Privacy Policy.

This Privacy Policy explains how Phantom ("we", "us", "our") collects, uses, stores, and shares information about you when you use the Phantom platform, including the website, web dashboard, and desktop client (collectively, the "Service"). Please read this policy carefully. By using the Service, you acknowledge that you have read and understood this policy.

1. Data Controller

Phantom is the data controller for personal data collected through the Service. If you have questions about this policy or wish to exercise your data rights, please contact support@phantomafk.com, the official Discord server, or the in-dashboard contact form.

2. What We Collect

We collect the following categories of personal data:

• Account data: your email address and bcrypt-hashed password, collected at registration and used to identify your account and send transactional notices.
• Security and audit data: IP address and User-Agent string, captured on login and significant account actions for security monitoring.
• Bot configuration data: Minecraft usernames, server hostnames, and ports you configure within the Service.
• Microsoft OAuth tokens (encrypted at rest): access and refresh tokens issued by Microsoft when you link a premium Minecraft account. These are encrypted with AES-256-GCM before storage. Your Microsoft password is never transmitted to or stored by Phantom.
• Optional integrations: Discord user ID and/or webhook URL, collected only if you choose to link Discord or enable Discord notifications.
• Event and audit log data: timestamped records of bot connections, disconnections, commands issued, and other significant actions associated with your account.
• Billing data: your subscription tier and billing history. Payment card details are processed by Stripe and are never transmitted to or stored by Phantom.
• Usage data: aggregate, non-identifying usage statistics such as feature interaction patterns, error rates, and performance metrics.

We do not knowingly collect sensitive personal data such as government identification numbers, health information, or financial account numbers (other than what Stripe handles directly).

3. How We Use Your Data

We use your personal data for the following purposes:

• To create and maintain your account and provide the Service;
• To authenticate your Minecraft accounts and operate your bots on your behalf;
• To send transactional communications (billing receipts, service alerts, security notifications);
• To detect, prevent, and investigate security incidents, abuse, and fraud;
• To comply with our legal and regulatory obligations;
• To improve the reliability, performance, and features of the Service.

We do not sell your personal data. We do not share your personal data with third parties for marketing or advertising purposes.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area ("EEA"), United Kingdom, or Switzerland, we process your personal data under the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR): processing your account data, bot configuration data, and Microsoft OAuth tokens is necessary to provide the Service you have contracted for.
• Legitimate interests (Art. 6(1)(f) GDPR): processing IP addresses, audit logs, and usage data is necessary for our legitimate interests in maintaining the security, integrity, and performance of the Service, provided these interests are not overridden by your rights.
• Legal obligation (Art. 6(1)(c) GDPR): retaining billing records as required by applicable tax law.
• Consent (Art. 6(1)(a) GDPR): where we seek your consent for specific optional processing activities (such as Discord integration), you may withdraw that consent at any time from the dashboard.

5. Data Sharing and Sub-Processors

We share personal data only with service providers needed to operate features you use. Depending on the deployment and features enabled, those providers include:

• Stripe, Inc. — payment processing. Stripe receives your billing information directly; we never handle your card details. Stripe is certified to PCI DSS Level 1. See stripe.com/privacy.
• Hetzner Online GmbH and Cloudflare, Inc. — application hosting, network delivery, DNS, and DDoS protection.
• Backblaze, Inc. and an optional S3-compatible storage provider — client-side encrypted database backups and, when configured, short-lived event-log archives. The event archive may use Cloudflare R2 or another S3-compatible service.
• Resend, Inc. — delivery of transactional account, billing, and security email.
• Discord, Inc. — account linking and notifications only when you enable a Discord integration.
• Google LLC and Cerebras Systems, Inc. — AI-assisted script or sequence generation only when you invoke an AI feature. The prompt needed for that request is sent to an available provider.
• Functional Software, Inc. (Sentry) — application error diagnostics when error monitoring is enabled.
• Microsoft Corporation — OAuth 2.0 authentication provider for Minecraft accounts. See privacy.microsoft.com.

