Privacy Policy

1. Who we are and what this policy covers

Exylia Licenses (the "Service") is the customer portal for the Minecraft plugins sold by Exylia. It is made of the panel at licenses.exylia.net and the Exylia Discord bot, and lets buyers see their licenses, manage the servers and machines authorised to use them and download the plugin loaders. It is operated by Cristobal Aranda, a natural person domiciled in Chile ("we", "us"). Contact: [email protected].

We are the controller of the personal data described here. This policy covers the people who sign in to the panel or use the bot ("Customers") and the visitors of the panel. It also explains what the plugin loaders send for license checks, because that data is shown in the panel.

Purchases are made on BuiltByBit, which handles the payment, your BuiltByBit account and the purchase record as an independent controller under its own privacy policy. We never receive your payment card or bank details.

2. Data we process

We collect only what the Service needs to work:

• Discord account: when you sign in with Discord or use the bot we receive your Discord user ID, username, display name and avatar. In the panel we request only the "identify" scope: we never receive your email address, your password, your servers or your messages. The Discord access token is used once to read that profile and is not stored.
• Account record: the link between your Discord ID, your customer record at Lukittu (our license provider) and your BuiltByBit member ID, the state of that link, and the dates of your last sign-in and of the last time we matched your identity. We also keep a record of each identity we verified (Discord, BuiltByBit, Lukittu) and when.
• Login sessions: a random session token, stored on our side only as a hash, with its creation and expiry dates, and the IP address and browser user agent from which the session was opened.
• Activity log: a security record of what was done on your account and licenses, such as signing in, matching your identity, revealing or rotating a license key, freeing a machine or server slot, linking an account with a license key, or using a bot command. Each entry has the date, the action, the license or product involved and, for actions in the panel, the IP address of the request. License keys and tokens are never written to it in full.
• Purchase notifications from BuiltByBit: when you buy a plugin, BuiltByBit sends us your BuiltByBit member ID, username and profile URL, and the resource, add-on or bundle, list and final price, renewal and purchase date. We use them to set up your license and to match your account sooner.
• Communications: the messages you send us by email or on our Discord server and our replies.
• Technical data: when you visit the panel, our network provider and our servers process your IP address, browser user agent and the requested URL to deliver the page, protect the Service against abuse (including rate limits) and diagnose errors.
• Usage analytics, only if you accept them in the cookie banner: Google Analytics and Microsoft Clarity receive the pages you visit (URL path and title), the referring page, your device, browser and operating system, your screen size, an approximate location they derive from your IP address, and your clicks and scrolling. Clarity also makes session recordings and heatmaps of how pages are used, with all text inside the panel masked, so your licenses, keys, names and other panel content are not captured.

We do not use the Service to profile you for advertising, we do not show ads, and we do not sell or rent personal data.

3. License data held at Lukittu

Your licenses live at Lukittu, the license service that issues and checks them on our behalf. The panel and the bot read them from Lukittu each time you look, and we do not copy license keys, hardware identifiers or server addresses into our own database. That data is:

• Your customer record: the details of the purchase that created it (which may include your BuiltByBit username and, if BuiltByBit or you provided them, your name and email address), your Discord ID and your BuiltByBit member ID.
• Your licenses: license key, products, creation and expiry dates, limits, status (for example suspended) and last activity.
• License checks: each time a server starts a plugin, its loader contacts Lukittu to check the license. Lukittu records the public IP address of the server (and the country derived from it), a hardware identifier of the machine and the time. This is how the limits on servers and machines are enforced, and you can see and free those slots from the panel or the bot.

When you reveal or rotate a key, or free a slot, the panel or the bot sends that request to Lukittu. When we match your identity, we may add your Discord ID or BuiltByBit member ID to your customer record at Lukittu, so the link survives a sign-in from either side.

4. The Discord bot

The bot answers slash commands (/licenses, /license and /account) and the buttons and forms attached to its replies. Every reply is visible only to the person who used the command.

