This policy explains what personal data FiveSites processes, why, on what legal basis, who we share it with, how long we keep it and what rights you have. It covers our website, the panel and the game server Sites hosted on FiveSites.
1. Controller
The controller of Account, payment, security and Google Analytics data is VunCode Dawid Barszcz, ul. gen. Władysława Andersa 1 lok. 31, 26-615 Radom, Poland, Tax ID (NIP) 7963050248, REGON 545610245, e-mail: [email protected]. For anything about personal data, contact us at [email protected].
For a Site's Content and the applications Players send through its forms, the Site owner is the controller and we process that data on their behalf (Annex 1 to the terms).
2. What data we process
- Account data: e-mail address, display name, avatar, password hash (Argon2id - we never store the password itself), language, time zone and your two-factor and passkey settings.
- Signing in with Google or Discord: the account ID, e-mail address and name those services share with us.
- Site Content: everything you or your team publish, upload or configure, including images and templates.
- Applications: Players' answers to forms and the Site team's notes, votes and decisions.
- Integrations: Discord server and channel IDs, bot name, webhook addresses and custom domains.
- Billing data: Plan, subscription status, name, billing address, tax ID if you enter one, and sales documents. Stripe collects card details - we never see full card numbers.
- Security data: IP address, browser and time of sign-ins and important actions, kept in sessions and the audit log, plus short-lived attempt counters used to prevent abuse.
- Site visitor statistics (for Site owners): daily page views. We estimate unique visitors with a salted hash that changes every day and is never stored with the IP address. No cookies are used for this.
- Cookie consent: a random browser ID, your choice, the version of the consent text and the dates of changes - so we can show that you gave or withdrew consent.
- Analytics data on FiveSites pages (only with your consent): the browser ID from the _ga cookie, the FiveSites pages you visit, the page you came from, device type, operating system and browser, and an approximate location (country, region, city) that Google Analytics derives from your IP address without storing it.
- Correspondence: messages you send us, such as reports, complaints and support requests.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Running your Account and providing the Service, including Sites, applications and integrations | Contract - Art. 6(1)(b) |
| Paid Plans and payments | Contract - Art. 6(1)(b) |
| Issuing and keeping sales documents | Legal obligation - Art. 6(1)(c) |
| Messages about your Account, applications and payments | Contract - Art. 6(1)(b) |
| Protecting Accounts and Sites, preventing abuse, the audit log | Legitimate interest - Art. 6(1)(f) |
| Handling complaints, content reports and withdrawals | Legal obligation - Art. 6(1)(c) |
| Establishing, pursuing and defending claims | Legitimate interest - Art. 6(1)(f) |
| Recording your cookie choice | Legal obligation - Art. 6(1)(c) with Art. 7(1) |
| Google Analytics statistics on FiveSites pages | Consent - Art. 6(1)(a) |
Giving us data is voluntary, but you cannot create an Account without an e-mail address or buy a paid Plan without billing details. We do not make decisions based solely on automated processing, including profiling, that have legal effects for you. We do not send marketing e-mails without your consent.
5. Transfers outside the EEA
Some providers process data in the United States. We transfer it under the European Commission's adequacy decision of 10 July 2023 for the EU-U.S. Data Privacy Framework where the provider takes part in it, and otherwise under standard contractual clauses adopted by the European Commission. You can get a copy of the safeguards by writing to us.
6. How long we keep data
- Account data: as long as the Account exists. After deletion it leaves our backups within 30 days.
- Content and applications: until the Site owner deletes them or the Site. A Site without a Plan is deleted 7 days after the Plan ends, with its Content and applications. How much application history is visible depends on the Site's Plan.
- Audit log: from 14 days to 3 years, depending on the Site's Plan. Sign-in sessions: 30 days.
- Sales documents and billing data: 5 years from the end of the year in which the tax payment deadline passed, as Polish tax law requires.
- Complaints, reports and correspondence: until the matter is closed, then until claims become time-barred.
- Cookie consent record: 13 months from your last change.
- Google Analytics data: 14 months. The _ga cookies expire after 2 years, or sooner if you withdraw consent.
7. Your rights
You have the right to access your data, have it corrected or erased, restrict its processing and receive it in a portable format, to object to processing based on legitimate interest, and to withdraw consent at any time. Withdrawing consent does not affect the lawfulness of earlier processing. To use these rights, contact us at [email protected]. We reply within one month.
For applications sent to a particular Site, contact its owner first - they are the controller. We will help them respond.
You can change your consent to analytics cookies at any time through the “Cookie settings” link in the footer or in the cookie policy.
You may lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or with the authority in the country where you live.
8. Security
We protect data with encryption in transit, password hashing, encrypted secrets, two-factor sign-in, passkeys, attempt limits, permission checks and an audit log. Custom template code is stripped of JavaScript, and Sites have a Content Security Policy. No system is perfectly secure. If a breach affects you, we will tell you as the law requires.
9. Children
Accounts are for people aged 16 and over. If you believe someone younger has given us data, contact us and we will delete it.
10. Changes to this policy
We publish changes to this policy here with a new update date, and tell you about significant ones by e-mail or in the panel.