Privacy Policy

1. Controller

Joshua Gerke (sole proprietor), trading as ShulkerHost.com, Am Sandberg 14, 38442 Wolfsburg, Germany. Email: privacy@shulkerhost.com. Phone: +49 5362 9743522.

2. Website

Our CDN Bunny.net (BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia) delivers the pages and processes your IP address, the requested page, time, browser and referrer in short-lived server logs to deliver the site and fend off attacks (Art. 6(1)(f) GDPR, legitimate interest in a secure, working website). We do not combine this with other data. Fonts are hosted by ourselves; no external fonts are loaded.

Protection against abuse (bot check): before you send the contact form, a cancellation, a withdrawal or a donation, register or reset your password, your browser solves a small computing task in the background (proof of work with the open-source software Cap). The task is issued and verified by a server we run ourselves (captcha.wolfscastle.de), which processes your IP address for this. No cookies are set, nothing is stored in your browser and no data goes to third parties (Art. 6(1)(f) GDPR, protecting our forms against automated abuse).

Ping test: on the home page, the locations page and the configurator your browser sends a small request to one game node per location (node1.eu/us/clt/in.shulkerhost.com) as soon as the list of locations comes into view, to show you the latency. The node sees your IP address for this request; it is not stored beyond short-lived technical logs. Nodes are located in Germany, the USA and India (Art. 6(1)(f) GDPR, showing you the best location).

Statistics: we count page views with Rybbit, which we run ourselves (own server at tracking.respawnhost.com, no sharing with third parties). Your browser only sends the page you open, its title and – if you come from another website – that site’s domain. No cookies are set, nothing is stored in your browser and no device properties such as screen size are read. To count visitors, the server derives a hash from your IP address and browser that changes every day; the IP address itself is not stored. The result is statistics (for example which pages are read often) that we do not combine with other data and delete after 24 months at the latest. Measurement only runs if you agree to statistics in the cookie banner (Art. 6(1)(a) GDPR). You can withdraw your consent at any time: open cookie settings.

Partner links: if you arrive through a partner link (…?ref=code), we only add the code to the links on the page you are on, so it reaches the panel when you sign up. It is not stored in your browser. If you come back later without the link, you can enter the partner code as a discount code when ordering.

Forms: if you use the cancellation or withdrawal form, we process your name, email, the contract you name and your message to process your declaration and confirm it by email (Art. 6(1)(c) GDPR, legal obligation).

3. Account, servers and payments

Account: email, password (stored only as a hash), optional name, preferred currency, login sessions and, if you turn it on, two-factor authentication data. Needed to provide the contract (Art. 6(1)(b) GDPR); without an email address we cannot open an account. If you sign in with Google, Discord or GitHub, that provider sends us your account ID, email address (only if confirmed there), display name and the address of your profile picture; we store them to recognise you and to show your picture in the panel. Our server loads the picture, your browser does not connect to the provider for it. Icons of mods and modpacks (Modrinth, CurseForge) and Minecraft heads (Mojang) are loaded through our server as well. The provider learns that you sign in to ShulkerHost; its own privacy policy applies. You can disconnect it in your profile at any time.

Servers: server name, configuration, location, files you upload, console logs and the IP addresses and Minecraft names of players connecting to your server as part of technical logs (Art. 6(1)(b) GDPR). Servers run on the game server platform Wolfscastle and on hosting infrastructure in the location you choose: Germany, the USA (Salt Lake City, Charlotte) or India (Noida). If you choose a location outside the EU, your server data is processed there because you asked for it (Art. 49(1)(b) GDPR); for the USA, providers are also bound by standard contractual clauses.

Payments and invoices: billing name and address, country, VAT ID (if you enter one), payment reference, amounts and invoices. Payments are processed by Stripe (Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland), which also calculates VAT (Stripe Tax) and loads its payment form from js.stripe.com only when you open the payment step. Stripe then sets cookies and collects device and usage data to detect fraud; this is required for a secure payment (Section 25(2) No. 2 TDDDG, Art. 6(1)(b) and (f) GDPR). Stripe may transfer data to Stripe, Inc. in the USA under the EU-U.S. Data Privacy Framework and standard contractual clauses. If you pay with PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) processes the payment as an independent controller. Invoices are created in our accounting software sevDesk (sevdesk GmbH, Hauptstraße 115, 77652 Offenburg, Germany). Legal basis: Art. 6(1)(b) and (c) GDPR (contract, tax law).

Emails: service emails (for example order confirmations, invoices, reminders before a term ends) are sent through our email service Sendwolf (Art. 6(1)(b) GDPR). Tips and offers (for example a note with an upgrade option when your server runs at its limits for a long time, or a discount campaign) are only emailed if you agreed to it with the optional checkbox when signing up or in your profile and confirmed your email address (Art. 6(1)(a) GDPR, at most once a week). As proof we store the time and wording of your consent. You can withdraw it at any time in your profile or with one click on the unsubscribe link in every such email, without signing in.

