Privacy Policy

This Privacy Policy provides information about the processing of personal data when using CloudPVP, our website including the player panel (UCP) and the staff panel (ACP), as well as our FiveM game server for GTA V (together the “Service”).

Controller within the meaning of Art. 4(7) GDPR:

E-mail: info@cloudpvp.xyz · Phone: +49 1522 9245421

Further information about the provider can be found in the Imprint. We are not legally required to appoint a data protection officer. For any data protection matters, please use the contact details above.

We only process the data required to run the website and the game server, to ensure fair play and to keep our community safe. For the website, this means:

• No tracking and no analytics: we use no audience measurement and no analytics or tracking services.
• No advertising and no advertising cookies: the few cookies we set are technically necessary (section 4), which is why we do not display a cookie banner.
• No social media plugins and no third-party scripts: no like buttons, widgets or external scripts are loaded.
• No external fonts: fonts and images are served exclusively from our own server.
• One exception: in the player and staff panels, Discord profile pictures are loaded directly from Discord (section 11).

Minimum age: Grand Theft Auto V is rated 18. Our Service is not directed at children; we do not knowingly process data of persons who have not reached the minimum age set out in our Terms of Service.

The website, the database and the game server are operated on servers of OVH GmbH, St. Johanner Straße 41–43, 66111 Saarbrücken, Germany, in data centres within the European Union. A data processing agreement pursuant to Art. 28 GDPR is in place with OVH.

When you access the website, our reverse proxy and web server automatically process technical access data: IP address, date and time of access, page or resource requested, HTTP status code, referrer URL and browser identification (user agent). This data is technically necessary in order to deliver the website and additionally serves the security and stability of operations (e.g. defence against attacks and misuse). Server log files are deleted regularly, at the latest after 14 days, unless a security-relevant incident requires longer retention.

To protect against overload and misuse, we limit the number of requests per IP address (rate limiting). For this purpose, your IP address is held exclusively in the server’s memory, for no longer than 5 minutes.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and stable provision of our Service).

We use exclusively technically necessary, first-party cookies. No tracking, analytics or advertising cookies and no third-party cookies are used. The cookies are either strictly necessary for the sign-in you request or store a choice you have made yourself. Consent is not required for these (Section 25(2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act); for this reason we do not display a cookie banner.

• __Secure-better-auth.session_token: login session for the player and staff panels; only set after you sign in. HttpOnly, Secure, SameSite=Lax. Duration: 7 days; while in use it is extended at most once a day. The cookie is deleted when you sign out.
• __Secure-better-auth.session_data: short-term cache of the session data so that not every page view has to query the database; only set after you sign in. HttpOnly, Secure, SameSite=Lax. Duration: 5 minutes.
• During sign-in with Discord, our authentication system additionally sets short-lived cookies to secure the process (state/CSRF protection); these are no longer used once sign-in is complete.
• ucp_character: stores which of your linked game characters the player panel shows. Duration: 1 year.
• cr_announcement_dismissed: remembers that you closed the announcement banner. Duration: 30 days.

You can delete cookies at any time via your browser settings. Without the login cookie (session_token), signing in to the player and staff panels is not possible; all other pages remain fully usable.

Legal basis: Art. 6(1)(b) GDPR (provision of the player and staff panels after sign-in) and Art. 6(1)(f) GDPR (legitimate interest in a user-friendly design, for ucp_character and cr_announcement_dismissed).

You can only sign in to the player panel (UCP) and the staff panel (ACP) with your Discord account (OAuth2); we do not store a password. In doing so, we receive from Discord your Discord user ID, your username or display name, your profile picture (avatar) and the e-mail address stored with Discord.

In our database (PostgreSQL, operated with the hosting provider named in section 3) we store:

• User account: name, e-mail address, address (URL) of the profile picture, role (e.g. player or staff member) and any suspension of the account,
• Linked Discord account: Discord ID as well as the OAuth access and refresh tokens, encrypted with AES-256-GCM,
• Sessions: session token, expiry time, IP address and browser identification (user agent), for session management, security and prevention of misuse.

Your name and profile picture are synchronised with your Discord account each time you sign in. You can view and end your sessions in the player panel on the “Account” page.

