Hosting

Privacy policy

Last updated: 21 October 2026

This is a translation for your convenience. The German version is legally binding: Datenschutzerklärung.

1. Controller

Jörg Stuff (Navoryx), c/o flexdienst – #22262, Kurt-Schumacher-Straße 74, 67663 Kaiserslautern, Germany, email: contact@navoryx.site, phone: +49 176 30624061. If you have any questions about data protection, write to us at this address.

2. What we process and why

  • Customer account: email address; when signing in with Discord, the Discord ID, the display name and, if verified with Discord, the email address. Purpose: sign-in, contract, communication (Art. 6(1)(b) GDPR).
  • Orders and servers: selected plan, server name, term, payment status and history, and for invoices the billing address and, if provided, your VAT ID (both entered in the Stripe checkout). Purpose: performance of the contract and statutory invoicing obligations (Art. 6(1)(b) and (c) GDPR).
  • Notifications: We send notices about your servers (for example expiry, payments, incidents) by email and, if you turn it on in your account, as a direct message from our Discord bot. Purpose: performance of the contract (Art. 6(1)(b) GDPR).
  • Proof of order: time, wording of your declarations of consent, IP address and browser identifier at the time of ordering. Purpose: proof of the conclusion of the contract and of your consent to immediate commencement (Art. 6(1)(b) and (c) GDPR). Retention period: up to three years after the contract ends.
  • Panel account: We create an account for you in the Pterodactyl panel with your email address so that you can access the console, files and SFTP. The panel runs on our own servers.
  • Content on your server: We process whatever you store on your server solely in order to host it for you (Art. 28 GDPR, with a data processing agreement on request).
  • Sign-in and security: We process passkeys (public key only), the authenticator app secret (encrypted) and codes by email (only as a check value, valid for 10 minutes). For each session we also process the device (browser identifier), IP address and timestamps, for the “Signed-in devices” list and the notice email when you sign in from a new device. Purpose: protecting your account (Art. 6(1)(b) and (f) GDPR). Retention: sessions until you sign out, at most 30 days; factors until you remove them.
  • Asking for a review: Only if you agreed when ordering, we send you one email 14 days later with a link to our review page (Art. 6(1)(a) GDPR, § 7(2) UWG). For this we store your consent and when the email was sent. You can object at any time via the link in the email or by emailing us. You write the review itself directly on the review site; its own privacy policy applies to that processing.
  • Referrals: Every account has its own referral link. If someone orders through it, we store who referred whom, whether the discount was granted and when. Purpose: granting the discount to both and preventing abuse (Art. 6(1)(b) GDPR). The referrer only sees how many referrals were rewarded, no names or email addresses. Retention: as long as both accounts exist.
  • Inviting fellow players: If you invite someone to your server, we process their email address or Discord name to deliver the invitation (Art. 6(1)(f) GDPR, our and your legitimate interests). We inform the invited person with the invitation; open invitations expire after 7 days.
  • Discord server and bot: If you signed in with Discord and are on our Discord server, our bot gives you the “Customer” role there. If you turn it on, it also sends you notices about your servers as direct messages. For this we process your Discord ID (Art. 6(1)(b) GDPR).
  • Server addresses: For Minecraft servers we create an address under mc.navoryx.site (DNS at Cloudflare, see section 4). It contains only our server's IP address and port, no data about you.
  • Navoryx Shield (attack protection): If the protection is turned on for a Minecraft server, players' connections run through our own proxy. It processes IP address and player name to fend off bots and overload. For the statistics in the panel, it stores hourly counts and the names of players who joined, for 90 days (Art. 6(1)(f) GDPR; for the Customer's players as data processing, see DPA).
  • Public demo server: Anyone can play on demo.mc.navoryx.site, and through “Try the demo” anyone can read its console and files in the panel without an account. If you play there, your player name and chat messages are visible to everyone in the console. The server does not write IP addresses to its log. We reset the server every night, which deletes everything (Art. 6(1)(f) GDPR, demonstrating our service). If you don't want this, please don't play there.
  • Navoryx Insight (performance analysis): Insight measures tick times and load of your server to explain lag. No data about persons is created. We delete the measurements after 2 days.
  • Server logs: When you access the site, the web server processes technically necessary data such as IP address, time and the requested address in order to fend off attacks (Art. 6(1)(f) GDPR). We delete these logs after 14 days at the latest.

3. Cookies, audience measurement and statistics

We measure the use of this website in two levels, exclusively on our own server in Germany (Hetzner, see section 4). No third parties are involved in it. We use the same measurement and the same cookie banner on navoryx.site and streamline.navoryx.site. The cookies streamline_consent and streamline_vid apply to the domain .navoryx.site, i.e. jointly to all these websites. Your choice in the banner therefore applies to all of them.

3.1 Basic measurement without cookies (no consent). For each page view we process the page visited without address parameters, only the domain of the referring website, campaign parameters (utm_source, utm_medium, utm_campaign) if the address contains them, the device class, the browser and operating system family without version number and your browser's preferred language. To count visitors per day without recognising them, the server calculates a non-reversible value from the IP address, browser and operating system family, device class and a random value renewed daily. This value is kept in memory only until midnight. We do not store IP addresses, set no cookies and store or read nothing on your device. Legal basis: our legitimate interest in improving our service (Art. 6(1)(f) GDPR). Retention: 13 months. If your browser sends Global Privacy Control or Do Not Track, you are not counted. You can also object to the basic measurement at any time (Art. 21 GDPR).

