This policy explains what personal data GameAP Cloud collects, why, on what legal basis, and what rights you have. It is written to meet Articles 13 and 14 of the General Data Protection Regulation (GDPR) and the equivalent provisions of the UK GDPR.
1. Who is responsible for your data
The controller is Individual Entrepreneur Nikita Kuznetsov, Sole proprietor registered in the Republic of Armenia, TIN 23378307, state registration number 278.1340665, registered at Yerevan, Republic of Armenia.
Contact for any privacy matter: support [at] gameap.cloud.
We have not appointed a Data Protection Officer; we are not required to. Privacy questions go to the address above.
2. What we collect
Account data. Your name (if you provide one) and email address. If you sign in through GitHub, Google or Discord, we receive the account identifier and the email address associated with it.
Connected installation data. The web address (URL) of the GameAP installation you connect, so that the Service can reach it and verify that you own it when the installation registers.
Country. The country you give at registration or that follows from your billing details. We use it to work out which terms and taxes apply to you.
Subscription and billing data. Which services you have enabled, plan, period, and the payment records and invoice references we receive from our merchant of record.
Support data. The content of messages you send us and our replies.
Technical data. IP address, date and time of requests, browser and operating system information, and server log entries generated when you use the site or the dashboard.
Cookie data. See our Cookie Policy.
3. What we do not collect
- Card details. Payments are handled by our merchant of record, Polar Software Inc.. Card numbers are entered on their side and never reach us.
- The contents of your backups. Backup data is encrypted before it leaves your machine with a key held only by you. We can see how much storage you use and when snapshots were taken; we cannot read what is in them.
- Special categories of data. We do not knowingly collect data revealing health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, or data concerning sex life or sexual orientation.
- Children’s data. The Service is not directed at people under 16.
4. Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account; providing the services you subscribe to | Performance of a contract — Art. 6(1)(b) |
| Connecting your GameAP installation and verifying that you own it | Performance of a contract — Art. 6(1)(b) |
| Determining the terms and taxes that apply to you, from your country | Performance of a contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c) |
| Billing, invoicing and handling refunds | Performance of a contract — Art. 6(1)(b) |
| Sending service messages: outages, maintenance, expiry and payment notices, changes to terms | Performance of a contract — Art. 6(1)(b) |
| Answering support requests | Performance of a contract — Art. 6(1)(b) |
| Keeping the Service secure, preventing abuse, investigating incidents | Legitimate interests — Art. 6(1)(f): running a secure service |
| Keeping accounting and tax records | Legal obligation — Art. 6(1)(c) |
| Analytics cookies | Consent — Art. 6(1)(a), withdrawable at any time |
| Marketing emails, if you opt in | Consent — Art. 6(1)(a), withdrawable at any time |
We do not use automated decision-making or profiling that produces legal or similarly significant effects.
5. Who we share it with
We do not sell personal data. We share it only with the providers we need to run the Service, and only to the extent necessary:
- our merchant of record and payment provider, for taking payments and issuing invoices;
- our hosting provider, for running the Service;
- our email delivery provider, for sending service messages;
- professional advisers and authorities, where the law requires it.
The current list, with each provider’s role and location, is published at Sub-processors.
6. International transfers
Your data is stored in the European Union. Our infrastructure runs on Hetzner Online GmbH, Falkenstein data centre, Germany, so account data and backup contents stay on servers inside the EEA.
We ourselves are established in the Republic of Armenia, which is not covered by a European Commission adequacy decision. A transfer outside the EEA therefore occurs when we access that data from Armenia to operate and support the Service.
Those transfers are made under the Standard Contractual Clauses adopted by the European Commission (and the UK International Data Transfer Addendum for UK data), supplemented by the technical and organisational measures described in clause 8. You may request a copy of the clauses by writing to support [at] gameap.cloud.
7. How long we keep it
| Data | Retention |
|---|---|
| Account data, connected installation address and country | For as long as the account exists, plus 30 days after deletion |
| Subscription, invoice and payment records | As required by tax and accounting law |
| Support correspondence | 1 year after the last message |
| Server logs and technical data | 6 months |
| Backup contents | Until you delete them, or 30 days after the account is closed |
When a retention period ends, data is deleted or irreversibly anonymised.
8. How we protect it
- encryption in transit (HTTPS) for all traffic to the site, the dashboard and the API;
- client-side encryption of backup contents, with keys we never hold;
- passwords stored only as irreversible hashes;
- access to production systems limited to the people who need it, protected by multi-factor authentication;
- logging of access to systems that hold personal data, and regular backups;
- an incident procedure that includes notifying the competent supervisory authority within 72 hours where the law requires it, and notifying you without undue delay where an incident is likely to result in a high risk to you.
9. Your rights
If you are in the EEA or the UK, you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have data erased where there is no longer a lawful reason to keep it;
- restrict processing while a dispute about accuracy or lawfulness is resolved;
- receive the data you gave us in a portable, machine-readable format, and have it transmitted to another controller where technically feasible;
- object to processing based on our legitimate interests;
- withdraw consent at any time, where processing is based on consent — this does not affect processing carried out before the withdrawal.
To exercise any of these rights, write to support [at] gameap.cloud from the address registered to your account. We respond within one month and may extend that period by two further months for complex requests, telling you why.
You also have the right to lodge a complaint with a supervisory authority — in the EEA, the authority of your habitual residence, place of work or the place of the alleged infringement; in the UK, the Information Commissioner’s Office (ico.org.uk).
Users in Armenia may address the Personal Data Protection Agency of the Ministry of Justice of the Republic of Armenia.
10. Cookies
The site sets only what is necessary for it to work, unless you accept analytics cookies in the banner. Details are in our Cookie Policy.
11. Changes to this policy
We may update this policy. The current version is always at https://gameap.cloud/legal/privacy.html. Where a change materially affects how we handle your data, we will notify you by email or in the dashboard before it takes effect.
Version 1.0, 30 August 2026.