Privacy Policy
Last updated: 9 July 2026
This policy explains what personal data NexoMC collects, why, and what rights you have. It applies to the nexomc.com website and account/store.
1. Who is responsible for your data
The data controller is CodeCraft Paulsen, a sole proprietorship (enkeltpersonforetak) registered in Norway, operating NexoMC. Our registered address is on file with the Norwegian Business Register (Brønnøysundregistrene) and is available on request.
For any privacy question or to exercise your rights, contact [email protected].
2. What we collect and why
| Data | Why we process it | Legal basis (GDPR Art. 6) |
|---|---|---|
| AccountUsername, email address, hashed password | To create and run your account and let you sign in | Performance of a contract (6(1)(b)) |
| PurchasesProduct, amount, currency, payment-provider reference, timestamps | To deliver what you bought and keep the required accounting records | Contract (6(1)(b)) and legal obligation (6(1)(c), Norwegian Bookkeeping Act) |
| DownloadsIP address, browser user-agent, timestamp, license key | To enforce licenses and prevent fraud, piracy and abuse of paid downloads | Legitimate interest (6(1)(f)) |
| Discord (optional)Discord ID, username and avatar | Only if you choose to link Discord, to show the connection and grant Discord perks. We never store Discord access or refresh tokens. | Consent (6(1)(a)); you can disconnect at any time |
| Profile avatar (optional)An image you upload or choose | To personalise your account | Consent (6(1)(a)) |
We do not use any advertising, analytics or tracking technology, and we do not sell your data or build profiles about you.
3. Cookies
We set a single, strictly-necessary session cookie so you can stay signed in. It is required for the site to work and is exempt from consent under the ePrivacy rules. We use no analytics, advertising or third-party tracking cookies, so there is no cookie-consent banner to click through.
4. Who we share data with
We share the minimum necessary data with the following processors, each under a data-processing agreement:
- Stripe: card/payment processing (only when you pay by Stripe).
- PayPal: payment processing (only when you pay by PayPal).
- Resend: sending transactional email (verification, email change, password reset).
- Hetzner Online GmbH: server hosting, located in Germany (EU).
- Discord: only if you choose to link your Discord account.
Payment providers act as independent controllers for the payment itself and keep their own transaction records for legal reasons.
5. International transfers
Our servers and email are hosted in the EU/EEA. Some payment providers (e.g. Stripe, PayPal) may process data outside the EEA; where they do, transfers are covered by the EU Standard Contractual Clauses or an adequacy decision.
6. How long we keep it
- Account data: for as long as your account exists. Delete your account and it is removed.
- Download logs: the IP address and browser user-agent are automatically erased 90 days after each download; the anonymous record (which product, when) may be kept longer for security auditing.
- Purchase / accounting records: retained for up to 5 years as required by the Norwegian Bookkeeping Act, even after account deletion. After you delete your account these are anonymised so they no longer identify you.
7. Your rights
Under the GDPR you have the right to access, correct, delete, restrict or object to the processing of your data, and to data portability. You can:
- Download your data yourself from your account settings (Export my data).
- Delete your account yourself from your account settings (Delete account).
- Or email [email protected] and we will help.
Where processing is based on consent, you may withdraw it at any time without affecting prior processing. You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).
8. Security
Passwords are stored only as salted bcrypt hashes, never in plain text. Traffic is served over HTTPS. We never store Discord or payment-provider tokens on our servers.
9. Children
NexoMC is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has given us data, contact [email protected] and we will remove it.
10. Changes to this policy
We may update this policy as the service evolves. The "last updated" date above always reflects the current version, and significant changes will be highlighted on the site.