Privacy Policy — Nova Servers

1. General provisions

1.1. This Privacy Policy (hereinafter — "Policy") defines the procedure for collecting, processing, storing, transferring, protecting and deleting personal data of users of the Nova Servers service (hereinafter — "Service"), located at nova-servers.com, and is an integral part of the Terms of Service.

1.2. Personal data processing is carried out in accordance with the Law of Ukraine "On Personal Data Protection", the EU General Data Protection Regulation (GDPR), COPPA and other applicable legislation.

1.3. By using the Service, the User confirms that they have read this Policy and give voluntary consent to the processing of personal data. If the User does not agree — they must stop using the Service.

1.4. The Service Administration acts as the data controller within the meaning of GDPR.

2. What personal data we collect

2.1. When using the Service we collect:

1. Account data: Discord ID, username, email address, avatar URL, role in the system;
2. Authentication data: access and refresh tokens in encrypted form, session state, token expiry;
3. Session data: session token, IP address (encrypted), User-Agent, device information, geolocation at country/city level;
4. Activity data: added servers, votes, reviews, comments, reports;
5. Subscription and payment data: subscription plan, amount, subscription status, promo code. Full card details are not stored;
6. Server statistics: aggregated data for rankings;
7. Notification data: webhook settings, notification schedule;
8. Communication data: messages through feedback forms.

2.2. We do not intentionally or purposefully collect special categories of personal data (racial origin, political views, health status, biometric data).

2.3. The Administration may collect additional technical data to ensure security and prevent abuse.

3. Purposes of personal data processing

We process data for: providing access to the Service, authorization, fraud prevention, security, quality improvement, communication, payment processing and compliance with legal requirements.

We do not use data for automated decision-making or profiling without separate consent.

4. Legal basis for data processing

1. Data subject consent (Art. 6(1)(a) GDPR) — during authorization via Discord OAuth2.0;
2. Performance of contract (Art. 6(1)(b) GDPR) — to fulfil the Terms of Service;
3. Legitimate interests (Art. 6(1)(f) GDPR) — security, fraud prevention;
4. Legal obligations (Art. 6(1)(c) GDPR) — tax law, regulatory requirements.

5. Transfer of data to third parties

We do not sell data. Transfer is only possible to: Discord Inc. (OAuth2.0), hosting providers (EU/Ukraine), payment providers, analytics services (anonymized), authorities (by law), professional advisors.

Data processing agreements (DPA) are concluded with processors in accordance with Art. 28 GDPR.

6. Cookies

The Service uses necessary, analytical and functional cookies. You can manage them in your browser settings. Disabling necessary cookies may limit functionality.

7. Data retention period

1. Account data — for the duration of the account + 12 months after deletion;
2. Server data (description, settings, reviews, statistics, votes, subscriptions) — while the server is on the Service + 30 days after it is removed (deleted in the settings or the bot is removed from the Discord server). If the server is added again within these 30 days, the data is restored; after that it is permanently deleted;
3. Payment data — 7 years (tax law);
4. Technical logs — 12 months;
5. Support communications — 24 months;
6. Cookies — from session to 24 months.

After the period expires, data is deleted or anonymized within 30 days.

8. Your rights

1. Right of access (Art. 15) — obtain a copy of your data;
2. Right to rectification (Art. 16) — correct inaccurate data;
3. Right to erasure (Art. 17) — "right to be forgotten";
4. Right to restriction of processing (Art. 18);
5. Right to data portability (Art. 20);
6. Right to object (Art. 21) and withdrawal of consent (Art. 7(3));
7. Right to lodge a complaint with the Ukrainian Parliamentary Commissioner for Human Rights or an EU supervisory authority.

To exercise rights — Telegram Direct. We will respond within 30 days.

9. Data security

We apply HTTPS/SSL/TLS encryption, restricted access, incident monitoring, password hashing and regular security audits.

10. Protection of minors' data

The Service is for users aged 13 and over. We do not knowingly collect data from children under 13. For ages 13–18 — use requires parental consent.

11–12. International data transfers

Data may be transferred to EU/EEA countries and the USA through Standard Contractual Clauses (SCC) with additional security safeguards.

13. Changes to the Policy

The Administration may modify this Policy. We notify of significant changes 7 days in advance. Continued use of the Service constitutes agreement with the updated version.

14. Contact information

Telegram Support: @novaservers_official

15. Consent to personal data processing

By using the Service, the User confirms they have read the Policy, understands the processing purposes and gives voluntary consent. Withdrawal of consent — via Telegram. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

16. Final provisions

16.1. This Policy is valid indefinitely until replaced by a new version.

16.2. Invalidity of individual provisions does not affect the validity of the rest.

16.3. The Ukrainian version takes precedence.

16.4. Disputes are resolved through negotiations, then in court.