How we collect, use, and protect your personal data
Last Updated: 2/28/2026
Infinity Projects takes the protection of your personal data very seriously. We process your data in accordance with the GDPR and German Telemedia Act (TMG). This privacy policy explains how we collect, use, and protect your information.
The data controller responsible for processing on this website is: Infinity Projects, Charly Pohl, Schilfweg 17, 01237 Dresden, Germany. Email: info@infinity-projects.de
Our hosting provider automatically collects information in server log files including: IP address, browser type, operating system, referrer URL, and access time. This data is processed based on Art. 6 (1) lit. f GDPR for security and system stability purposes. Logs are deleted after 7 days.
When you contact us via email or support system, we store your contact data (email, name, message content) to process your inquiry. Legal basis: Art. 6 (1) lit. b GDPR (contract processing) or Art. 6 (1) lit. f GDPR (legitimate interest in customer communication). Data is retained for 3 years after the last correspondence.
To use our services, you must create an account. We collect and process: Email address, password (hashed with bcrypt), username, and registration date. Authentication is handled through Supabase (EU servers). Legal basis: Art. 6 (1) lit. b GDPR. Account data is stored until account deletion or 2 years after last login.
We use Stripe for payment processing. When you make a purchase, payment information (name, billing address, payment method) is transmitted directly to and processed by Stripe. We only store: Transaction IDs, purchase amounts, timestamps, and purchase metadata. We do not store complete credit card data. Legal basis: Art. 6 (1) lit. b GDPR. Stripe privacy policy: https://stripe.com/privacy. Payment records are retained for 10 years for tax purposes per German law (§ 147 AO).
We use essential cookies and local storage for: User authentication (session cookies), security tokens, user preferences. Legal basis: Art. 6 (1) lit. f GDPR (essential for website functionality). We do not use tracking or analytics cookies. You can block cookies in your browser settings, but this may affect functionality.
We use the following service providers (Art. 28 GDPR processors): Supabase (database, authentication - EU servers) - Privacy: https://supabase.com/privacy; Stripe (payment processing) - Privacy: https://stripe.com/privacy; Vercel (hosting, CDN - EU/Frankfurt servers) - Privacy: https://vercel.com/legal/privacy-policy. All processors are GDPR-compliant and process data only on our instructions.
When you purchase and use our services, we collect: (1) Game Servers: Server configuration (CPU, RAM, storage), server files and world data, server logs and console output, IP address and port assignments. (2) Software Products: License information, download history, activation data, product version. (3) Service Usage: Feature usage data, performance metrics, error logs for troubleshooting. This data is necessary for service provision (Art. 6 (1) lit. b GDPR). Server data is retained for the duration of your service plus 30 days backup retention. Product license data is retained for the legally required period (10 years for tax purposes). You can request deletion of non-mandatory data at any time.
Account data: Until deletion or 2 years after last activity. Transaction records: 10 years (German tax law § 147 AO, § 257 HGB). Support communications: 3 years. Server data: Service duration + 30 days. Server logs: 7 days. Backup data: 30 days after server termination.
You have the following rights: Right of access (Art. 15) - Request a copy of your personal data. Right to rectification (Art. 16) - Correct inaccurate data. Right to erasure (Art. 17) - Request deletion of your data (subject to legal retention requirements). Right to restriction (Art. 18) - Request processing restrictions. Right to data portability (Art. 20) - Receive your data in machine-readable format. Right to object (Art. 21) - Object to processing based on legitimate interests. Right to withdraw consent (Art. 7(3)) - Withdraw consent at any time. To exercise these rights, contact: info@infinity-projects.de. You may also lodge a complaint with the Saxon Data Protection Authority (Sächsische Datenschutzbeauftragte).
We implement technical and organizational measures to protect your data: TLS/HTTPS encryption for all data transmission. Bcrypt password hashing with salt. Encrypted database storage (AES-256). Regular security updates and patches. Access controls and authentication. Firewall and DDoS protection. Regular backups with encryption. However, no internet transmission is 100% secure.
Our services are intended for users 13 years and older. Users under 16 years require parental consent under GDPR. We do not knowingly collect data from children under 13. If we become aware of such data, it will be deleted immediately. Parents may contact us to exercise rights on behalf of their children.
We may update this policy to reflect legal changes or service updates. Material changes will be announced via email or website notice. Continued use after changes indicates acceptance. Last updated date is shown at the top of this document.