Sylvaria: Privacy Policy

1. Data Controller

The data controller for personal data processed through this platform is:

Ridoco
KVK: 95439609
BTW: NL005153257B49
De Nieuwe Erven 3-12572, 5431 NV Cuijk, Netherlands
Phone: +31 6 49154776
Email: contact@ridoco.com

2. Data Ridoco Collects

2.1 Account data

When you register or log in via Discord OAuth2, Ridoco receives and stores:

• Discord User ID, username, display name, avatar URL
• Email address (if authorized)
• OAuth2 access and refresh tokens (stored encrypted)

2.2 Platform-generated data

• Profile data: Username, display name, avatar, banner, about me, status
• Activity data: Activity points, rank, participation records
• Credits: Essence of Hell (EoH) prepaid balance and transaction history
• Linked accounts: Steam ID, Minecraft UUID, Patreon, and other linked services
• Subscriptions: Subscription tier, provider, payment references
• Content: Forum posts, comments, submissions you create

2.3 Automatically collected data

• IP address (for security and rate limiting)
• Browser User-Agent string
• Essential cookies for session management

2.4 Licence checks from software you bought and host yourself

If you bought EclipseCP and installed it on your own server, that installation contacts this site to confirm your key is still valid. It does so once a day on a schedule, and again when an administrator re-checks a key by hand or enters a new one. The call carries four things: your licence key, a fingerprint the installation generated for itself, the site address it is configured with, and a one-time random value. It carries nothing about your visitors or your members.

Ridoco keeps the following against your licence record:

• a SHA-256 hash of that fingerprint, the site address, and the date the installation first activated, as one entry per installation;
• the time of the most recent check and a running count of checks;
• a truncated SHA-256 hash of the IP address the check came from. The address itself is not stored.

The one-time value is not kept. Ridoco processes this to perform the licence agreement (Art. 6(1)(b)) and to stop one key being run on more installations than it was sold for, which is Ridoco's legitimate interest (Art. 6(1)(f)). It is not metering and cannot change what you were charged. The answer to the check does decide your licence state, and that state can limit the installation: a rejected key, or a licence server the installation cannot reach for long enough, puts the admin panel into read-only and can place a notice on the public site. The thresholds are set out in the product's LICENSE.md. Section 6 says how long it is kept.

2.5 Business accounts

If you create an account for a business, Ridoco stores:

• the company name, and the KvK number and VAT number if you give them;
• your name as the contact person, your email address, and your password as a hash;
• the time you confirmed that you are 18 or older and may create the account for the business, with a hash of the sentence you confirmed.

A business account is not asked for a date of birth and has no public profile page. The company name, KvK number and VAT number are saved as your invoice address and appear on the invoices for what you buy. Ridoco processes this data to create and run the account and to perform the contract (Art. 6(1)(b)), and to put the required particulars on invoices and keep them as Dutch tax law requires (Art. 6(1)(c), art. 35a Wet OB 1968 and art. 52 AWR). Section 6 says how long it is kept.

3. Legal Basis for Processing

Ridoco processes your personal data under the following legal bases (GDPR Art. 6):

• Contract performance (Art. 6(1)(b)): Account management, service delivery, prepaid credit transactions
• Legitimate interest (Art. 6(1)(f)): Security, fraud prevention, service improvement
• Consent (Art. 6(1)(a)): Non-essential cookies, marketing communications
• Legal obligation (Art. 6(1)(c)): Tax records for purchases, lawful requests

4. How Your Data Is Used

• Authenticate and manage your account
• Display your profile, content, and activity on the platform
• Process prepaid credit transactions and maintain financial records
• Deliver subscription benefits and rank rewards
• Moderate content and enforce community rules
• Send service-related notifications
• Generate aggregate, anonymized analytics

5. Data Sharing

Your personal data is never sold. The providers below process data on Ridoco's instructions under a data processing agreement, except where noted otherwise.

• netcup GmbH, and the Anexia group companies it relies on. Server hosting, databases and backups. Processed in Germany and Austria (EU).
• Stripe and PayPal. Payment processing. They also act as independent controllers for their own fraud prevention and regulatory duties. Processed in the EU and the United States.
• Mollie. Payment processing for iDEAL, bank transfer and SEPA Direct Debit, offered only where that payment option appears at checkout. This site sends Mollie the amount and a reference to the payment. You enter your payment details on Mollie's own page, and Mollie acts as an independent controller for those. Mollie B.V. is a Dutch company. Processed in the European Union.
• Fourthwall. Sale and shipping of physical merchandise. Buying merchandise takes you to Fourthwall's store and the order is completed there. Fourthwall receives your name, email address, delivery address and order, and reports the completed order back to this site with your email address on it. Fourthwall, Inc. is based in the United States.
• 17TRACK. The shipment tracking widget on the order tracking page. Your browser loads it directly from 17TRACK, so your IP address, your browser details and the tracking number you type reach 17TRACK. 17TRACK is operated from China. Nothing is sent until you press Track.
• Google. Business email, and analytics where you have consented. Also calendar sync for EclipseBook: where a host connects their Google Calendar to a booking page, your name, your email address, the time and the notes you leave on the booking are written into a Google Calendar event, with a Google Meet link added for a video call. Processed in the EU and the United States.
• Sentry. Application error and crash reporting, which can include your IP address and account identifier. Processed in the EU and the United States.
• Discord. Authentication, community features and bot integrations. This site also posts notifications to the operator's Discord channels where those are configured. Such a notification carries the subject and the first 800 characters of your support ticket or bug report, your display name, and on a payment notification your email address. A new booking with the booker's name and notes, a new forum thread with its first 300 characters, and an entry in the Hall of Fame or Hall of Patrons are announced the same way. Processed in the United States.
• AI features. By default, AI runs on Ridoco's own infrastructure and no data you submit is sent to a third-party AI provider. Automated consistency and rule checks on content you submit always run on that infrastructure. AI assistant (chatbot) replies run on it too by default; an optional external tier is used only if Ridoco enables it or you supply your own provider key, in which case replies are processed by an external AI provider (currently Google Gemini or Anthropic) in the United States.

