Last updated: 24 May 2026. This policy explains what personal data Ecstacy Anticheat ("we", "the Service")
processes, on what legal basis, for how long, and the rights you have under the EU General Data Protection
Regulation (GDPR). We follow a data-minimisation approach and only process what is required to operate the
Service.
In short
There are two different kinds of person in this policy and the rules
differ for each. For customers, the people who buy a licence, we are
the controller. For players on a server running Ecstacy, the server
owner is the controller and we only process on their instructions.
From customers we hold a Discord ID, an email, plan and billing status,
and licence keys only as irreversible hashes. Tax records are kept 10 years because
Italian law requires it.
From players we process UUID, username and gameplay behaviour, to
attribute a detection to an account. Usernames and UUIDs are kept readable on purpose:
staff cannot action a detection against an anonymous identifier.
We do not receive players' IP addresses in clear text. For the
alternative-account fingerprint feature, the server sends us an encrypted and
irreversible form of a player's IP address or subnet. We cannot read the original
address from it and use it only to recognise the same network across accounts — never to
identify or locate a player. The server's own address and hardware identifier are also
collected, to stop licence sharing. That is the server, not the people on it.
We never see your card details. Stripe handles payment and VAT as an
independent controller.
Detection data may be used to improve the models. Nothing here makes an
automated decision with legal effect about a customer.
Analytics cookies are only set after you accept the banner, and you can
withdraw that at any time. There is no advertising or cross-site tracking.
You can access, correct, export or delete your data. For customer data,
write to us. For player data, ask the server owner. We assist them as processor.
This summary is provided for readability only. It has no legal
effect. The numbered sections below are the policy that applies, and where the two differ,
the sections govern.
1. Who Processes Your Data & Two Distinct Roles
The Service is operated by Simone B. (the "Operator"), contactable at
support@ecstacy.ac. We act in two different legal capacities
depending on whose data is involved:
As Data Controller: for the data of our paying customers (the people who buy a
licence and use the dashboard).
As Data Processor: for the data of in-game players on servers that run Ecstacy. The
server owner who installs Ecstacy is the Data Controller for their players; we process that data only
on their behalf and on their instructions, under a Data Processing Agreement.
2. Customer Data (we are Controller)
Account: Discord User ID and username (via Discord OAuth2), email address, and an
optional 2FA secret. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
Licence & subscription: licence keys (stored only as irreversible hashes), plan
configuration, the IP addresses/ranges you whitelist for your own API key, and the country you declare
at checkout. Legal basis: performance of the contract.
Billing: payment status, amounts and transaction identifiers. Card and bank details
are never seen or stored by us. They are handled solely by our payment provider (see
section 5). Transaction records are retained for 10 years as required by Italian tax
law (art. 2220 Civil Code). Legal basis: legal obligation (Art. 6(1)(c) GDPR).
3. Player Data (we are Processor on behalf of the server owner)
When Ecstacy runs on a Minecraft server it processes data about the players connecting to that server, for
the sole purpose of detecting cheating:
Player Minecraft UUID and username: processed and stored in cleartext. They are used
to attribute detections to an account and are visible only to the server's authorised staff through the
dashboard. We do not pseudonymise these values, because staff need to identify the player to action a
detection.
Behavioural gameplay data (movement, rotation and packet-timing features) and the
resulting detection records and machine-learning model scores.
Server connection data: the IPv4/IPv6 address and hardware identifier of the
server running Ecstacy, used to prevent licence abuse and leakage. For the
alternative-account fingerprint feature we additionally receive a player's IP address or subnet in
encrypted, irreversible form: the original address cannot be recovered from what we
store, and we use it solely to recognise repeat networks behind multiple accounts — never to
identify or locate a player. Raw player IP addresses remain on the server side and are accessible
only to the server's own staff.
Legal basis: the legitimate interest of the server owner in keeping their server free of cheating
(Art. 6(1)(f) GDPR), exercised by us under their instructions as Processor.
Retention: raw behavioural records are kept for a limited period and then deleted or
aggregated; detection records flagged for human review are kept while the review is open. Where a player is
a minor, the server owner remains responsible for any consent or notice required toward the player and
their guardians.
4. Machine-Learning Training
Detection records and behavioural data may be used to train and improve our cheat-detection models. Records
used for training retain the player UUID so that samples from the same session can be grouped correctly.
Models are not used to make legally significant automated decisions about customers.
5. Third Parties & Payments
Payments are processed by Stripe as the payment provider. Stripe handles your card or
bank details and the applicable VAT, and is an independent data controller for that transaction.
We never store or have access to your full card number or bank details.
We also rely on Cloudflare (CDN, DDoS protection and bot mitigation) and our EU-based hosting provider.
We do not sell, rent or trade your personal data.
6. Cookies & Analytics
We use strictly necessary cookies to keep you logged in to the dashboard. We also use Google Analytics
(gtag) to measure aggregate site usage; Google Analytics sets analytics cookies, which are
not strictly necessary and are only set after you consent via our cookie banner. You can
withdraw consent at any time. We do not use advertising or cross-site tracking cookies.
7. Your Rights (GDPR)
You have the right to access, rectify, erase, restrict or port your personal data, and to object to
processing. For data about your customer account, contact us at
support@ecstacy.ac or via a ticket on our Discord. For data about a
player on a specific server, the server owner is the controller. Direct your request to them, and
we will assist them as Processor. Note that deleting your customer account will terminate your active
licences. You may also lodge a complaint with the Italian Data Protection Authority (Garante per la
protezione dei dati personali).