Retention period: We store account data for as long as your account exists; on request we delete it (section 17). Sessions are deleted as soon as they expire or are ended.

Providing your Discord account data is neither required by law nor by contract, but it is necessary in order to sign in; without it, a login is technically not possible.

Legal basis: Art. 6(1)(b) GDPR (provision of the player or staff panel); for security and anti-misuse measures Art. 6(1)(f) GDPR.

In the player panel you only see your own game data (section 7.3). It is matched via your Discord ID: the panel shows the game characters linked to the Discord account you signed in with.

Your own IP addresses are only shown to you in masked form there. Names of staff members, for example on sanctions, are not shown in the player panel.

Legal basis: Art. 6(1)(b) GDPR (provision of the player panel).

To connect to our game server you need FiveM and a Discord account linked in FiveM. For the use of FiveM itself, the privacy provisions of the provider of FiveM apply in addition; we have no influence on that processing.

7.1 Identity and device tokens

When you connect, our server reads the identifiers of your account transmitted by FiveM (including your Discord ID) and your IP address, and creates a player account with the in-game name you chose.

The server also reads device-related hardware tokens provided by FiveM (so-called player tokens) and links them to your player account. This allows us to enforce bans and to prevent banned players from evading their ban with another account.

Legal basis: Art. 6(1)(b) GDPR for sign-in and the player account; Art. 6(1)(f) GDPR for the hardware tokens (legitimate interest in fair play and in protecting our community).

7.2 Anticheat

A server-side anticheat evaluates game events and the synchronised game state in order to detect cheats and manipulation. A small component on your client answers regular check requests from the server (challenge heartbeat).

If the anticheat detects irregularities, it produces evidence. Staff review this evidence before a ban is imposed (section 16).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in fair play, in the security of the server and in protecting our community).

7.3 Game data

For each player and game mode we store:

• Statistics: kills, deaths, streaks, level and experience points (XP) as well as playtime,
• Progress: in-game money and in-game bank balance, inventory and items,
• Customisation: gang membership, character appearance, weapon attachments and vehicle tuning,
• Login sessions: time, server, game mode, duration and IP address,
• Sanctions: warnings, kicks, mutes and bans with reason, time and the issuing staff member, for example for violations of our Rules,
• Packages (perks) with start and end date (section 9).

So that your Discord profile picture can be displayed in game, our server may retrieve it via Discord’s bot interface (API). In doing so, your Discord ID is transmitted to Discord.

Legal basis: Art. 6(1)(b) GDPR (provision of the game); for login sessions with IP address and for sanctions Art. 6(1)(f) GDPR (legitimate interest in the security of the server, in enforcing our rules and in proving sanctions).

7.4 Visibility to other players

Some information is also visible to other players: leaderboards and the in-game “statues” of the top players show your in-game name, your level and your kills. In game, other players also see your in-game name, for example above your character (nametag) and in the kill feed. If you do not want to be recognised, choose an in-game name unrelated to your real name.

Legal basis: Art. 6(1)(b) GDPR (leaderboards and name display are part of the game).

The staff panel is accessible only to our staff members. They process player data there for moderation, for example to review rule violations, to impose or lift sanctions and to assign packages.

Access is tiered by role: administrators see IP addresses and hashes of the hardware tokens; moderators only see IP addresses and e-mail addresses in masked form. Staff members can write internal notes about players, which are visible only to staff.

Every action of a staff member is recorded in an audit log: acting staff member, action, target of the action, details, IP address and time.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in fair moderation, in the traceability of staff actions and in preventing misuse).

Packages (perks for a period of time) are assigned to your player account; we store the package as well as the start and end of the period.

If packages are offered for purchase, the payment service provider named during checkout processes your payment data as its own controller; its privacy notices apply. From it we only receive the information required to activate the package, such as an order or transaction reference, the amount and the package purchased.

Legal basis: Art. 6(1)(b) GDPR (provision of the packages or performance of a contract); for statutory retention obligations Art. 6(1)(c) GDPR.

You can reach us via our Discord server (support) or by e-mail. In doing so, we process the information you provide, such as your Discord name or e-mail address and the content of your message, in order to handle your enquiry. We delete the correspondence as soon as it is no longer required and no statutory retention obligations preclude this.