• Gateway intents: the bot uses only the Guilds intent, which Discord requires to deliver commands in servers. It uses no privileged intent: it does not receive the content of messages, the member list or presence information.
• What it stores: the same account record as the panel (Discord ID, username, display name and avatar, created or updated the first time you use it) and an activity log entry for each command or action. It does not store message content, server member data or anything about the servers it is in.
• Staff commands: Exylia staff can use /grant to issue a license or trial to a Discord user. The bot then sends that user a direct message with the license and the loader.

Removing the bot from a server deletes nothing because it keeps no per-server data. To delete what it stored about you, see section 8.

5. Why we use the data and on what legal basis

• To provide the Service and the licenses you bought: sign-in, matching your purchases to your account, showing and managing your licenses and delivering the loaders. Basis: performance of a contract (GDPR art. 6.1.b) and, in Chile, the contractual relationship and your consent given when you sign in (Law 19.628, arts. 4 and 20).
• To enforce the license terms: checking licenses, applying server and machine limits, and detecting and stopping key sharing, chargeback fraud or other abuse. Basis: performance of a contract and our legitimate interest in protecting our software (GDPR art. 6.1.f).
• To keep the Service secure: sessions, rate limits, the activity log and error diagnosis. Basis: our legitimate interest in running a secure service (GDPR art. 6.1.f).
• To provide support and communicate changes to these terms. Basis: performance of a contract and legitimate interest.
• To comply with legal obligations, such as tax and consumer law, and to respond to lawful requests from authorities. Basis: legal obligation (GDPR art. 6.1.c).
• To understand how the Service is used and improve it, through usage analytics and session recordings, only if you accept them. Basis: your consent (GDPR art. 6.1.a; in Chile, your consent under Law 19.628 and Law 21.719), which you can withdraw at any time with the "Cookies" link in the footer.

We do not make decisions that produce legal or similarly significant effects on anyone solely by automated means. Matches that cannot be made with certainty are left to a person to review, and suspensions for abuse are decided by our staff.

6. Cookies and local storage

The panel sets, without asking, only the cookies it needs to work and those that remember choices you made. Analytics cookies are set only if you accept them in the cookie banner: until you choose, none is set and no analytics script is loaded. There are no advertising cookies.

• __Host-exylia_session: keeps you signed in. 30 days, renewed while you use the panel. Strictly necessary.
• __Host-exylia_oauth: protects the Discord sign-in against forgery. 10 minutes. Strictly necessary.
• NEXT_LOCALE: the language you chose, shared by the Exylia sites. Preference.
• exl_rail and exl_fold: remember the state of the sidebar. Preference.
• exylia_consent: remembers whether you accepted or rejected analytics, for every Exylia site (*.exylia.net). 180 days. Strictly necessary.
• Only with your consent, Google Analytics: _ga and _ga_<id>, which tell visits from the same browser apart. 2 years.
• Only with your consent, Microsoft Clarity: _clck (1 year) and _clsk (1 day), which tie the pages of a visit together, and CLID and MUID (1 year), which Microsoft uses to recognise the browser.
• The theme (light or dark) is kept in your browser's local storage and never leaves your device.

You can change your choice at any time with the "Cookies" link in the footer. If you withdraw your consent, the analytics cookies are deleted and the page reloads without the analytics scripts. The choice applies to every Exylia site and is asked again after 180 days.

Your Discord avatar is loaded from cdn.discordapp.com, so your browser connects to Discord to show it.

7. Who receives the data

We run the panel, the bot and their database on our own servers. We share personal data only with the providers needed to run the Service, each bound by its own data protection terms:

• Lukittu (lukittu.com): issues, stores and checks the licenses, as described in section 3, on our behalf.
• BuiltByBit (builtbybit.com): the marketplace where you buy. It sends us purchase notifications, and when you sign in we ask it which BuiltByBit member, if any, has linked your Discord account.
• Discord Inc. (United States): sign-in with Discord and the bot.
• Cloudflare, Inc. (United States; global network): DNS, TLS and network protection. All traffic to licenses.exylia.net passes through Cloudflare.
• Google LLC (United States): Google Analytics, only if you accept analytics. Advertising features and Google Signals are off, and the data is not used for ads.
• Microsoft Corporation (United States): Microsoft Clarity, only if you accept analytics, with the panel content masked.