• Connected services: When you link accounts (Discord, Steam, Patreon, Google, GitHub, Twitch, X, Reddit and Kickstarter), data is shared with those services per their privacy policies.
• Law enforcement: When required by applicable law or valid legal process.

6. Data Retention

Deleting your account erases your identity immediately. The step cannot be undone. Your name, email, password, profile text, uploaded avatar and banner, linked game and chat identifiers, and the free text you wrote are overwritten or deleted as part of the request, before you are logged out.

• Account data: Retained while active. Identity erased on deletion, at once. The account row itself is kept as an anonymous key, with the deletion date on it as the record that the erasure happened. Payment records reference that key, and deleting it would destroy them.
• Transaction records: Retained for 7 years, with the customer name and email required on them. Dutch tax law obliges Ridoco to keep them (art. 52 lid 4 AWR, art. 35a Wet OB 1968). After 7 years that identity is erased too and only the amounts remain.
• Software licence records: A sold licence is a contract, so the record described in section 2.4 is kept while the licence runs and for 7 years after it ends under that same tax rule, after which the identifying fields on it are erased.
• Content: Comments, threads and tickets you wrote are replaced with a removal marker. Replies from other members keep their context.
• Session cookies: Expire per session or after configured timeout.
• Refunds on closure: if your account is closed while you hold EoH you bought and have not spent, or unused subscription time, Ridoco keeps your email address, the amounts and the payment references in a refund ticket until the refund is paid. The refund is a payment record and is kept for 7 years under the same tax rule.
• What cannot be reached automatically: some records are keyed to a Discord or Steam identity rather than to your site account, including community applications, game server join logs and in-game event records. Erasing your site account does not clear these. Ask Ridoco and they are cleared by hand.

Where Ridoco erases an account on your written request, that is done by hand and can take up to the thirty days Art. 12(3) allows. Either way, ask and you will be told when it was carried out.

Erasure clears the live database. Erased rows stay in the encrypted nightly backups until the backup rotation overwrites them. Those backups are held in the European Union and are only read to restore the site after a failure.

7. Your Rights (GDPR Art. 15-22)

As an EU/EEA resident, you have the right to:

• Access (Art. 15): Request a copy of your personal data
• Rectification (Art. 16): Correct inaccurate data
• Erasure (Art. 17): Request deletion ("right to be forgotten")
• Restriction (Art. 18): Request restriction of processing
• Portability (Art. 20): Receive your data in machine-readable format
• Objection (Art. 21): Object to processing based on legitimate interest
• Withdraw consent: Where processing is based on consent

To exercise these rights, please open a support ticket first. If unavailable, email contact@ridoco.com (or contact@doombringerz.com as a secondary). Ridoco responds within 30 days. You may also lodge a complaint with the Autoriteit Persoonsgegevens (AP) in the Netherlands.

8. International Data Transfers

Ridoco's servers are in the European Union. Some of the providers listed in section 5 are based in the United States or may process data there, in particular Discord, Google, Sentry, Stripe, PayPal, Fourthwall, and any optional external AI provider you enable. Where that happens, the transfer relies on one or both of:

• the EU-US Data Privacy Framework, where the provider is certified under it;
• the European Commission's Standard Contractual Clauses, together with additional technical measures such as encryption in transit.

Mollie processes inside the European Union.

The 17TRACK shipment tracking widget sits apart from this. 17TRACK is operated from China, for which there is no adequacy decision, and the data goes straight from your browser to 17TRACK without passing through Ridoco's servers. To avoid that transfer, do not press Track on the order tracking page and enter your tracking number with the carrier directly. The tracking number is in your shipping email.

You can request a copy of the relevant safeguards using the contact details in section 12.

9. Data Security

• Passwords stored as irreversible cryptographic hashes
• All data in transit encrypted via TLS/HTTPS
• Admin access restricted by account rank
• Session tokens stored in secure, httpOnly cookies

10. Children's Privacy

In the Netherlands the age of digital consent under Art. 8 GDPR is 16. This platform is not directed at children under 16, and Ridoco does not knowingly collect their personal data without parental authorisation. Registration asks for a date of birth and applies an age gate. Contact Ridoco if you believe a child has provided personal data, and Ridoco will delete it.

11. Changes

Ridoco may update this policy. Material changes are communicated via the platform.

12. Contact

Ridoco
De Nieuwe Erven 3-12572, 5431 NV Cuijk, Netherlands
KVK: 95439609 | BTW: NL005153257B49
Email: contact@doombringerz.com
Phone: +31 6 49154776