age) | Contract; legitimate interest in fraud prevention (6(1)(f)) | Refreshed on sign-in; deleted with account |
| IP address, user agent, timestamps (website) | Your browser | Security, session integrity, abuse and fraud prevention | Legitimate interest | 90 days logs; longer if part of a fraud case |
| Device/anti-fraud signals (e.g. hashed browser characteristics, IP-overlap flags, VPN/proxy/datacenter flags) | Your browser; game server | Detect multi-accounting, bots, owner–player collusion | Legitimate interest (fraud prevention, Recital 47) | 12 months; fraud cases until resolved + limitation period |
| Gameplay telemetry on partner servers (connect/disconnect times, activity flags, game events listed in the Game Annex, server-side IP) | The SpawnBoost mod on the Owner's server | Verify Goals; fraud prevention; aggregated Campaign reports for Owners | Contract (for Players who joined a Campaign); legitimate interest (for anti-fraud and for players on the server who did not join) | Raw events 90 days; Goal results and Reward ledger as financial records (below) |
| Campaign, Goal and Reward records | Our systems | Run Campaigns, pay Rewards, accounting | Contract; legal obligation (6(1)(c)) for accounting | 8 years (Hungarian Accounting Act, Sztv. §169) |
| Owner billing data (name/company, address, VAT no.) | You | Invoicing, VAT | Contract; legal obligation | 8 years |
| Tax data for reporting (if DAC7 or PIT reporting applies: name, address, date of birth, TIN, payout totals) | You / Stripe | Report to NAV | Legal obligation | 10 years (DAC7) |
| Support and complaint messages | You | Answer you; DSA complaints | Contract; legal obligation | 3 years |
Campaign attribution (campaign tags from the link you arrived through, landing page, referring site's domain; cookie sb_attr) |
Your browser | See which channels bring owners and players | Legitimate interest | 12 months |
Ad click IDs (e.g. gclid, fbclid), only if you choose "Allow ad measurement" on the cookie banner |
Your browser | Measure which ads lead to sign-ups and paid campaigns | Consent (6(1)(a)); withdraw any time via "Cookie choices" in the footer, which deletes them | Until you withdraw consent, at most 12 months |
Your cookie choice (sb_consent) |
Your browser | Remember your choice | Legal obligation / legitimate interest | 180 days |
We do not: read chat message content, record voice, take screenshots, scan your computer, sell personal data, or use it for targeted advertising.
Players who did not join a Campaign
The mod runs on the whole server, so it may see the SteamIDs and activity of everyone on that server. For players who are not SpawnBoost users we keep only what is needed for fraud checks (e.g. detecting alt accounts or owner collusion) for 30 days, then delete it.
3. Automated decisions
We use automated rules to flag possible fraud (e.g. shared IP with the Owner, new Steam account, impossible activity patterns). A flag can delay a Reward. A Reward is only rejected or clawed back after a human has reviewed it, so no decision with legal or similarly significant effect is taken solely by automated means (Art. 22). You can ask how a decision was made and contest it.
4. Who we share data with
| Recipient | Role | What |
|---|---|---|
| Stripe (Stripe Payments Europe Ltd, Ireland, and affiliates) | Separate controller for payouts, identity/age verification (KYC), sanctions screening and fraud | Your SteamID-linked account reference, email if you give it to Stripe, Reward amounts. Stripe collects ID documents, bank details, date of birth directly — we do not see your ID documents. Stripe's privacy policy: https://stripe.com/privacy |
| Server Owners | Joint controller for gameplay telemetry collected on their server (see section 5) | Campaign progress for their Campaigns; aggregated reports. Owners never see your IP address, payout data or identity documents. |
| Valve / Steam | Separate controller | We call the Steam Web API with your SteamID to get public profile data |
| Hosting provider (EU) | Processor | All site data |
| Cloudflare, Inc. | Processor (CDN, DDoS protection, DNS) | IP addresses, request data |
| NAV and other authorities | As required by law | Tax and legal requests |
5. Joint controllership with server Owners
When you play on a server running the SpawnBoost mod, the Owner (who decides to run the mod on their server) and SpawnBoost (which decides what the mod collects and why) jointly determine the purposes and means of that gameplay data collection. Under Art. 26 GDPR we have an arrangement with each Owner (the Server Owner Data Agreement). Essence of the arrangement:
- SpawnBoost is responsible for this privacy notice, data security of the data it receives, answering your rights requests, and breach notifications for its systems.
- The Owner is responsible for telling players on the server that the mod is installed (join message and server description per the Game Annex), for the security of their server, and for passing any rights requests to us.
- You can exercise your rights against either of us.
6. International transfers
Our main systems are in the EU. Some providers (Stripe affiliates, Cloudflare, Valve) are in the United States. Transfers rely on the EU–US Data Privacy Framework adequacy decision (Commission Implementing Decision (EU) 2023/1795) where the recipient is certified, otherwise on Standard Contractual Clauses (Commission Decision (EU) 2021/914).
Steam Data storage location (required by the Steam Web API Terms): the EU.
7. Your rights
Access, rectification, erasure, restriction, portability, objection (including to processing based on legitimate interest), withdrawal of consent where consent is the basis, and not to be subject to solely automated decisions. Write to [email protected]; we answer within one month. We may need to confirm it's you (e.g. by asking you to sign in with Steam). Some data we must keep (accounting, tax, fraud cases) even after deletion requests.
8. Age
SpawnBoost Campaigns are for people aged 18+. We do not knowingly collect data from children except where the mod incidentally records a minor playing on a partner server (handled as in section 2 "Players who did not join"). If you think a child has an account, contact us.
9. Security
TLS everywhere; secrets server-side only; signed mod reports; least-privilege access; logging and backups in the EU; breach notification to NAIH within 72 hours where required.
10. Cookies
See the Cookie Policy. By default we use only strictly necessary cookies (plus the first-party attribution cookie described there). Ad measurement happens only if you choose "Allow ad measurement" on the cookie banner, and you can withdraw that choice at any time.
11. Changes
We will notify material changes in-app before they apply.