Privacy policy
01Data controller
Mathéo Fourneaux, 284 Rue du Neubourg, 27520, Grand Bourgtheroulde, France. For any question about your data: contact@novastudio.gg.
02What we collect
Your account: e-mail address, display name, and - if you sign in with Discord, GitHub or Google - the public identifier of the account used.
Your subscription: the plan taken out, its dates, and your invoice history. Your bank details never reach us: they are handled by Stripe.
Your server: its configuration, its runtime logs, and the technical measurements needed to operate it.
Framework error reports: when Nova's code hits an error, on your server or in a player's game, the framework automatically sends us a technical report. It carries the error message, the place in the code concerned, the framework version and the state of your server at that moment. When the error happens in a player's game, it also carries that player's game context: their character's job and grade, the model of the vehicle they are in, interior and instance, position rounded to about ten metres, ping, screen resolution and game language, as detailed in the privacy notice for players. It contains no player identity field (name, game licence, Discord identifier, IP address): the game server strips these before sending, and on arrival the site masks the identifiers it recognises in the error text.
Your sign-ins: for each open session, the browser, the operating system and the IP address, kept until thirty days after the session ends, to detect abuse. To warn you of a sign-in from an unknown device, each browser receives a random identifier of which we only keep a fingerprint, with the browser's name and the date it was last seen.
Where you came from: if you reach the site through a tagged link, the creator's or referral code it carries is attached to your account when you sign up, with the date of the click: it is what gives you the advertised discount and what pays the creator or referrer. The link's campaign (its source, medium and name) is never attached to your account, nor sent with the journey steps described in the Cookies section: it only adds one sign-up to that campaign's monthly counter, and nothing at all if your browser asks not to be tracked. Neither the site the click came from nor the landing page is recorded. A click on a creator’s short link (novastudio.gg/c/CODE) only adds one to a counter per code and per day, with no identifier; to limit abuse, your IP address is held in memory, never written, for thirty minutes at most, just long enough to count one click per address. A link without tags leaves no trace.
Our administration logs: actions taken from your account area, with their timestamp and originating IP address.
03Why, and on what basis
To provide the service and perform the contract: account, subscription, server.
To meet our legal obligations: retention of accounting records.
Our legitimate interest: securing the infrastructure, preventing abuse, and keeping a record of administrative actions.
Our legitimate interest in software quality: the framework's error reports let us find and fix its defects.
Our legitimate interest in measuring the traffic of the site and what brings us customers, through counts without any identifier.
Your consent, for marketing messages: Nova new features and offers, and reminders as long as you have not subscribed (the day after and a week after you sign up, and once the day after a payment left pending), by email and by Discord direct message if your Discord account is linked. They are only sent if you ticked the box when signing up or turned on "Nova news" in Settings, never to an account that already has a subscription, and every change is dated in your account log.
04Who else has access
OVH SAS (hébergement des serveurs, France), Cloudflare (sauvegardes chiffrées, Union européenne), Resend (envoi des e-mails), Stripe (paiement et facturation). No other recipient, and no resale of data.
No data is sold, rented, or passed on for advertising purposes.
05For how long
Your account and its server: for the duration of the subscription, then 90 jours after it ends.
Accounting records: the statutory retention period.
Administration logs: 12 mois.
Error reports: the details of each error, 30 jours after our team has dealt with it; until it is dealt with, only its last hundred occurrences are kept. The error's title, a sample of its message and the number of times it occurred are kept with no time limit, without the game context that came with them.
06Your rights
You have the right to access, rectify, erase, restrict, object and to data portability. Write to contact@novastudio.gg: we answer within one month.
You can withdraw this consent at any time, without giving a reason: from Settings, or through the "Stop receiving these messages" link in each marketing email, which works without signing in. Messages about your account, your servers and your billing are not affected.
You can download at any time, from your account settings, a file of what we know about your account. It contains neither your servers' game database nor any secret.
You may also refer the matter to your national data protection authority if you believe your rights are not respected.
07Cookies
The site sets a session cookie, required to keep you signed in, and remembers your language and theme choice as well as the last server opened in your dashboard. On sign-in, a random device cookie recognises a browser already used, so that we can warn you of a sign-in from an unknown device. When you arrive through a tagged link, a thirty-day cookie keeps the link's code and campaign until you sign up, then is deleted. If you tick the box that accepts our messages about offers and news when you sign up, a cookie lasting one hour at most keeps that choice while your account is created (including through Discord, GitHub or Google), then is deleted; unticking the box deletes it at once. If you refuse audience measurement below, or if your browser blocks local storage, a cookie remembers that refusal for thirteen months so that our server respects it too. No advertising or audience measurement cookie is used.
The site counts its traffic with Plausible, a cookieless audience measurement tool hosted by Mathéo Fourneaux: it receives the address of the page viewed (without the identifiers it contains; only the parameters of a tagged link, campaign and creator's or referral code, remain), the site you came from and your browser type. Your IP address is only used, on the same day, to tell visits apart, in a hashed form that is not kept. Our server also sends Plausible, without any identifier, four steps of the journey: sign-up, checkout start, subscription and waiting-list request (the first one for a plan). Each one is sent with the chosen plan and billing period, the reason for the refusal for the waiting list, the creator code if any (from the link followed or from your account), the mere fact of having come through a referrer, and the amount of a subscription; never your email address, your account identifier, your IP address, a referral code or the link's campaign, which is only counted by month: these steps are only counted. The back office is never measured. You can refuse this measurement below, and your browser's "Do Not Track" setting (or Global Privacy Control) is respected, for page views as well as for these steps.