We do not disclose your personal data to any other third party except: (a) with your explicit consent; (b) where required by applicable law or regulation; (c) to comply with a valid legal process such as a court order or government request; or (d) to protect the rights, property, or safety of Phantom, its users, or the public.

6. International Data Transfers

Phantom may process and store your data in countries outside your country of residence, including the United States. Where we transfer personal data from the EEA, United Kingdom, or Switzerland to a country that has not been deemed to provide an adequate level of data protection, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission or the UK Information Commissioner's Office.

By using the Service, you acknowledge that your data may be transferred to and processed in countries outside your own.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy, to provide the Service, or as required by law.

Audit-log retention by plan tier:

• Free: 7 days
• Trial / Pro: 30 days
• Custom: 1 year

Searchable bot event logs are retained in the primary database for 24 hours. When an event archive is enabled, its storage lifecycle must delete archived objects within 30 days. Encrypted database backups are also retained for no more than 30 days.

Account deletion removes account-owned data from the active Phantom database immediately. Residual copies in encrypted backups expire within 30 days. Stripe, as the payment processor, may retain payment and tax records where required by law under its own retention policy.

8. Security

We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, loss, disclosure, or destruction, including:

• AES-256-GCM encryption for sensitive data at rest;
• TLS encryption for all data in transit;
• Bcrypt hashing for passwords (we never store plaintext passwords);
• HttpOnly, Secure, SameSite session cookies;
• Rate-limited authentication endpoints;
• Comprehensive audit logging of all significant account actions.

No method of transmission or storage is 100% secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and any applicable supervisory authorities as required by law.

9. Cookies

We use only HttpOnly, Secure, SameSite cookies that are strictly necessary to authenticate dashboard sessions, rotate session credentials, and protect forms against cross-site request forgery. These cookies are essential for the Service to function.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies. We do not respond to Do Not Track ("DNT") signals, as we do not engage in cross-site tracking to which DNT would apply.

10. Your Rights

Depending on your location, you may have the following rights with respect to your personal data. To exercise any of these rights, please contact us via the dashboard or our Discord server.

EEA, UK, and Switzerland (GDPR/UK GDPR)

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your personal data where there is no legal basis for continued processing.
• Right to restriction — request that we restrict processing of your data in certain circumstances.
• Right to data portability — receive your personal data in a structured, commonly used, machine-readable format.
• Right to object — object to processing based on legitimate interests or for direct marketing (we do not engage in direct marketing).
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint — you have the right to lodge a complaint with your local data protection supervisory authority.

California (CCPA / CPRA)

• Right to know — request disclosure of the categories and specific pieces of personal information we collect, use, disclose, and sell (we do not sell personal information).
• Right to delete — request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to correct — request correction of inaccurate personal information.
• Right to opt out of sale or sharing — we do not sell or share personal information for cross-context behavioural advertising.
• Right to non-discrimination — we will not discriminate against you for exercising your privacy rights.

You may export all personal data associated with your account at any time via the account settings page in the dashboard.

We will respond to verified data rights requests within 30 days (or such shorter period as required by applicable law). We may need to verify your identity before processing your request.

11. Children's Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that a child under 13 has provided us with personal data, we will take steps to delete that information promptly. If you believe we may have inadvertently collected data from a child under 13, please contact us immediately.

If you are between 13 and 18 years old, please review these Terms and this Privacy Policy with a parent or guardian before using the Service.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and/or by a prominent notice on the Service at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects when the policy was most recently revised.

We encourage you to review this policy periodically. Your continued use of the Service after the effective date of any revised policy constitutes your acceptance of the changes.

13. Contact

If you have questions, concerns, or requests relating to this Privacy Policy or our handling of your personal data, please email support@phantomafk.com, use the in-dashboard contact form, or contact us through the official Discord server. We will endeavour to respond within 30 days.