3.2 Extended statistics (only with your consent). Only if you choose “Accept all” in the cookie banner or turn on the “Statistics” category do we additionally record: a random visitor ID in the cookie streamline_vid (new or returning visitor), sessions with start, duration, entry and exit page and number of page views, time on page and scroll depth per page, clicks on individual buttons marked by us (never your input in form fields), the full referring address without credentials, the full browser identifier, screen size, time zone and language, and your IP address (in full for at most 30 days, then shortened). As the visitor ID applies to all the websites named above, your visits there may be assigned to the same ID. We do not use the data for advertising and do not pass it on. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Retention: 13 months. You can withdraw your consent at any time via “Cookie settings” in the footer. We then delete streamline_vid. As proof of your choice we store a random identifier, time, choice and banner version without IP address for three years.

3.3 All cookies and browser storage.

  • nx_hosting_session: keeps you signed in, up to 30 days or until you sign out, necessary (§ 25(2) no. 2 TDDDG).
  • nx_hosting_oauth: secures signing in with Discord, 10 minutes, necessary.
  • nx_hosting_order: links an order without an account to your browser, 2 days, necessary.
  • nx_ref: remembers the code of a referral link so the discount applies to your order, 30 days, necessary for the requested discount (§ 25(2) no. 2 TDDDG).
  • nx_panel_last: remembers where to continue after the shared sign-in with the panel (domain .navoryx.site), necessary.
  • streamline_consent: your choice in the cookie banner (domain .navoryx.site), 12 months, necessary.
  • streamline_vid: random visitor ID for extended statistics (domain .navoryx.site), 13 months, only with consent.
  • _gcl_au, _gcl_aw: Google Ads cookies for conversion measurement (see 3.4), up to 90 days, only with consent to “Marketing”.
  • Local storage nx-first-steps:…: remembers whether you hid the first-steps hints for a server, until you delete it, necessary.

3.4 Google Ads (only with your consent to “Marketing”). We run ads on Google. Only if you choose “Accept all” in the cookie banner or turn on the “Marketing” category does this website load the Google tag of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). It measures whether a visit via one of our ads led to an order (conversion) and sets the cookies _gcl_au and _gcl_aw for this. Google processes your IP address, browser and device details, the pages visited, the ad click ID and, for an order, an order number and the monthly price; no names and no email addresses. We do not use personalised advertising (remarketing). Google also processes data in the USA. Google LLC is certified under the EU-US Data Privacy Framework. We and Google are joint controllers for the measurement (Art. 26 GDPR). Google is solely responsible for its own further processing, see policies.google.com/privacy. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Cookie retention: up to 90 days. You can withdraw your consent at any time via “Cookie settings” in the footer. The site then no longer loads the Google tag and deletes the Google cookies.

3.5 Trustpilot reviews on the home page (only with your consent). On the home page we can show our reviews on Trustpilot. The widget comes from Trustpilot A/S (Pilestræde 58, 1112 Copenhagen, Denmark). It only loads once you click “Show Trustpilot reviews” or consent to the “Marketing” category in the cookie banner. Until then no request goes to Trustpilot. When loading, Trustpilot processes your IP address, browser and device details and the page visited, and may use cookies or similar storage. We remember your click in your browser (local storage, entry nx-trustpilot) so you do not have to click again each time. Trustpilot may also process data outside the EU. Trustpilot is solely responsible for its own processing, see legal.trustpilot.com. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Withdrawal: delete the entry in your browser or turn off “Marketing” in the cookie settings.

4. Recipients and service providers

  • Trustpilot A/S (Copenhagen, Denmark): showing our reviews on the home page, only with consent, see section 3.
  • Google Ireland Limited (Dublin, Ireland): conversion measurement for Google Ads, only with consent, see 3.4.
  • Hetzner Online GmbH (Gunzenhausen, Germany): servers and data centre in Falkenstein. A data processing agreement is in place with Hetzner.
  • Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland): payment processing, invoices and customer portal. You enter your payment details directly with Stripe; we do not see them. Stripe processes some data in the USA. This is safeguarded by the EU-US Data Privacy Framework and standard contractual clauses. For payment processing, Stripe is in part an independent controller, see stripe.com/privacy.
  • IONOS SE (Montabaur, Germany): sending our emails, for example sign-in links and billing notices.
  • Discord Inc. (San Francisco, USA): only if you sign in with Discord or turn on Discord notifications. After you have given your consent, Discord passes the profile data mentioned above to us. Messages to you are delivered via Discord, also in the USA (EU-US Data Privacy Framework).
  • Cloudflare, Inc. (San Francisco, USA): manages the DNS records of navoryx.site, including the server addresses under mc.navoryx.site (without data about you). In addition, only on the panel sign-in pages (panel.navoryx.site), Cloudflare Turnstile checks that a human is signing in. Cloudflare processes your IP address and technical browser characteristics, also in the USA (EU-US Data Privacy Framework). Purpose: protection against automated sign-in attempts (Art. 6(1)(f) GDPR). Other pages of the panel and of this website load no content from third-party servers.

5. Retention period

We store account data for as long as your account exists. We delete servers and their data 14 days after the contract ends. We or Stripe retain invoices for the statutory retention periods (up to ten years, § 147 AO, German Fiscal Code).

6. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and the right to object to processing based on legitimate interests (Art. 15 to 21 GDPR). To exercise these rights, write to contact@navoryx.site. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany (www.ldi.nrw.de). We are not required to appoint a data protection officer (§ 38 BDSG).

7. Obligation to provide data

To place an order, we need an email address and the payment details entered with Stripe. Without them we cannot conclude a contract. We do not make automated decisions within the meaning of Art. 22 GDPR.