Privacy Statement

We value your privacy and aim to collect only the minimum information necessary to provide a secure and functional experience.

1. Data Controller

The data controller responsible for this service is Valheim Roleplay.

If you have questions about this policy or wish to exercise your data rights, you may contact us through our ticket system at any time.

2. Data We Collect

2.1 Discord Identity

When you log in through Discord authentication, we receive limited profile data including:

• Discord ID
• Username
• Avatar
• Email Address

We store your Discord ID and username as your primary account identifier. Your avatar is used only for display purposes while logged in and is not permanently stored. Your email address may be transmitted during the authentication process but is not stored by our service and is not accessible to staff.

2.2 Steam Identity

Upon connection to our servers we collect and store your Steam ID in connection with your user identity.

2.3 Access Logs

To maintain security and prevent abuse (such as ban evasion or DDOS attacks), we may log IP addresses, request timestamps, and basic connection metadata. This information is strictly controlled, accessible only by senior technical staff, and purged regularly.

3. How We Use Your Data

• Authentication: To verify your identity via Discord.
• Community Management: To link applications and moderation actions to the correct user.
• Security: To protect the community from fraud and unauthorized access.

4. Legal Basis for Processing

Under the GDPR, we process data based on:

• Performance of a contract: To provide authentication and service access.
• Legitimate interests: To maintain security and administer the community.

5. Data Sharing

We do not sell or rent your personal data. Information is only used internally or disclosed if required by law. Discord processes your information according to its own privacy policy during the OAuth process.

6. Data Retention

Discord IDs and usernames are stored while your account is active. Access logs are typically retained for up to 30 days.

7. Your Data Protection Rights

Regardless of location, we honor the following rights:

• Request access, correction, or deletion of your data.
• Request restriction of or object to processing.
• Request data portability.

Note: Deleting your data will result in a loss of access to the system until consent is provided again.

8. International Data Transfers

Your aforementioned data is stored on servers provided by DigitalOcean in the United States. DigitalOcean is certified under the EU-U.S. Data Privacy Framework, which allows for the legal transfer of EEA personal data to the US. In addition, our agreement with DigitalOcean incorporates Standard Contractual Clauses (SCCs) as a secondary safeguard to ensure your data remains protected according to GDPR standards.