Privacy Policy
Last updated 13 October 2026 · S Ward Host Ltd. (trading as BinaryFall)
This policy explains how S Ward Host Ltd. (trading as BinaryFall) handles your personal data. We are the data controller, registered in England & Wales, and we process personal data under the UK GDPR, the Data Protection Act 2018, and the EU GDPR for customers in the EEA. Questions or requests: privacy@binaryfall.com.
1. What BinaryFall does
We rent game servers. You pick a plan, we provision a container on our hardware, and you manage it through a web control panel. That is the whole product, and it shapes everything below: we need enough data to bill you and run your server, and we have no advertising business that would give us a reason to collect more.
VPS and panel accounts. We also rent virtual private servers (VPS). When your email address is verified, we create a matching account with the same email, name and username in our two control panels: the game-server panel and the VPS panel. We set the panel password to the password you use on this website at the moment you log in or change it. We do not store that password in readable form, and we do not log it. The VPS panel keeps what you do there, such as power actions, backups and snapshots, and a terminal session that you open in the browser connects to your own VPS only. We do not look inside your VPS except as our VPS Service Terms allow.
2. Data we collect
- Account data: your name, email address, and a password hash — or a Google account identifier if you use Google sign-in.
- Billing data: from Stripe, we receive payment status, amounts, and transaction identifiers. Stripe collects and holds the card details themselves.
- Service data: your server configuration, and the files, worlds, plugins, and backups you upload (“Your Content”).
- Technical data: IP address, browser details, and server and access logs.
- Support data: messages you send us by ticket or email.
- Referral data: if you use the referral programme, which account referred which, so credits can be awarded correctly.
Public file-sharing links
If you create a public download link in the game-server panel, we store a private snapshot of the selected content, its file name and size, the owning account and server, link credentials, creation and expiry times, and aggregate download-start and completed-transfer counts. We use these to provide the feature and enforce security and resource limits. Anyone with the link can download the snapshot without an account. Only publish content you are entitled to share, and remove secrets and personal data first.
For visitors, IP addresses are processed for temporary rate limits and security; essential session and anti-forgery cookies protect the download form. Owners see aggregate counts, not visitor identities or an individual download history. Counts do not identify unique people. The public download page has no advertising or third-party analytics.
Removing a link invalidates it and deletes its snapshot. Rotation invalidates the old URL but retains the snapshot and counts. Expiry blocks access immediately; expired records and snapshots are removed by periodic cleanup. Recipients can retain or redistribute copies already received, which we cannot recall. To report exposed personal data or unlawful content, contact privacy@binaryfall.com or abuse@binaryfall.com and send the link privately.
What we do not collect
- No card numbers. Card details go to Stripe and never reach our servers, so there is nothing here to leak.
- No analytics or advertising tracking. No Google Analytics, no advertising pixels, no cross-site tracking, no data brokers.
- No reading of your game content for our own purposes. We do not scan, mine, or analyse your worlds, files, or player chat to profile you or build products.
- No selling or renting of personal data to anyone, in any form, ever.
- No AI model training. Your content, your files, and your support messages are never used to train any AI model, ours or anyone else’s.
3. How we use your data & our legal basis
| Purpose | Legal basis |
|---|---|
| Create your account, provision and run your servers, provide support | Performance of a contract |
| Take payments, handle refunds, and prevent payment fraud | Contract; legitimate interests |
| Send transactional email (verification, invoices, service notices) | Contract |
| Keep the platform secure and investigate abuse of our network | Legitimate interests |
| Operate the referral credit programme and prevent its abuse | Contract; legitimate interests |
| Keep invoices and tax records | Legal obligation |
| Optional marketing email | Consent (withdraw at any time) |
Where we rely on legitimate interests, we have weighed those interests against your rights and use the least intrusive approach that still works. You can object to that processing at any time — see section 8.
4. Cookies & browser storage
We set only strictly necessary cookies (sign-in and security) and a few functional preferences. We set no analytics or advertising cookies at all. Every single item is listed by name, purpose, and duration in our Cookie Policy.
5. Connecting an AI assistant to your server
The control panel can expose your server to an AI assistant you choose, such as Claude, so you can manage it in plain English. This is entirely optional and off unless you set it up. It is worth understanding exactly what happens when you do:
- You authorise the connection on a consent screen that names the access level you are granting — read (status, console output, files, players, backups), write (start and stop, run commands, edit files, take backups), or admin (reinstall, restore or delete backups, change startup settings).
