DataWiserPrivacy policy
Last updated 26 October 2026
Who we are
DataWiser is a hosted analytics panel for Minecraft servers, at datawiser.net and panel.datawiser.net. It's run by NPS Services, a sole proprietorship (eenmanszaak) registered with the Dutch Chamber of Commerce (KVK) under number 86386034, at Keurenplein 41 Box A1726, 1069 CD Amsterdam, the Netherlands ("DataWiser", "we", "us"). For anything in this policy, email [email protected].
What this policy covers
This policy covers personal data about:
- Account holders: server owners who sign up, and the team members they invite.
- Visitors to datawiser.net.
It doesn't cover the players on your servers. For player data, the server owner decides what is collected and why. They're the controller, and we process it on their behalf under our data processing agreement. If you're a player, contact the server you play on.
What we collect about you, and why
| Data | When we get it | Why | Legal basis |
|---|---|---|---|
| Your name and email address | When you register, or when an owner invites you | To run your account, log you in and send service emails | Contract (GDPR Art. 6(1)(b)) |
| Your password | When you register or change it | To log you in. We store only a hash of it | Contract |
| Two-factor authentication, if you turn it on | When you set it up | To protect your login. The secret and recovery codes are stored encrypted | Contract |
| Your brands, team memberships and permissions | As you use the panel | To show each member only the brands and sections they may see | Contract |
| An invitation: the email address an owner typed, and the permissions offered | When an owner invites you | To let you join their brand | Legitimate interest in letting teams form (Art. 6(1)(f)) |
| Your login session: IP address and browser user agent | While you're logged in | To keep you logged in and to spot misuse of an account | Legitimate interest (security) |
| Your IP address, briefly, in rate-limit counters | When you log in or download the plugin | To slow down password guessing and abuse | Legitimate interest (security) |
| What you set up: brand and server names, server keys, store connections, alert rules, alert email addresses and Discord webhooks | As you configure the panel | To run the service you set up | Contract |
| Billing records from Paddle | When you subscribe, change plan, cancel or pay | To show your plan, invoices and payments, and to apply your plan's limits | Contract |
| Messages you send us | When you email us | To answer you | Legitimate interest in answering questions |
Alert email addresses and Discord webhooks you add may belong to other people. You add them, so make sure they're happy to receive alerts.
What we don't do. There are no analytics, tracking or advertising tools on the panel or the website, and no third-party error tracker. We don't sell personal data, and we don't use it to profile you. We don't send marketing email. If we ever want to, we'll ask for your permission first and update this policy.
Support on Discord. If you ask for help in our Discord server, Discord processes what you post there under its own privacy policy. We only see what you post.
Visitors to the website
The website sets no cookies and uses no fonts, scripts or images from other companies: everything comes from our own server. It reaches you through Cloudflare, which protects it against attacks and keeps copies of its files close to visitors. Like most web servers, ours keeps a short access log of each request (IP address, browser user agent, the page asked for and the time) to keep the site secure and working. We keep these logs for 14 days.
Emails we send
Only emails about your account and the service: confirming your email address, password resets, invitations, the alerts you set up, the notice when your brand goes over its plan's limit and the reminder before its grace period ends, and the notice to team members when a brand's owner has asked to delete their account.
Receipts, invoices and failed-payment emails come from Paddle, not from us.
Who receives it
| Who | Their role | What they receive | Where |
|---|---|---|---|
| Hetzner Online GmbH | Our processor: hosting, database, job queues and backups | Everything in this policy | Germany |
| Resend | Our processor: sending email | Your email address and the email's content | EU region. Resend is a US company, so we rely on the EU-US Data Privacy Framework for any transfer |
| Cloudflare | Our processor: protecting the website and the panel against attacks, and delivering them | Your IP address and the requests your browser sends to datawiser.net and panel.datawiser.net | Its network, at the location nearest to you. Cloudflare is a US company, so we rely on the EU-US Data Privacy Framework for any transfer |
| Paddle | An independent controller, and the merchant of record for our subscriptions | The billing details you give at checkout | Under Paddle's own privacy notice |
| Members of a brand you belong to, with access to its Team section | Your name, email address and the sections you can open in that brand | ||
| Authorities | Only what the law requires us to hand over |
We'll update this list 14 days before we add a new processor.
