MACO Core: Privacy Policy
Last updated: 13 November 2026
This policy explains:
- what personal data we collect about you;
- why we collect it;
- who we share it with;
- how long we keep it;
- your rights.
1. Who we are
MACO Core is a trading name of MACO, run by Miguel Alejandro Chavez Oliva, a sole trader based in England. We are the controller of the personal data described in this policy.
| Address | Address coming soon (contact us by email in the meantime) |
| Email for privacy questions | [email protected] |
| ICO registration number | Registration pending |
We are a small business and have not appointed a Data Protection Officer. Send any privacy question to the email above.
Data on your game server is different. Your server may hold personal data about your players, such as usernames, IP addresses or chat logs. For that data, you are the controller and we only process it for you as your processor. Our Terms of Service, section 15, covers this.
2. What data we collect
Data you give us
| Type | What it includes |
|---|---|
| Account data | Name, email address, username, password (stored hashed, we can't see it), two-factor authentication settings |
| Billing data | Billing name and address, what you bought, invoices, payment status. Card or PayPal details are handled by our payment provider: we don't see or store full card numbers. |
| Support data | Anything you send us in tickets, emails or Discord messages, including attachments |
| Verification data | Information we ask for to prevent fraud, only if needed |
| Partner programme data | If you are one of our invited partners: your partner code, PayPal email address, which orders used your code (not who placed them), commission earned and payouts made |
| Waitlist data | Your email address and the date you signed up, if you join a waitlist on our website (for example for game server hosting) |
Data we collect automatically
| Type | What it includes |
|---|---|
| Technical and log data | IP addresses, browser type, login times, control panel activity (for example starting or stopping servers), and security logs |
| Server and monitoring data | Server status, resource use (CPU, RAM, disk, network), crash reports, process names, network connection counts, and console and system logs. We use these to keep services running and detect abuse. |
| Cookies | See section 9 |
3. Why we use your data and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Creating and managing your account, providing the Services, providing support | Contract: we need it to provide what you ordered |
| Taking payments, sending invoices and service emails (renewals, outages, security notices) | Contract |
| Keeping accounting and tax records | Legal obligation |
| Running the partner programme: tracking code use, calculating commission, paying partners | Contract (our Partner Programme Terms) |
| Monitoring and securing our systems, preventing fraud and abuse, enforcing our Terms and Acceptable Use Policy | Legitimate interests: keeping our services, customers and the internet safe |
| Improving our services and fixing problems | Legitimate interests |
| Responding to legal requests, establishing or defending legal claims | Legal obligation / Legitimate interests |
| Marketing emails about new products or offers (only if you opt in) | Consent: you can withdraw it at any time |
| Emailing you when a product you joined the waitlist for launches | Consent: you give it by joining the waitlist, and can withdraw it at any time by emailing us or using the unsubscribe link |
Where we rely on legitimate interests, we have balanced them against your rights. You can object (see section 7).
4. Automated monitoring and administration
To run our infrastructure around the clock, we use automated monitoring and system administration tools. These tools:
- check whether servers and services are up;
- detect crashes, resource problems and signs of abuse (for example cryptocurrency mining or network attacks);
- help diagnose and fix technical problems on our servers.
To do this, they may process technical data such as:
- server names and identifiers;
- process names and resource use;
- network connection information;
- log files;
- error messages;
- file names.
They do not need your password or payment details. Some of these tools are provided by IT service providers based in the USA, acting as our sub-processors.
No solely automated decisions with legal or similarly significant effects. Automated tools may flag a problem, but decisions to suspend or terminate an account for abuse are always reviewed and approved by a person.
5. Who we share your data with
We don't sell your personal data. We share it only with:
| Who | Why | Where |
|---|---|---|
| Hosting and data centre providers | Servers that run our website, billing system, control panel, customer VPSes, dedicated servers and game servers | UK / EU |
| Payment providers (such as Stripe and PayPal) | Processing payments, fraud prevention | UK / EU / USA |
| IT and monitoring service providers | Automated monitoring and system administration (see section 4) | USA |
| Email providers | Sending account and service emails | UK / EU |
| Discord (only if you contact us there) | Support chat; service alerts for our own staff | USA |
| Our own off-site backup server | Off-site backups | UK |
| Our accountant or professional advisers | Accounting, tax and legal advice | UK |
| Police, regulators, courts | Only where the law requires or allows it, for example to prevent crime | UK |
| A buyer or successor of the business | If MACO is sold, merged or becomes a limited company | UK |
International transfers. Some providers are outside the UK. When we transfer personal data outside the UK, we make sure it is protected using one of:
- a UK "adequacy" decision, which includes the UK–US Data Bridge for certified US companies;
- the UK International Data Transfer Agreement or Addendum;
- another safeguard allowed by law.
You can ask us for details.
6. How long we keep your data
| Data | How long |
|---|---|
| Account data | While your account is open, then up to 12 months after it closes (to deal with questions, disputes or abuse), unless the law needs longer |
| Billing and invoice records | 6 years after the end of the tax year they relate to (UK tax law) |
| Partner commission and payout records | 6 years after the end of the tax year they relate to (UK tax law) |
| Server files and game data | Deleted 7 days after the Service ends (7 days after the due date if it ends for non-payment). Backup copies are removed as backups rotate, normally within 30 days (see Terms, section 12) |
| Support conversations | Up to 2 years after the last message |
| Logs and monitoring data | Normally up to 90 days, longer if needed to investigate a security incident or abuse |
| Records of abuse and suspensions | Up to 2 years, to prevent repeat abuse |
| Waitlist emails | Until we've told you the product has launched, or you ask to be removed, and no longer than 12 months after you sign up |
7. Your rights
Under UK data protection law you have the right to:
- Access: ask for a copy of your personal data;
- Rectification: ask us to correct inaccurate data;
- Erasure: ask us to delete your data, where there's no good reason for us to keep it;
- Restriction: ask us to limit how we use your data;
- Portability: get your data in a reusable format, where we rely on contract or consent;
- Object: object to us using your data on the basis of legitimate interests, or for direct marketing (always honoured);
- Withdraw consent: at any time, where we rely on consent.
How to use your rights
- Email [email protected].
- We may need to check your identity.
- We'll reply within one month. This can be extended by two more months for complex requests, and we'll tell you if so.
- It's normally free.
8. Security
We take appropriate technical and organisational measures to protect your data, including:
- encrypted connections (HTTPS / SSH);
- hashed passwords;
- two-factor authentication options;
- key-only server access for our admin tools;
- restricted access;
- monitoring and off-site backups.
No system is 100% secure. If a data breach is likely to put your rights at risk, we will tell you and the ICO as the law requires.
9. Cookies
Our website and control panel use:
- Essential cookies: needed to log you in, keep your session secure and remember settings. These don't need consent.
You can block or delete cookies in your browser settings, but parts of the control panel won't work without essential cookies.
10. Children
Our Services are not aimed at children. Accounts must be opened by someone 18 or over, or by a parent or guardian (see our Terms of Service). We don't knowingly collect personal data directly from children under 13. If you think we have, contact us and we'll delete it.
11. Complaints
If you're unhappy with how we've used your data, please contact us first at [email protected] and we'll try to put it right.
You also have the right to complain to the Information Commissioner's Office (ICO):
- ico.org.uk
- 0303 123 1113
12. Changes to this policy
We may update this policy. If the changes are significant, we'll tell you by email or in the control panel before they take effect. The date at the top shows when it was last updated.