1. Data controller
The controller of your personal data is the company below. This notice is written for Article 10 of Türkiye's Personal Data Protection Law no. 6698 (KVKK) and Article 13 of the EU General Data Protection Regulation (GDPR).
- E-mail
- info@talerift.net
Tebex is the controller of what you give Tebex during payment (section 4).
2. What data, why, and for how long
There are no advertising or analytics tools on the site or the panel. We handle your data for the following:
- Account
Your e-mail address, a hash of your password (Argon2id; we don't store the password itself), your language, whether your address is verified, when you registered and last signed in, and the reason if your account was suspended.
Why: to open your account, let you sign in and send e-mails about the service. Basis: forming and performing the contract.
How long: as long as your account exists. It is deleted at once when you delete your account; only the account number and dates remain. The record of what our team did with an account also stays, under the account number.
- Sessions
The IP address and browser details you signed in with, when you signed in and when you last used the session.
Why: to show you your open sessions, notice an account takeover and warn you about a sign-in from a new device. Basis: legitimate interest in data security.
How long: deleted at most 30 days after last use, and at once when you close the session or delete your account.
- Your servers
Your server's name, description and settings, your world, the files you upload, console and game logs, backups, and performance measurements (CPU, memory, disk, player count, tick time).
Why: to provide the service and solve problems. Our team can access the console and files when needed. Basis: performing the contract.
How long: as long as the subscription lasts. Deleted 7 days after the period ends if you cancel, on day 37 if payment fails, at once on a 72-hour refund, and within 24 hours at the latest if you delete your account. The record of a deleted server stays hidden for 30 more days. Performance measurements are kept for 48 hours.
- Players who connect to a server
When a player connects, their player name and IP address can go into our connection logs, and their player name and chat into Minecraft's own log files. The game server doesn't see the player's real IP address; the server's owner can see their name and chat. This also applies to players without a Talerift account.
Why: to prevent abuse and solve connection problems. Basis: legitimate interest.
How long: connection logs for 30 days, the game's log files until they are deleted with the server.
- Payment records
Tebex's transaction and subscription numbers, the plan, amount, currency, dates and the invoice copies you see in the panel. If you entered billing details in the panel, your name, address and tax number. Your card details never reach us.
Why: to run your subscription, make refunds and keep accounting and tax records. Basis: performing the contract and legal obligation.
How long: even if you delete your account, they stay for as long as tax and commercial law require (Turkish Tax Procedure Law art. 253, Commercial Code art. 82; up to 10 years). Billing details you entered in the panel are deleted with your account; the copy on documents already issued remains.
- Consent records
The versions of the documents you accepted at checkout, when you accepted them, your instant performance consent, and your IP address and browser details at that moment.
Why: to prove that we informed you and got your consent. Basis: legal obligation and protecting our rights.
How long: the versions, the time and the consent stay for the legal period. The IP address and browser details are deleted when you delete your account.
- E-mails
Your address and the content of the e-mails we send you. We send only e-mails about the service: account, payment, server and security notices. We don't send marketing e-mails.
Why: to provide the service and keep you informed. Basis: performing the contract.
How long: the sending record for 7 days. If a mail server permanently rejects your address, only a hash of it is kept for 180 days, so that we don't send to it again.
- Support messages
What you write to info@talerift.net.
Why: to solve your problem. Basis: performing the contract.
How long: until the problem is solved and the period for a possible dispute has passed.
- Technical records and backups
Request logs (IP address, account number, request number, time), event records between our services, short-lived caches and database backups.
Why: to run the service, debug, look into security incidents and protect against data loss. Basis: legitimate interest.
How long: request logs for 30 days, tracing data for 14 days, event records and caches for at most 7 days. Database backups for 30 days; the data of a deleted account can stay in backups until the oldest one expires.
3. How we collect your data
From what you enter when you register and use the panel, automatically when you connect to the site or a game server, and from the payment notices Tebex sends us. We keep no customer details from Tebex: the transaction and subscription number, the amount and the status are enough.
4. Who we share it with
- Tebex
The seller that takes the payment, and a separate controller of the data it handles. When a payment starts, we send Tebex your IP address, a generated username (starting with "cbs") and your account and subscription numbers. We don't send your name or e-mail; you enter those and your card details on Tebex's page yourself.
Tebex Limited is based in the United Kingdom (England and Wales, company number 08129184). The details are in Tebex's privacy policy.
- E-mail provider
- Hostinger International Ltd. (Cyprus). It delivers our e-mails and sees your address and their content.
- Hosting
- The site, API and databases: netcup GmbH (Germany). Game machines: netcup GmbH (Germany); your server runs in the location you chose (Istanbul or Frankfurt).
- DNS
- Cloudflare, Inc. (USA). Your server's address is a public record and contains the server's name (for example
survival-k3x9.mc.talerift.net). Don't give your server a name with personal information in it. - Have I Been Pwned
- We check whether a new password appears in known breaches. Only the first 5 characters of the password's hash go to this service; your password and e-mail do not.
- Mojang and Microsoft
- If premium account verification is on for your server, players who join are verified through Mojang.
- Authorities
- Courts and competent public authorities, where the law requires it.
Some of these are outside Türkiye: Tebex is in the United Kingdom, and the game machines in Frankfurt are in Germany. These transfers are made in line with Article 9 of KVKK.
5. Your rights
Under Article 11 of KVKK you can:
- find out whether your data is processed, for what purpose and who it is transferred to;
- ask for incomplete or wrong data to be corrected, for it to be deleted where the conditions are met, and for the recipients to be told;
- object to a result against you that comes solely from automated analysis;
- ask for compensation if you are harmed by unlawful processing.
If you live in the EU, you also have the GDPR rights of access, correction, erasure, restriction, portability and objection. We don't make automated decisions about you or profile you.
You can download your account details and sessions as a JSON file in the panel, and delete your account there. For anything else, write to info@talerift.net from your account's address, or apply to the address or KEP address in section 1. We answer free of charge within 30 days at the latest. If you aren't satisfied, you can apply to the Turkish Personal Data Protection Board, or in the EU to your country's supervisory authority.
6. Cookies
The site and these pages set no cookies. We don't use advertising or analytics cookies. Cookies are used only once you sign in to the panel, for your session:
cbs_rt- Session cookie: so that reloading the page doesn't sign you out. It lasts 30 days, renews on each use and is deleted when you sign out.
cbs_dev- Known device cookie: so that you aren't locked out while someone else tries your password, and so that we can warn you about a sign-in from a new device. It holds your account number and a random device number. It lasts 365 days.
Both go only to our API address and can't be read by JavaScript. They are strictly necessary for the service to work and stay secure, so we don't ask for consent. If you delete them in your browser, your session ends. The panel's access token stays only in the memory of the open page. The payment page is Tebex's; cookies there are subject to Tebex's policy.
7. Security
Passwords are hashed with Argon2id, only hashes of session and e-mail link tokens are stored, the site and API run over HTTPS, and game servers run in containers isolated from each other.
8. Children
We don't ask your age. To pay, Tebex's terms require you to be at least 16; anyone under 18 should use the service with permission from a parent or guardian. If you think a child's data is being handled without permission, write to us.
9. Changes
If we change this notice, we publish it here with its new date. We tell you about important changes by e-mail.