Privacy policy
— дата, от която тази редакция е в сила
Carbon Stealth VCC, ул. „Самуил“ № 3, гр. Бобов дол 2670, обл. Кюстендил, България, 208725180 · privacy@carbonstealth.eu
We have not appointed a data protection officer: the processing does not require regular and systematic large-scale monitoring and does not involve large-scale processing of special categories of data.
What we collect, on what basis, and for how long
- Listing submission: server name, address/cfx code, Discord link, contact email and your note. Basis: Art. 6(1)(b) and (f) GDPR. Retention: 24 months. The email is mandatory — without it we cannot reply, nor send a statement of reasons if the listing is refused.
- Review: rating, text and chosen nickname. Basis: Art. 6(1)(f). We do not ask for a name, email or IP address with a review. Published reviews are kept while the server is listed; rejected ones are deleted after 6 months.
- DSA report: name, email, the content’s address and the explanation. Basis: Art. 6(1)(c) (legal obligation under Regulation (EU) 2022/2065). Retention: 24 months.
- Web server technical log: IP address, time, requested path — for security and diagnostics only, Art. 6(1)(f). Retention: 14 days. This log is not linked to a specific review or submission.
- Admin panel login counter: an IRREVERSIBLE HASH of the IP address (not the address itself), the time and whether the attempt succeeded. Its only purpose is to make the attempt limit per-sender rather than global — a global limit lets one person lock the owner out. Basis: Art. 6(1)(f). Retention: 24 hours, deleted automatically.
Who else sees the data
The server infrastructure provider is in the EU. Outgoing email goes through Resend (Resend, Inc., USA) — so there IS a transfer to a third country, not a hypothetical “if”. Both act as processors under Art. 28 GDPR. The transfer to the USA is based on the adequacy decision under the EU–US Data Privacy Framework or, if the provider is not certified under it, on standard contractual clauses under Art. 46 GDPR; a copy is available on request. We do not sell or share data for advertising.
What we do NOT collect
- No tracking cookies, no advertising pixels, no analytics, no profiling.
- No automated decision-making under Art. 22 GDPR. Every submission, review and report is reviewed by a person.
- We do not read or store the servers’ player lists (players.json) — players’ names and identifiers (Steam, Discord, licence) never reach us. We keep only the total player count.
- We do not publish a listed server’s IP address.
Automatically discovered servers
Some servers in the directory were found in the public Cfx.re list rather than submitted by their owners. The data about them (name, player count, address) is public data about a service, not personal data. A server that does not want to be listed can write to the email below and we remove it.
Reviews and third parties’ data
A review written by a visitor may name an administrator or a player by nickname. We did not obtain that data from the person themselves (Art. 14 GDPR) — we publish it on the basis of Art. 6(1)(f), having weighed the community’s interest in being informed against the interference, and after a manual check. Notifying each named person individually would involve disproportionate effort, in which case Art. 14(5)(b) allows the information to be made publicly available — this section is that information.
Reviews are anonymous and we cannot link an author to an account. If you are an author and want your review deleted, quote the text and the date — we will find the record and delete it (Art. 11(2) GDPR).
Streamers — data we did NOT obtain from you
The “Streamers” page lists channels publicly broadcasting Bulgarian GTA V / FiveM roleplay. Channels are discovered through the official interfaces of Twitch, Kick and YouTube; TikTok offers no public discovery, so those channels are added by hand. A natural person stands behind each channel, so this is personal data not obtained from the data subject — the information required by Art. 14 GDPR is here.
- Categories of data: channel name, display name, channel URL, current stream title, viewer count and the language declared by the platform. All of it is made public by the streamer themselves at the moment of broadcasting.
- Source: the public interfaces of Twitch (helix/streams), Kick (public/v1/livestreams) and YouTube (Data API v3), plus manual entry by us for TikTok.
- Basis: Art. 6(1)(f) GDPR — the community’s legitimate interest in finding Bulgarian roleplay content, and the streamers’ own interest in being found. We process only publicly broadcast professional activity, not private-life behaviour.
- We neither download nor embed profile pictures. The reason is technical and in your favour: an embedded picture makes every visitor’s browser call the third-party CDN, which tells the platform who reads this page.
- Retention: 180 days after the last detected broadcast. For YouTube channels it is 30 days — that is what the platform’s own developer policies allow (III.E.4.d), and they are stricter than ours. Manually added channels (TikTok) are dropped 365 days after our last check. Deletion is automatic, every night.
- No profiling and no automated decision under Art. 22 GDPR. A channel whose language the platform does not declare as Bulgarian is never published automatically — a person reviews it. The current stream title is shown only once a person has looked at the record.
- Data from YouTube comes through the YouTube API Services. By using this page you also agree to the YouTube Terms of Service: https://www.youtube.com/t/terms · Google’s privacy policy applies to Google’s processing: https://policies.google.com/privacy
Why the interest prevails — the assessment, in short
A legitimate interest under Art. 6(1)(f) is an assessment, not a declaration, so here it is. FOR: broadcasting is public professional activity, deliberately made visible, and a list of who streams Bulgarian roleplay serves both viewers and the streamers themselves. AGAINST: the data does not come from the person, this page gathers it in one place, and we submit that page for indexing — which amplifies visibility beyond a streamer’s reasonable expectations (Recital 47). That is why the scope is narrowed to what was publicly broadcast, with no avatars, no profiling and no historical archive of broadcasts, and why removal is unconditional and needs no reason. If you are a minor, tell us — where a child is concerned the balance tips the other way (Recital 38) and we remove the channel immediately.
We do not notify each streamer individually: channels are discovered automatically and we have no contact address for them. The information is instead made publicly available here, which Art. 14(5)(b) permits where individual notice would involve disproportionate effort — and this section exists before the first publication and at every reading of it, i.e. within the period set by Art. 14(3). For manually added channels (TikTok) the derogation is weakest, so there we also try to write personally.
Right to object (Art. 21 GDPR): write to privacy@carbonstealth.eu and the channel is removed within 72 hours on working days, no reason asked. Along with that we keep a minimal SUPPRESSION record — the platform and the channel name only — because without it automatic discovery brings the channel back within 10 minutes. The display name, URL, stream title and viewer count are erased at the moment of removal. The suppression record rests on Art. 6(1)(c) in conjunction with Art. 21(3) (giving effect to the objection itself) and Art. 5(2) (accountability); it is kept for as long as automatic discovery exists.
Separately we keep an audit log of who decided what (action, affected channel, date) — removals included. Basis: Art. 6(1)(c) and (f) (accountability and protection against arbitrary moderation). Retention: 24 months.
Your rights
Access, rectification, erasure, restriction, objection and portability (Art. 15–21 GDPR). You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP, cpdp.bg).