Text pending legal review
Information shown in brackets (for example [COMPANY NAME]) is a placeholder to replace with your real details before going live. This banner disappears on its own once no placeholder remains on the page.Privacy policy
This privacy policy describes how [COMPANY NAME] collects, uses, and protects the personal data of users of the CGS Hub site, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable data protection law.
Data controller
The data controller for personal data collected on CGS Hub is [COMPANY NAME], [LEGAL FORM], registered under company number [REGISTRATION NUMBER], with registered office at [ADDRESS]. Publication director: [PUBLICATION DIRECTOR NAME]. Contact: [CONTACT EMAIL].
Data collected
Depending on your use of the site, we process: account and authentication data (Discord identifier, username, email, Discord avatar, display name and custom avatar); content you publish (reviews, creator profiles, missions, quotes, products, listings); messages exchanged in private messaging and any blocks you set — a report only stores the reason given by the reporter, never the content of the reported private message; for vote anti-fraud and listing audience measurement, a hash of your IP address (salted HMAC, your plain-text IP address is never stored), kept for 13 months, the vh_voter anti-fraud cookie and, where applicable, the in-game name you provide; Stripe identifiers linked to a payment or subscription (customer, subscription, session, payment) and the receipt URL, excluding any card data; and, for site security, an admin audit log recording their email and a hash of their IP address (salted HMAC, never the plain address), kept for 365 days.
Moderator access to reported messages
Outside of a report, the content of your private messages is never accessed by the moderation team. When a conversation is the subject of a report, a moderator may open a bounded, logged excerpt of the relevant thread: at most the 10 most recent messages exchanged before the report date, each truncated to 400 characters. This access is logged before the content is even read, irreversibly, and is limited to the strict review of the report at hand.
Purposes of processing
Your data is used for: managing your account and authenticating you via Discord; providing the platform's services (rankings, missions, profiles, private messaging); preventing vote fraud and measuring listing audience; processing payments and subscriptions via Stripe; sending transactional e-mail notifications; the security and traceability of actions performed by administrators; complying with our legal and accounting obligations.
E-mail notifications
We send you e-mails for strictly transactional purposes (purchase confirmation and receipt, sanction notice, etc.), never a marketing campaign or newsletter. For notifications tied to a purchase or a sanction, the legal basis is performance of the contract or Terms; for other transactional notifications, it is our legitimate interest, with a right to object at any time. These e-mails are sent through our subcontractor Cloudflare (Email Service), and the associated data is kept for as long as your account exists. You can adjust your notification preferences from your "My account" area.
Legal basis
Processing is based, depending on the case, on: performance of the contract / Terms (account, published content, private messaging, payment and subscription, notifications tied to a purchase or a sanction); the legitimate interest of [COMPANY NAME] (vote anti-fraud, listing audience measurement, admin security audit log, other transactional notifications); compliance with a legal obligation (invoicing, accounting); and, for non-essential cookies should they be introduced, prior consent collected via the preference center.
Retention period
Account data and published content are kept for as long as the account exists; deletion triggers immediate anonymization. The admin audit log (email and IP address) is kept for 365 days, then automatically deleted. The IP hash used for vote anti-fraud and audience measurement is kept for 396 days, then automatically anonymized — the re-identifying hash is removed while ranking aggregates are retained. An expired login session is automatically purged within a 7-day grace period after it expires; this delay is purely technical, since an expired session is rejected immediately regardless of whether it still exists in storage. Billing data is kept by Stripe in accordance with applicable accounting obligations (up to 10 years); we only hold Stripe identifiers on our side. The vh_voter cookie is kept for 12 months, session cookies for the duration of the session, and your cookie consent choice for 13 months. These periods are indicative and will be confirmed following legal review.
Data recipients
Your data may be shared with subcontractors strictly necessary for the operation of the service: Cloudflare, Inc. (data hosting — D1, R2, KV —, Turnstile anti-bot protection, and sending transactional e-mails); Discord (authentication); Stripe (payment and subscription processing); and, for cookie-free video playback, YouTube-nocookie / Google. No data is sold to third parties for commercial purposes.
Transfers outside the European Union
Some of our subcontractors (Cloudflare, Stripe, Discord, Google) are based in the United States and may process your data there. These transfers outside the European Union are governed by the appropriate safeguards required by the GDPR, notably the European Commission's standard contractual clauses (SCCs) and each subcontractor's own compliance mechanisms.
Security
[COMPANY NAME] implements reasonable technical and organizational measures to protect your data against unauthorized access, loss, or alteration: encryption of exchanges, access control, hashing of IP addresses used for anti-fraud purposes, and logging of administration actions.
Your rights
In accordance with the GDPR, you have the right to access and port your data (JSON export available from your account area), to rectify it (username and avatar can be edited directly from your account; your email address, synced with Discord, cannot be changed from the site), to erasure (deleting your account triggers immediate anonymization of your data), to object to and restrict processing, and to withdraw your consent for optional cookie categories via the preference center. To exercise these rights, contact us at [CONTACT EMAIL] or our data protection officer at [DPO CONTACT EMAIL]. You also have the right to lodge a complaint with the CNIL (www.cnil.fr).
Data protection officer
For any question regarding your personal data, you may contact our data protection representative at [DPO CONTACT EMAIL].
Cookies
The site uses cookies and similar technologies strictly necessary for its operation (session, security, vote anti-fraud), as well as local storage to remember your cookie consent choice. No analytics or advertising cookies are used at this time. For details on each cookie and its retention period, see our dedicated cookie policy.
Changes to this policy
This policy may be updated periodically. The last update date is shown at the bottom of the page. We invite you to review it regularly.