Privacy Policy
How Medal Labs collects, uses, encrypts, and protects your account details, telemetry, and personal information.
This Privacy Policy explains what personal data Medal Labs (“Medal Labs”, “we”, “us”, “our”) collects, why we collect it, how we use and protect it, and the choices you have. It applies to the website medal-labs.com, our customer portal, and all cloud services we provide (including VPS, Discord bots, and RDP services). It forms part of, and should be read together with, our Terms of Service.
1. Data We Collect
1.1 Account Data
When you register, we collect: name or username, email address, password (stored hashed with bcrypt/argon2, never in plain text), and optionally country and phone number.
1.2 Billing Data
When you purchase a Service, we collect: invoices, order history, transaction IDs, the payment method type used, billing country, and Medal Labs Wallet balance and history.
We do not store your full card number, CVV, or payment credentials. Payments are processed by certified third-party payment providers (Polar.sh, Stripe, NOWPayments); we receive only confirmation of payment and limited metadata (e.g., last 4 digits, provider reference ID).
1.3 Technical & Usage Data
When you use our website or control panel, we automatically collect: IP address, browser and device information, login timestamps, pages visited, and actions performed in the control panel (e.g., server restarts, reinstalls). This data is used for security, fraud prevention, and troubleshooting.
1.4 Service Data
To operate your VPS or Bot Service, our systems process: the IP address(es) assigned to your server, resource usage metrics (CPU, RAM, disk, bandwidth), uptime data, and network flow metadata used for capacity planning and DDoS mitigation.
1.5 Support Communications
When you contact us, we keep the content of your tickets and related correspondence, along with any diagnostic information you choose to include in them.
1.6 Content on Your Server
Data you store or run on your server (“Customer Content”) belongs entirely to you. We do not access, read, or monitor the contents of your server in the ordinary course of business. We may access Customer Content only:
- (a) with your consent or at your explicit request (e.g., a technical support task);
- (b) to investigate a suspected violation of our Acceptable Use Policy, based on network-level indicators;
- (c) where required by law or a valid legal order; or
- (d) in critical emergencies affecting the physical security or operational stability of our infrastructure.
2. How We Use Your Data
We use the data described above to:
- (a) create and manage your account credentials;
- (b) provision, operate, and maintain your cloud services;
- (c) process payments, issue official invoices, and manage wallet renewals;
- (d) provide technical support and verify server ownership;
- (e) send service notifications — renewal reminders, expiration notices, incident announcements;
- (f) detect and prevent fraud, abuse, AUP violations, and network attacks;
- (g) monitor and improve performance, capacity, and system reliability;
- (h) comply with statutory legal, tax, and accounting obligations.
We do NOT sell or rent your personal data to anyone under any circumstances.
3. Legal Bases for Processing
Where applicable law requires a legal basis, we rely on:
- Contract: Necessary to deliver the Services you purchased;
- Legitimate interests: Platform security, fraud and abuse prevention, network protection;
- Legal obligation: Retaining invoices and tax records, responding to lawful authorities;
- Consent: Opt-in communications and non-essential cookies.
6. International Transfers
Our server infrastructure and partners are distributed globally (e.g., Germany, USA, Finland). Where data is transferred across borders, we take robust steps to ensure an adequate level of data protection consistent with this Policy.
7. Data Retention
- Account data: Retained while your account is active. Deleted upon verified user request within 30 days;
- Billing records & invoices: Retained as required by applicable tax and accounting laws;
- Server data (Customer Content): Permanently deleted automatically after the 7-day grace period;
- Support tickets & logs: Retained for up to 3 years for dispute-resolution and quality assurance.
8. Marketing Communications
8.1 Transactional emails (invoices, renewal reminders, security alerts) are mandatory for active services.
8.2 Product announcements and newsletters are strictly optional. Every promotional email contains a one-click unsubscribe link.
9. Security Measures
9.1 We protect your data using TLS 1.3 encryption, salted passwords, strict role-based access controls, firewalls, and 24/7 DDoS mitigation.
9.2 Your responsibilities: You are responsible for securing your server credentials and SSH keys. Always use strong, unique passwords and enable Two-Factor Authentication (2FA).
10. Your Rights
Depending on your jurisdiction, you have the right to access, correct, delete, or export your personal data, or object to certain processing. To exercise these rights, submit a support ticket or email [email protected].
11. Children’s Privacy
Our Services are not directed at children under 13. Users under 18 require parental or legal guardian consent.
12. Third-Party Links
Our website and portal may link to external websites or third-party documentation. Their privacy practices are governed by their own independent policies.
13. Changes to This Policy
We may update this Policy periodically. Material changes will be announced on medal-labs.com and by email to registered account holders.
14. Contact Information
Privacy queries & data requests: [email protected]
Official Portal & Ticket Support: medal-labs.com