Exylia staff see the data of the Service to give support, review identity matches and handle abuse. We may disclose data when required by law or by a court or competent authority, and to defend our legal rights, for example in a chargeback dispute.

8. How long we keep data

• Account record and verified identities: while you hold licenses or use the Service. There is no self-service deletion yet: write to [email protected] and we will delete your account within 30 days.
• Login sessions: until they expire (30 days without use) or you sign out; the records, with their IP address and user agent, are deleted 7 days later.
• Activity log: kept as a security and dispute record, with no automatic expiry at present. When we delete an account, we delete or anonymise its entries, except those we must keep for an open dispute, a chargeback or a legal claim.
• Purchase and license notifications from BuiltByBit and Lukittu: kept as a record of what was delivered to us, with no automatic expiry at present; deleted on request together with your account, with the same exceptions.
• License data at Lukittu: while the license exists, and afterwards for as long as needed to handle disputes, chargebacks and our legal obligations. Freed server and machine slots are marked as forgotten in the panel. Deleting your account does not delete your licenses; if you also want your customer record removed, say so in your request, knowing that its licenses will stop working.
• Technical logs: for a short operational period; they are not archived.
• Usage analytics: Google Analytics keeps it for 14 months and Clarity keeps session recordings for 30 days, after which those providers delete it. Withdrawing consent stops any further collection.
• Messages with us: as long as needed to handle the matter and for up to 2 years afterwards, unless the law requires longer.

Backup copies of the database, where they exist, are rotated, so deleted data disappears from them when they are overwritten.

9. International transfers

Our servers are in Chile, and some providers in section 7 are in the United States or other countries. When data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on our providers' safeguards, such as the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses. Google LLC and Microsoft Corporation, which receive the analytics data only if you accept it, are certified under the EU-U.S. Data Privacy Framework.

10. Security

We protect data with measures appropriate to the risk, including:

• Encryption in transit (HTTPS/TLS) for all traffic to our domains.
• Session tokens stored only as hashes, sessions revoked on sign-out, and sign-in protected against forgery.
• License keys, hardware identifiers and server addresses kept only at Lukittu, not in our database, and masked in our logs.
• Every request checked against the licenses your account owns, the same way in the panel and the bot; actions on licenses rate-limited and recorded.

No system is completely secure. If a personal data breach occurs, we will notify affected Customers without undue delay, and the competent authority where the law requires it.

11. Your rights

Depending on where you live, you have the right to access your data, rectify it, erase it, restrict or object to its processing, receive it in a portable format and withdraw any consent you gave (for analytics, with the "Cookies" link in the footer), without affecting earlier processing. In Chile, Law 19.628 grants the rights of access, rectification, cancellation and blocking, and from Law 21.719 taking effect also objection, portability and the right not to be subject to automated decisions.

To exercise them, write to [email protected] from a channel that lets us confirm your identity (we may ask you to confirm through your Discord account). Data about your purchase held by BuiltByBit is handled by BuiltByBit: ask it directly. We will answer without undue delay and within the time the applicable law allows (under the GDPR, one month, extendable where necessary).

You can complain to a data protection authority: in the European Union, the authority of your country of residence or work; in Chile, the Personal Data Protection Agency created by Law 21.719 once it is operating, or the courts under Law 19.628. We would appreciate the chance to resolve your concern first.

12. Minors

The Service is intended for people who are at least 18 years old or of legal age where they live, or who buy with the authorisation of a parent or guardian where the law allows it. We do not knowingly collect data from children under 14, and we will delete it if we learn that we did.

13. Changes and contact

We will update this policy when the Service or the law changes, and show the date of the latest version at the top. If a change materially affects how we use personal data, we will announce it in the panel at least 30 days before it applies.

Questions or requests: [email protected].