Privacy policy

1. Data controller

LastStudioMC (French SIRET 94007369500014) is the data controller for the website, SaoWorld accounts and game services.

2. Data and purposes

Depending on the activity, processing is based on performance of the service or contract, legal obligations, SaoWorld’s legitimate interest in operating and securing its services, or consent when required.

• SaoWorld account: email address, Minecraft username and UUID, avatar, salted password hash, role, ban status and hashed session tokens, used to create, secure and administer the account.
• Security: login, ban and rate-limiting IP addresses, timestamps and technical logs, used to prevent fraud, abuse and intrusion.
• Shop: Minecraft username, IP address when available, basket product identifiers and quantities, and result data needed to deliver a purchase.
• Game and SaoMusic: username, UUID, server, world, approximate position, music state and presence metadata needed for music and proximity voice chat.
• Recruitment and support: information voluntarily submitted in a form or email, used only to handle that request.

3. Payments and providers

Data is not sold. It is disclosed only to authorised team members and providers required to deliver the service, within their assigned role. Tebex describes its own processing in its privacy policy.

• Tebex creates and processes the basket and payment. SaoWorld sends the Minecraft username, IP address when available, products, quantities and return URLs. Billing and payment details are processed directly by Tebex and its payment providers; SaoWorld does not receive full card data.
• OctoGency hosts the website and may process hosting data such as HTTP logs and IP addresses.
• MineStrator hosts game, database and Redis services and processes the technical data needed to run them.
• OVH provides DNS and email services. Messages sent to support pass through that infrastructure.
• Mojang/Microsoft and the mc-heads.net avatar service are queried using a Minecraft username or UUID to verify a profile and display its avatar.

4. Music, sessions and voice chat

• The SaoMusic link carries a temporary code in the URL fragment, which is not sent to the web server with the request. It is intended to expire after two minutes and is revoked immediately when exchanged.
• The browser then receives a random HttpOnly session cookie, Secure in production and SameSite=Strict. The session expires after fifteen minutes of inactivity and is revoked when player presence can no longer be confirmed.
• Voice packets are relayed only in volatile memory to nearby players. They are not written to files, a database or Redis. Each recipient queue holds at most 48 packets and is drained on delivery or removed with an inactive client after about fifteen seconds.
• Application logs do not record codes or cookies in clear text. A truncated, non-reusable fingerprint may be used to diagnose a rejection.

5. Cookies and local storage

SaoWorld currently sets no advertising or audience-measurement cookies.

• sw_account_session: HttpOnly account sign-in cookie, valid for up to one year.
• sw_music_session: HttpOnly SaoMusic-only cookie, with a sliding maximum of fifteen minutes without activity.
• lang and basket: language preference and locally stored basket contents.
• cookie_consent: a preference stored locally in the browser.

6. Retention

• Account data is kept while the account is active and deleted on request, except where data is needed for a legal or accounting obligation, security, or the establishment or defence of legal claims.
• Expired sessions and hashed tokens are deleted by the service. Security logs and information are retained only as long as needed to prevent and handle incidents.
• Purchase data is kept under applicable accounting obligations and Tebex rules. Applications and support requests are kept for the time needed to process them and reasonable follow-up.
• Presence, music-state and SaoMusic-session data use short technical expiries. Voice content is not stored persistently.

7. Your rights

You may request access, correction, deletion, restriction or portability of your data and object to certain processing where the GDPR provides. You may also delete your account from your profile. Limited identity evidence may be requested where there is reasonable doubt.

8. Security and changes

SaoWorld uses access controls, encryption in transit, password and session hashing, rate limiting and security logging. This policy may change when services or providers change; the date above identifies the current version.