Free trial: to give each person only one free trial, we store a normalised form of your email address as long as your account exists, and the network part of your IP address (/24 for IPv4, /64 for IPv6) for 30 days (Art. 6(1)(f) GDPR, preventing abuse). A trial can be refused automatically on this basis; if you think that’s wrong, write to us and a person will review it.

Partner program: which customers a partner referred (by link or code), the resulting commissions and, if you request a payout, your PayPal address or bank details (Art. 6(1)(b) GDPR). The partner only sees numbers: how many people signed up through them, how many of those are paying customers, and their commissions with date and amount. They do not see names, email addresses or servers of referred customers (Art. 6(1)(f) GDPR, running the partner program). Referred customers see no data about the partner beyond the discount.

Donation pages: donors can donate without an account. We process the amount, the donor’s country (for VAT), and only if entered a name and a message, which are shown on that page (the page owner can hide them), and an email address. The email is used only with consent, given with the checkbox, to send the payment receipt through Stripe (Art. 6(1)(a) GDPR); it can be withdrawn at any time. The page shows the owner’s Minecraft skin, which our server loads from Mojang’s public skin service.

Support: your tickets (subject, messages, screenshots you attach, the server you name), our replies, and your email address and name to assign them to your account (Art. 6(1)(b) GDPR). Tickets are kept in our support system Chatwolf; we email you about replies through Sendwolf. The same applies when you write to us without an account through the contact form on the website: your email address, your name (optional), the topic you chose and your message become a ticket that we answer by email (Art. 6(1)(b) GDPR for questions about a contract or before an order, otherwise (f), answering your request).

AI helper Shulky (optional, in the panel): your messages, screenshots you add and the server data Shulky reads for your question (status, console log, crash reports, files, mod list) are sent to our AI provider Eden AI (Eden AI SAS, France) and processed on servers in the EU by the language model DeepSeek V4.1 Flash to answer you (Art. 6(1)(b) GDPR). We do not use them to train models. Logs can contain names and IP addresses of players on your server; Shulky only reads them when your question needs it. Shulky is an AI, not a human – the chat window says so too; you can reach a person at any time through a support ticket. The chat is kept only in your browser tab and is deleted when you close it. Shulky changes nothing on your servers without your click on Allow, unless you explicitly turn that on for a chat; before deleting anything or changing files Shulky always asks.

Security and activity log: for every sign-in (also failed ones) and every change you make in the panel we store the time, the action (method and address of the request, e.g. “POST /api/gameservers/…/power”), the result and your IP address – no passwords and no form contents. We use it to detect abuse, to help you when something went wrong and to prove what happened (Art. 6(1)(f) GDPR). It is deleted after 90 days. Actions our staff take in the admin area are logged as well.

4. Browser storage and cookies

The website sets no cookies. In your browser’s local storage it only keeps what you chose yourself: language (sh.lang) and currency (sh.currency) once you pick them in the menu, the time you closed the welcome offer (sh.promo.seen, not shown again for 14 days), whether you hid the banner of a running campaign (sh.campaign.hidden) and your choice in the cookie banner (sh.consent, 12 months). This is required to respect your choice (Section 25(2) No. 2 TDDDG). There are no advertising or tracking identifiers.

The panel only uses strictly necessary cookies: the session cookie for login, a security cookie for 10 minutes while you sign in with Google, Discord or GitHub, and for staff a cookie for the admin area. It also uses local storage for your display settings (for example theme and sidebar), dismissed notices, first-steps progress and an order you started but haven’t paid yet. These stay on your device. Details: Cookie Policy.

5. Recipients

Besides the providers named above, we use processors under data processing agreements (Art. 28 GDPR) for hosting and operating our systems. Transfers to the USA (to Stripe and, if you sign in with Google, Discord or GitHub, to those providers) rely on the EU-U.S. Data Privacy Framework and, in addition, standard contractual clauses. We do not sell personal data. Authorities receive data only where the law requires it.

6. Retention

Account data: as long as your account exists. When you close your account, we delete or anonymise it (including linked sign-ins, your customer record at Stripe and your donation page), except for data we must keep by law (invoices, payments, partner payouts).

Invoices and accounting records: 8 or 10 years under German tax and commercial law.

Servers: a paused server is deleted 14 days after it was paused; the final backup is kept for another 14 days. A free trial server that isn’t booked is deleted 7 days after the trial ended. Backups you create yourself are kept until you delete them or the server is deleted.

Trial abuse check: IP network 30 days, email form until the account is deleted. Statistics: at most 24 months, without IP addresses. Security and activity log: 90 days. Short-lived technical logs (CDN, game nodes): a few days.

7. Your rights

You have the right to access, rectification, erasure, restriction of processing and data portability (Art. 15–20 GDPR) and to withdraw any consent with effect for the future. You can download a copy of your data in your profile and delete your account there yourself. Contact: privacy@shulkerhost.com.

Right to object (Art. 21 GDPR): where we process data based on legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation.

You also have the right to lodge a complaint with a supervisory authority, for example the authority responsible for us: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.

8. Security

All connections are encrypted (TLS). Passwords are stored only as hashes, two-factor authentication is available, and internal access is limited to what each role needs.