Who we are
Tommy Taylor, trading as TX Studio, a sole trader in the United Kingdom, runs ControlARK from 61 Bridge Street, Kington, HR5 3DJ, United Kingdom. For your account data we are the controller under the UK GDPR. Contact us about your data at support@controlark.net.
This website
This website sets no cookies and uses no analytics or advertising. Our hosting and network providers handle your IP address when you load a page. Our server also keeps technical logs of requests, such as the time, the page and a network address, to keep the site running and secure (legitimate interest). These logs are kept for up to 30 days.
Your account
When you use the ControlARK app we keep:
| What | Why | How long |
|---|---|---|
| Usernames, account name, your users' permissions | To run your account (contract) | While your account is open |
| Sign-in tokens and API keys, stored only as one-way hashes | To check sign-ins (contract) | Until replaced or the account closes |
| Sign-ins: time, IP address, a device ID and the PC's name | Security and new-device alerts (legitimate interest) | 30 days |
| Change log: who changed which setting | So owners can see what their team did (legitimate interest) | 1 year |
| Your Nitrado token, encrypted | To find your servers and their admin password (contract) | Until you remove it |
| Your settings: servers, kits, commands, events, Discord webhook addresses | To run the service (contract) | While your account is open |
| API activity: calls made with your keys, including the action, server and any player's XUID, and each key's last-used IP address | To run the API and show you what your keys did (contract) | While your account is open |
| Payment records and messages with us | Accounting and support (legal obligation, contract) | 6 years for payment records; messages for as long as we need them to support you |
Owners can see their users' sign-ins in the app, with the IP address partly hidden. If an owner sets up new-device alerts, the alert goes to their Discord webhook, also with the IP address partly hidden.
We need a username to create your account, and your Nitrado token to connect your servers. Without them we can't provide ControlARK.
Players on your servers
To do its job, the bot sees what any player on the server can see. For each server owner we keep, on their behalf:
- players' character names, gamertags, Xbox user IDs (XUIDs) and tribes;
- chat lines that are commands, or that the owner's moderation filter acts on, and cross-chat between the owner's servers;
- points, playtime, kits claimed and other requests;
- moderation records: warnings, kicks, bans and renames, with the word and message that caused them;
- bot activity on the server, kept for 30 days.
Apart from bot activity, this data stays until the owner clears it or asks us to, or until their account closes.
The owner's moderation filters can warn, kick, ban or rename a player automatically, following the rules the owner sets. A player who thinks a filter got it wrong should ask the server's owner to review it.
For this data the server owner decides what is collected and why, and we process it for them. Players who want to see or remove their data should ask the server's owner, or contact us and we'll pass the request on and help.
Who we share it with
- Hosting and network: Render stores the data and runs our server for us, and Cloudflare carries traffic to it.
- Email: IONOS handles our email.
- Payments: Stripe and its Link service (also called Onelink) take your payment and handle receipts, tax, fraud checks, disputes and payment support. They receive the details they need for this. We don't see or store your full card details.
- Nitrado: we call Nitrado with your token to read your servers.
- Discord: when you set a Discord webhook, we post the messages you chose to it. If you contact us on Discord, Discord handles those messages too.
- Your own tools: when you create an API key or webhook, the data you allow goes to where you send it.
We don't sell data or use it for advertising. We'd share it with authorities only where the law requires.
Some of these providers may store data outside the UK. Where they do, we rely on the UK's adequacy rules or standard contract terms to protect it.
Your rights
You can ask us to see, correct, delete, restrict or export your data. Email support@controlark.net; we'll reply within one month.
Deleting your account: the account owner can delete the account in the app, under Delete account. That deletes its data straight away, apart from payment records we must keep and a record that the deletion happened, which has no name in it. Your account stays open after your last paid month until you delete it or ask us to. Once a plan has ended you can't sign in, so email us and we'll delete it for you.
Your right to object: where we rely on legitimate interests, you have the right to object to our use of your data at any time.
Complaints about your data
If you're unhappy with how we handle your data, you have the right to complain to us. Email support@controlark.net with the subject "Data protection complaint", or write to us at 61 Bridge Street, Kington, HR5 3DJ, United Kingdom. We'll acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.
You can also complain to the Information Commissioner's Office at ico.org.uk.
Security
Connections to ControlARK are encrypted. Tokens and keys are stored only as hashes, Nitrado tokens are encrypted, and the server's admin password is only ever given to the bot. Access to our systems is limited to us.
Changes
If we change this policy in a way that matters, we'll tell account owners before it applies.