EFFECTIVE 26 August 2026

PRIVACY POLICY

This policy describes the personal data used to operate HejterMods accounts, payments, orders, email messages and website security.

1. Privacy contact

For privacy requests concerning the HejterMods website, contact hejtermods@gmail.com.

2. Data categories

• Account: email address, Discord username, password hash, email-verification status and account timestamps.
• Authentication and security: session token hash, one-time-code hash, expiry and attempt counters, pseudonymised request-address hash, request counters and technical logs.
• Order: order number, selected services, amount, currency, language, consent timestamps and version, payment and fulfilment status, refund or dispute status and Stripe identifiers.
• Communication: messages sent by email and information voluntarily provided in a private Discord ticket.
• Location for pricing: the country code supplied by Cloudflare. Precise location is not requested or stored for this purpose.

The HejterMods website does not collect a game-account login, password or verification code. Do not enter them into account, checkout or public Discord fields.

3. Purposes and legal bases

• Account, order, checkout, fulfilment and customer communication: performance of a contract or steps requested before entering into a contract (GDPR Art. 6(1)(b)).
• Accounting, tax, consumer and authority obligations: compliance with legal obligations (Art. 6(1)(c)).
• Fraud prevention, service security, defence of claims, operational status and necessary technical logs: legitimate interests (Art. 6(1)(f)), balanced against user rights.

HejterMods does not currently use personal data for newsletter or behavioural-advertising campaigns.

4. Recipients and processors

• Cloudflare — hosting, D1 database, TLS, security, anti-DDoS, logs and Turnstile.
• Stripe — Checkout, payment processing, fraud prevention, refunds and disputes. Stripe receives payment and transaction data under its own privacy information.
• Brevo — transactional email delivery for verification, password reset and order confirmations.
• Discord — customer communication after the user voluntarily opens Discord; Discord's rules and privacy policy then apply.

Data may also be disclosed to professional advisers, payment institutions or public authorities when necessary and legally justified.

5. International transfers

Some providers may process data outside the European Economic Area. In such cases the provider and controller must rely on a lawful transfer mechanism, such as an adequacy decision or standard contractual clauses, together with appropriate safeguards.

6. Retention

• Verification and password-reset codes expire after 10 minutes; only cryptographic hashes are stored.
• Login sessions expire after 14 days and may be invalidated earlier.
• Rate-limit records are automatically removed after the security window, no later than approximately 7 days after their last update.
• Account data is retained while the account is active and then only for obligations, fraud prevention or claims that still require it.
• Order, payment and accounting records are retained for statutory tax/accounting periods and applicable limitation periods, ordinarily no longer than 6 years unless a dispute or law requires longer.

7. Cookies and local storage

The site uses a strictly necessary, HttpOnly, Secure session cookie to keep the user signed in. Language preference may be stored locally in the browser. Turnstile and Stripe may use necessary security or payment storage under their policies. No analytics or advertising cookies are currently installed by HejterMods.

8. Security

Passwords are stored as salted PBKDF2 hashes, sessions use random hashed tokens, emails are verified with expiring codes, write requests are protected against cross-site submission, abusive attempts are rate-limited, and Cloudflare provides TLS, Turnstile and network protection. No online service can guarantee absolute security.

9. Your rights

Depending on the circumstances, you may request access, rectification, erasure, restriction, portability and object to processing based on legitimate interests. You may lodge a complaint with the competent data-protection authority. Where processing is required by contract or law, deletion may be limited.

Send a request from the account email to hejtermods@gmail.com. We may need to verify identity before disclosing or deleting data.

10. Automated decisions and changes

Country code automatically selects PLN or EUR and security systems may block suspicious requests. No decision producing legal or similarly significant effects is made solely by HejterMods automated processing. Material policy changes will be published with a new effective date.