If you contact us via Discord, Discord’s privacy provisions apply in addition (section 11). For confidential information we recommend contacting us by e-mail.

Legal basis: Art. 6(1)(b) GDPR insofar as your enquiry concerns your user or player account; otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

Community, support and sign-in run via Discord. The platform is provided by Discord Inc., 444 De Haro Street, Suite 200, San Francisco, CA 94107, USA. For the processing of data by Discord itself, Discord Netherlands B.V., Schiphol Boulevard 195, 1118 BG Schiphol, Netherlands, is the controller for users in the European Economic Area; we have no influence on the scope and purpose of that processing. Details: discord.com/privacy.

In the player and staff panels, Discord profile pictures are loaded directly from Discord’s content delivery network (cdn.discordapp.com) in your browser. In doing so, your IP address is transmitted to Discord.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in using Discord for community and support and in displaying Discord profile pictures as required for the functionality).

Personal data is only disclosed in the following cases:

• to our hosting service provider OVH GmbH as a processor (section 3),
• to Discord during sign-in, when profile pictures are loaded and when your profile picture is retrieved for display in game (sections 5, 7.3 and 11),
• to the provider of our e-mail mailbox, insofar as you contact us by e-mail, on the basis of a data processing agreement,
• to the payment service provider named during checkout, insofar as you purchase a package (section 9),
• to other players, insofar as information is visible in game or on leaderboards (section 7.4),
• within our team to the staff members with access to the staff panel, with rights tiered by role (section 8),
• where we are legally obliged to do so (Art. 6(1)(c) GDPR) or where you have given your consent (Art. 6(1)(a) GDPR).

Data is never sold or passed on for advertising purposes.

Our own systems are operated in the European Union. When Discord is used (sign-in, profile pictures, community and support), data may be transferred to Discord Inc. in the USA. Discord Inc. is certified under the EU-U.S. Data Privacy Framework; an adequacy decision of the EU Commission (Art. 45 GDPR) therefore exists for this transfer.

Whether a payment service provider named during checkout transfers data to third countries is set out in its privacy notices.

We only store personal data for as long as is necessary for the respective purpose:

• Server log files: 14 days at the latest, unless a security-relevant incident requires longer retention (section 3),
• Rate limiting: IP addresses for no longer than 5 minutes in memory,
• Website sessions: until the session expires or is ended,
• User account, linked Discord account and game data: for as long as your account exists; on request we delete them (section 17),
• Sanctions: for as long as necessary to enforce and prove the sanction; for bans also beyond the deletion of the account, including the hardware tokens required for enforcement,
• Anticheat evidence, internal notes and audit log: for as long as they are required for moderation, the traceability of staff actions and the investigation of misuse,
• Enquiries: until they have been fully handled, unless statutory retention obligations apply (section 10),
• Cookies: see the respective duration in section 4.

Where statutory retention obligations apply, for example when a package is purchased, we retain the data concerned for their duration and use it during that time for this purpose only (Art. 6(1)(c) GDPR).

The website and the player and staff panels are delivered exclusively in encrypted form via HTTPS (TLS); you can recognise this by the padlock symbol in your browser. In addition, we use technical and organisational measures to protect your data against loss, manipulation and unauthorised access, including security headers, up-to-date software, encrypted storage of Discord tokens, role-based access rights in the staff panel and an audit log of all staff actions. Please note that the transmission of unencrypted e-mail may generally have security vulnerabilities.

Automated decision-making including profiling within the meaning of Art. 22 GDPR does not take place. Our anticheat (section 7.2) produces evidence that staff review before a ban is imposed.

You have the following rights with regard to the personal data concerning you:

• access to the data processed (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdrawal of consent given, with effect for the future, insofar as processing is based on consent (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): Insofar as we process data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you have the right to object to this processing at any time on grounds relating to your particular situation.

An informal message to info@cloudpvp.xyz is sufficient to exercise your rights. Please state your Discord ID or your in-game name so that we can match your data. We answer requests without undue delay, at the latest within one month.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), e.g. with the authority responsible for us: The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

We adapt this Privacy Policy whenever the legal situation, our Service or the technology used changes. The version published here applies in each case; you will find the current status at the top of this page.