- Once connected, whatever the assistant reads from your server is transmitted to that assistant’s provider, and is then governed by that provider’s privacy policy and terms, not ours. We are not able to control or retrieve it.
- We do not send your data to any AI provider ourselves, and we do not choose the provider — you do.
- You can revoke the connection at any time from the panel, which stops further access immediately.
Treat granting this access the same way you would treat giving someone your server password: only connect an assistant you trust, and prefer the narrowest access level that does what you need.
6. Who we share data with
We share personal data only with providers who process it on our behalf under contract, each bound to protect it:
| Provider | What they handle | Their policy |
|---|---|---|
| Stripe | Payments, card storage, refunds, fraud checks | stripe.com/privacy |
| Sign-in only, and only if you choose Google sign-in | policies.google.com/privacy | |
| OVH SAS (France) | The physical servers in Germany that run the panel and your game server | ovhcloud.com/en/personal-data-protection |
| BinaryFall (our own mail server, Germany) | Delivery of transactional email such as receipts and server-ready notices. No outside email provider is used for this. | This policy |
| OVH SAS (France) | DDoS filtering and routing of network traffic (OVHcloud's anti-DDoS protection on our servers) | ovhcloud.com/en/personal-data-protection |
We may also disclose data where we are legally required to, or to protect our rights, our customers, or the public — for example when reporting illegal content to the authorities. We do not sell your personal data, and we do not share it for cross-context behavioural advertising.
7. How long we keep it
| Category | Retention |
|---|---|
| Account data | While your account is open, then deleted or anonymised after closure unless we must keep it by law |
| Your Content (worlds, files, backups) | Deleted after the 7-day grace period following cancellation or termination (see section 5 of our Terms). Keep your own copies. |
| Invoices and tax records | 6 years, as UK tax law requires |
| Server and access logs | Kept for 30 days for security and troubleshooting, then deleted |
| Support tickets | Kept while relevant to your account, then deleted |
| Referral and credit ledger entries | Kept as long as needed to keep the balance auditable and to prevent abuse |
8. Your rights
Under UK and EU GDPR you have the right to access your data, have it corrected or erased, restrict or object to how we process it, and receive it in a portable format. Where we rely on consent, you can withdraw it at any time without affecting what we did beforehand.
To exercise any of these, email privacy@binaryfall.com. We respond within one month, and will tell you promptly if a request will take longer or needs identity verification. Exercising your rights is free and we will not treat you differently for it.
If you are unhappy with our response you can complain to your data protection authority. In the UK that is the Information Commissioner’s Office; in the EEA it is your national supervisory authority.
California residents
If you live in California, the CCPA as amended by the CPRA gives you the right to know what personal information we collect and why, to delete it, to correct it, and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined, and we do not use it for cross-context behavioural advertising, so there is no opt-out to exercise. We do not offer financial incentives for data, and we will not discriminate against you for making a request. Use the same address above.
9. International transfers
Your servers and our panel run inside the EU, in Germany. Some processors may handle data outside the UK or EEA. Where they do, we rely on approved safeguards — UK International Data Transfer Agreements, the UK Addendum, or EU Standard Contractual Clauses, or on an adequacy decision covering that country.
10. Children
Our services are not directed at children under 13, and we do not knowingly collect their personal data. You must be 18 or over to hold an account. Under-18s may use BinaryFall only through an account created and held by a parent or guardian, who accepts our Terms. If you believe a child has given us personal data, contact us and we will delete it.
11. Security
We encrypt data in transit with HTTPS, hash passwords, hold session identifiers in HttpOnly cookies so page scripts cannot read them, isolate each customer’s server in its own container, and apply least-privilege access to production systems and secrets. No system is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will notify the regulator within 72 hours and tell you without undue delay.
12. Changes & contact
We may update this policy. Material changes will be announced by email or on the website before they take effect, and the “last updated” date above always reflects the current version.
Data controller: S Ward Host Ltd., registered in England & Wales, trading as BinaryFall. Privacy enquiries: privacy@binaryfall.com. Everything else: support@binaryfall.com. See also our Cookie Policy, Terms of Service, and Refund Policy.