Paddle
Paddle sells DataWiser subscriptions to you as the merchant of record: it runs the checkout, takes the payment, handles sales tax and VAT, and sends your receipts and invoices. It does this as an independent controller, under its own privacy notice. Paddle never receives any player data.
From Paddle we keep a copy of your Paddle customer ID, name and email address, each subscription's plan and status, and each transaction's invoice number, status, amount, tax, currency and date. We never see your card or bank details.
When your account is deleted, we delete our copy. Paddle keeps its own customer record and invoices, which it needs as the seller and which we can't delete for you. Ask Paddle directly about those.
How long we keep it
| Data | How long |
|---|---|
| Your account: name, email address, password hash, two-factor settings, memberships | Until your account is deleted (see below) |
| Your login session record (IP address, user agent) | Deleted automatically after the session expires, after 2 hours of inactivity |
| Rate-limit counters | About a minute |
| Invitations | Until accepted, or until they expire after 7 days. Expired invitations are deleted daily |
| Failed background jobs, which can include an email being sent | 7 days |
| Our copy of your billing records | As long as your account exists |
| Server and application logs | 14 days |
| Backups of all of the above | 28 days, after which they're overwritten |
Deleting your account
Cancelling your plan isn't deleting your account. Cancelling returns your brand to the free plan and deletes nothing.
You can delete your account in your profile settings, with your password. Here's what happens:
- Straight away: every store you connected is disconnected, every Discord alert channel is deleted, and your servers stop reporting. Each paid subscription is cancelled at the end of its billing period. Your team members are told by email.
- For 30 days you can change your mind: log in, and the request is withdrawn. You'll need to reconnect your stores and Discord channels and resume your subscriptions yourself. If you've forgotten your password, you can still reset it during this time.
- After 30 days everything is permanently deleted, including your brands, their players and purchases, and our copy of your billing records. Any subscription still running is cancelled then.
- 28 days after that, it's gone from our backups too.
If you're a team member and delete your own account, you leave every brand you belonged to. The brands stay with their owners.
If we close an account ourselves (see the terms), it's permanently deleted 90 days after we close it, unless we reopen it before then.
Your rights
Under the GDPR you can:
- See the personal data we hold about you, and get a copy.
- Correct it. You can change your name and email address in your profile settings.
- Delete it, by deleting your account as described above.
- Restrict how we use it, or object to uses based on our legitimate interests.
- Take it with you. Email us and we'll send your data as a JSON file.
Email [email protected] for any of these. We'll answer within one month.
You can also complain to a data protection authority. In the Netherlands that's the Autoriteit Persoonsgegevens. If you live elsewhere in the EU, you can also go to the authority in your own country.
If you're a player: we process your data for the server you play on, so your request belongs with them. If a player's request reaches us, we pass it on to the server owner.
Security
The panel and its data are hosted in Germany and served over HTTPS. Passwords are stored only as hashes, two-factor authentication is available to everyone, and store secret keys are encrypted.
Age
You must be at least 16 to create an account, and at least 18 to buy a paid plan.
Changes to this policy
When this policy changes, we update this page and the date at the top. We'll email account holders about important changes at least 30 days before they take effect.
Cookies
The website sets no cookies. The panel sets only the cookies it needs to work, so there's no cookie banner.
| Cookie | What it's for | How long |
|---|---|---|
datawiser-session | Keeps you logged in. Encrypted, sent only over HTTPS | Until 2 hours of inactivity |
XSRF-TOKEN | Protects forms against cross-site request forgery | Same as the session |
remember_web_* | Set only if you tick "Remember me" when you log in | Up to about 400 days, or until you log out |
Your light or dark theme is stored in your browser, not in a cookie, and is never sent to us. On the panel's Billing page, Paddle's checkout runs under Paddle's own policy and may set its own cookies.