Legal information
Privacy policy
This English version is a translation provided for convenience. In case of discrepancy, the French version prevails.
This policy explains how [TO COMPLETE: company name] (“we”, the “Publisher”) processes personal data in connection with the supermdt.fr website and the SuperMDT service (the “Service”), in accordance with Regulation (EU) 2016/679 (“GDPR”) and the French Data Protection Act no. 78-17 of 6 January 1978.
1. Two different roles
SuperMDT is used by organizations: each one is a roleplay game server that configures its space and invites its members.
- We are the controller for the data needed to manage our customers and your account: sign-in, billing, Service security, support, public website.
- We are a processor for the data organizations have processed in their space: member profiles, game content, data sent by the game server, audit log. For this data, the controller is the organization (its owner), which decides how it is used. We only process it on its instructions, under the data processing agreement. To exercise your rights over this data, contact the organization concerned first; we will help it respond.
2. Who to contact
- Controller: [TO COMPLETE: company name, registered office address]
- Personal data contact: [TO COMPLETE: dedicated email address, for example privacy@supermdt.fr]
- Data protection officer: [TO COMPLETE: name and contact details if a DPO is appointed, otherwise remove this line]
3. Data we process as controller
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Signing you in and managing your account | Discord ID, username, display name, avatar; chosen language; session tokens; organizations you belong to | Performance of the contract (Terms of Use) | While the account is active, then [TO COMPLETE: period, for example 3 years] without sign-in before deletion or anonymization |
| Managing subscriptions, billing and accounting | Name or company name, billing address, billing email address, VAT number, plan, payment history, invoices; Stripe customer ID (never the full card number) | Performance of the contract; legal obligation (accounting retention) | Term of the contract, then 10 years for accounting records (article L. 123-22 of the French Commercial Code) |
| Securing the Service and preventing fraud and abuse | IP address, date and time, browser, pages and functions called, errors; detection of free trial abuse | Legitimate interest (protecting the Service and its users); legal obligation for hosting providers’ identification data | [TO COMPLETE: technical log retention, for example 12 months] |
| Handling support and contact requests | Contact details, content of exchanges, organization concerned | Performance of the contract or pre-contractual steps; legitimate interest | 3 years after the last exchange |
| Handling reports and moderation | Identity and contact details of the reporter, reported content, decision and reasons | Legal obligation (LCEN, Digital Services Act); legitimate interest | [TO COMPLETE: period, for example 2 years after the decision] |
| Informing you about the Service (changes, end of trial, non-payment, termination) | Discord ID, billing email address | Performance of the contract | Term of the contract |
| Establishing or defending legal claims | Data relevant to the dispute | Legitimate interest | Applicable limitation period |
We use no audience measurement, no advertising and no advertising trackers. We never sell or rent any data. We make no decision based solely on automated processing that produces legal effects concerning you.
When you sign in with Discord, we only request the “identify” permission: we do not receive your Discord email address, your server list or your messages.
4. Data we process on behalf of organizations
For each organization, depending on its configuration, we host and process:
- member profiles: Discord identity (ID, username, avatar), service, rank, badge number, assignments, duty sessions, absences, sanctions, fictional pay, and any information the organization adds;
- roleplay content: fictional characters, records, reports, medical and court files, photos, documents; they concern fictional characters and must not contain any real data (see the Terms of Use);
- data sent by the game server (if the bridge is installed): FiveM player identifiers and Rockstar license, character ID, character data (name, fictional date of birth, vehicles, licenses, invoices…); in-game positions are held in memory only, for the live map, and never stored in the database;
- the audit log: who performed which sensitive action, on which item, and when;
- messages sent by the organization’s Discord bot (notifications, direct messages according to your preferences).
These processing operations, their purposes and retention periods are the responsibility of the organization, as controller. When the subscription ends, this data follows the process in the terms of sale: read-only for 14 days, archived for 90 days, then permanently deleted.
5. Recipients and processors
Your data is only accessible to authorized staff of the Publisher, within the limits of their duties, and to organization members according to the permissions those organizations define. We use the following providers:
| Provider | Role | Data location |
|---|---|---|
| OVH SAS (Roubaix, France) | Hosting of the website, application, database and backups | France (European Union) |
| Cloudflare, Inc. (United States) | Storage of photos and files (Cloudflare R2), once in service | [TO COMPLETE: chosen storage region, for example EU jurisdiction]; company subject to US law |
| Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (United States) | Payments and subscription management, once in service; Stripe also acts as controller for its own obligations (fraud prevention, anti-money laundering) | European Union and United States |
| Discord Inc. (United States) | Sign-in (OAuth2); sending messages and managing roles through organizations’ bot | United States |
Discord acts as controller for your Discord account, which is governed by its own privacy policy.
We may disclose data to authorities where required by law.
6. Transfers outside the European Union
Some providers are established in the United States (Discord, Stripe, Inc., Cloudflare) or may access data from there. These transfers are covered, as applicable, by the European Commission’s adequacy decision of 10 July 2023 on the EU–US Data Privacy Framework, for certified companies, or by the European Commission’s standard contractual clauses, supplemented where necessary by additional measures. You can obtain a copy of these safeguards by writing to us. [TO COMPLETE: check each provider’s certification and the applicable transfer mechanism]
7. Security
We implement appropriate technical and organizational measures: encrypted connections (HTTPS), strict isolation of each organization’s data verified by automated tests, permission-based access control, audit log of sensitive actions, soft deletion with restoration, regular backups, in-game positions never stored. Details are in the annex to the data processing agreement.
8. Your rights
You have the rights of access, rectification, erasure, restriction, objection (in particular to processing based on our legitimate interest) and data portability, under articles 15 to 22 GDPR. Under French law, you may also give instructions on what happens to your data after your death.
To exercise them, write to [TO COMPLETE: personal data contact email address]. We reply within one month, which may be extended by two months for complex requests. We may ask you to prove that you own the Discord account concerned.
For an organization’s data (member profile, content, audit log), contact its owner; if you write to us directly, we forward your request to the organization.
If you believe your rights are not respected, you may lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, cnil.fr, or with the supervisory authority of your country of residence.
9. Minors
The Service is intended for people who meet Discord’s age requirements. In France, a minor under fifteen (15) may only use it with the permission of their legal guardian. Subscriptions are reserved for adults or minors authorized by their legal guardian.
10. Cookies and local storage
The website and the Service only use strictly necessary cookies and storage (sign-in session, preferences). See the cookie policy.
11. Changes
We may update this policy. The date of the last update is shown at the top of the page; in case of significant change, we inform you in the Service.