1. Controller
Davis von Löwe Kiedrowski
Walsroder Straße 158, 30853 Langenhagen, Germany
Email: contact@cabalspy.xyz
Telephone: +49 511 7663766
We are not required to appoint a data protection officer. For any privacy question, write to the address above.
2. What we collect and why
Signing in with Discord
When you sign in we receive from Discord your user ID, username, avatar and your roles in the CabalSpy Discord server. We store the ID and username so we can identify you, check your access and assign the correct roles. We do not receive your Discord password or your email address from Discord.
Legal basis: Art. 6(1)(b) GDPR, performance of a contract and steps prior to it.
Buying access
When you buy, we store your Discord ID, which chains you bought, the plan, the start and end of your access, and your customer reference at Stripe. We also store the confirmation you give at checkout regarding the early start of the service and your right of withdrawal, together with its timestamp, because we are required to be able to prove it.
Payment data — card number, billing address, name — is collected and processed by Stripe, not by us. We never see your full card details.
Legal basis: Art. 6(1)(b) GDPR for the contract, Art. 6(1)(c) GDPR for statutory retention of accounting records, Art. 6(1)(f) GDPR for proof of the consent given at checkout.
Server logs
Our server records requests, including IP address, time, requested page, browser and referrer. This is needed to operate the service, find faults and defend against attacks. Logs are deleted after 30 days at the latest.
Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a secure and functioning service.
Cookies
We use one cookie: a session cookie that keeps you signed in. It is strictly necessary for the service to work, contains no tracking identifier, and expires when your session ends. We do not use advertising cookies, analytics, tracking pixels or profiling, so no consent banner is required.
Your browser also stores your display preferences, such as whether panels are open, locally on your device. That information never reaches our server.
Withdrawal and support requests
If you use the withdrawal function or contact us, we store your message, your Discord ID and the time, so we can process the request and document that we handled it.
Legal basis: Art. 6(1)(b) and (c) GDPR.
3. Who receives your data
| Recipient | Purpose | Details |
|---|---|---|
| Stripe Payments Europe, Ltd., Dublin, Ireland | Payment processing, subscriptions, invoices | Stripe privacy policy |
| Discord Netherlands B.V. / Discord Inc. | Sign-in and role assignment | Discord privacy policy |
| Our hosting provider | Operation of the server, stored in the EU | Bound by a data processing agreement |
| Tax advisor and tax authorities | Statutory accounting obligations | Only where legally required |
Some of these providers are US companies or may process data in the United States. Such transfers are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework or on standard contractual clauses under Art. 46 GDPR.
We do not sell your data and we do not pass it to advertisers.
4. How long we keep it
- Access and account data: while your access is active, then up to 12 months, so we can restore it if a payment or role assignment goes wrong.
- Invoices and accounting records: 10 years, as required by §§ 147 AO and 257 HGB.
- Checkout confirmations regarding withdrawal: 3 years, matching the statutory limitation period.
- Server logs: 30 days.
- Support messages: 3 years.
5. Your rights
Under the GDPR you have the right to:
- access your data (Art. 15);
- have inaccurate data corrected (Art. 16);
- have data erased (Art. 17), unless we must keep it by law;
- restrict processing (Art. 18);
- receive your data in a portable format (Art. 20);
- object to processing based on legitimate interests (Art. 21);
- withdraw any consent at any time, with effect for the future.
To exercise any of these, write to contact@cabalspy.xyz. We answer within one month.
You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is:
Die Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5, 30159 Hannover, Germany
lfd.niedersachsen.de
6. Is providing data required?
Signing in with Discord and providing payment data is necessary to enter into and perform the contract. Without it we cannot give you access. There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.
7. Security
The site is served over an encrypted connection. Access to our systems is restricted. Payment data never reaches our servers. No system is perfectly secure, so we also ask you to protect your Discord account, ideally with two-factor authentication.
8. Changes
We may update this policy when the Service or the law changes. The current version is always on this page.
Version of 13 September 2026.