1Controller
Responsible for the processing of your personal data under the EU General Data Protection Regulation (GDPR) is the operator of Coreboosts ("Coreboosts", "we"). Contact: support@coreboosts.com.
2What we collect
| Category | Data | Source |
|---|---|---|
| Account | Discord user ID, username, avatar, registration date; email address if you enter one | Discord login / registration |
| Orders | Order ID, Products, durations, prices, timestamps, discount or gift codes used, store balance | Your orders |
| Payment | Cryptocurrency, amount, sending wallet address, transaction ID, confirmation times | Your payment on the blockchain |
| Licenses | License keys, activation time, hardware identifier (HWID hash), IP address at activation, reset history | Our licensing system |
| Support | Ticket messages, attachments, staff notes, assistant replies, ticket transcripts | Your Discord tickets |
| Technical | IP address, browser and device information, request logs, session cookie | Your use of the site |
| Community | Vouches, reviews, reward claims, reseller status | Our Discord server |
3Why we process it
| Purpose | Legal basis (GDPR) |
|---|---|
| Processing orders, delivering Products, managing licenses and HWID resets | Art. 6(1)(b) – contract |
| Payment matching, invoices, tax and accounting records | Art. 6(1)(c) – legal obligation |
| Support tickets and the automated ticket assistant | Art. 6(1)(b) – contract; Art. 6(1)(f) – efficient support |
| Anti-piracy (HWID binding, key-sharing detection), fraud prevention, security logging, rate limiting | Art. 6(1)(f) – protecting our services and customers |
| Order, delivery and product status messages via Discord | Art. 6(1)(b) – contract |
| Marketing messages (only if you opt in) | Art. 6(1)(a) – consent, revocable at any time |
We do not sell personal data and we do not run third-party advertising or tracking on this site.
4Automated ticket assistant
First-line replies in support tickets can be generated by an AI assistant. For this, the messages in your ticket, your Discord user ID, the Products you bought and the state of your licenses are sent to our AI provider, Anthropic PBC (USA), to generate a reply. Under its commercial terms the provider processes this data only to provide the service and does not use it to train its models. Transfers to the USA are based on the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses. The assistant makes no decisions with legal effect on you: refunds, replacements and account actions are decided by staff.
5Who receives your data
- Discord Inc. (USA) – login, server, tickets and direct messages run on Discord; Discord's own privacy policy applies.
- Licensing provider (KeyAuth) – stores license keys, HWID hashes and activation data for license validation.
- Hosting provider – our website and bots run on servers of our hosting provider (server location: EU); domain services by IONOS SE (Germany).
- Anthropic PBC (USA) – AI ticket assistant, see section 4.
- Public blockchains – crypto transactions are public and permanent by design; we cannot delete or alter them.
- Authorities – where we are legally required to disclose data.
Transfers outside the EU/EEA are protected by adequacy decisions, the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.
6Cookies
We use one strictly necessary session cookie to keep you logged in and to protect forms against misuse. It needs no consent and expires when the session ends. We do not use analytics or advertising cookies.
7Retention
| Data | Kept for |
|---|---|
| Orders, payments, invoices | 10 years (German tax and commercial law) |
| Account and license data | Lifetime of the account, plus 12 months |
| Support tickets and transcripts | 24 months after the ticket is closed |
| Security and request logs | 30 days; longer only while an incident is investigated |
| HWID hashes and activation IPs | Lifetime of the license, plus 12 months |
8Security
Transport encryption (TLS), encrypted storage of secrets and backups, two-factor authentication and access controls for staff, rate limiting and audit logging. No system is completely secure; report vulnerabilities to support@coreboosts.com.
9Your rights
You have the right to access your data, to rectification, erasure, restriction, data portability and to object to processing based on legitimate interests (Art. 15–21 GDPR). Consent can be withdrawn at any time with effect for the future. Legal retention periods can limit erasure. You can complain to a data protection authority, for example the authority of the German state where we are located or the authority of your place of residence.
To exercise your rights, open a ticket in our Discord server or email support@coreboosts.com; we verify your identity through your Discord account.
10Age
Our services are intended for adults. We do not knowingly process data of persons under 18; such accounts are deleted once we become aware of them.
11Changes
We update this policy when our services or the law change. The current version is always published on coreboosts.org with its effective date.