Privacy Policy
Last updated: October 7, 2026
Data controller
The matrixblue.eu website and the MatrixBlue launcher are operated by MATRIXBLUE — Lucas PILOQUET (SIREN 130 804 297), the controller of your personal data under Regulation (EU) 2016/679 ("GDPR") and the French Data Protection Act.
Contact for any data protection request: contact@matrixblue.eu.
Data collected, purposes and retention
| Data | Purpose | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|---|
| Account: username, hashed password, creation date, status (admin/banned) | Creating and managing your account | Performance of contract | Until account deletion |
| Orders: products, duration, price, date, promo code, Stripe session ID | Delivering and tracking licenses, order history | Performance of contract | Until account deletion; accounting records kept 10 years (French Commercial Code) at Stripe |
| Hardware ID (HWID) of your PC | Binding the license to a device, preventing license sharing | Performance of contract | Until account deletion or reset by support |
| Launcher sign-in tokens (HWID, pseudonymised IP) | Launcher authentication | Performance of contract | 30 days |
| Launcher presence: pseudonymised IP (HMAC), client and versions, username if signed in | Public aggregated usage stats, anti-abuse | Legitimate interest | 30 days (presence) / 90 days (daily stats) |
| Crash reports: logs, minidump, versions, HWID, username (unless sent anonymously) | Diagnosing and fixing bugs | Legitimate interest | 7 days maximum |
| Shared configs: file, name, description, username, pseudonymised IP, votes | Community sharing, moderation | Performance of contract | Until removed; anonymised on account deletion |
| Reviews: rating, comment, username (published on the site) | Displaying customer reviews | Your voluntary action of posting a review (performance of contract) | Until account deletion |
| Discord link: Discord ID | Granting customer roles on Discord | Performance of contract | Until account deletion |
| Security: IP address and username on failed logins | Brute-force protection | Legitimate interest (security) | 24 hours maximum |
| Technical error logs (no IP address) | Site maintenance | Legitimate interest | 60 days maximum |
What we do not collect
We do not ask for your name or email address to create an account. We never receive your card details: payment happens directly on Stripe's secure page. We use no advertising cookies, no third-party analytics, and we never sell data. No automated decision producing legal effects is made about you.
Recipients and processors
- Stripe Payments Europe Ltd. (Ireland): payment processing. Stripe acts as an independent controller for payment data; some data may be transferred to the United States under the EU-US Data Privacy Framework and standard contractual clauses.
- Hosting providers: OVH SAS, 2 rue Kellermann, 59100 Roubaix, France (site web) ; Winheberg, Maxime Wussow, auto-entrepreneur (SIRET 883 153 314 00017), Rue Chaussade, Bâtiment 2, 43260 Saint-Julien-Chapteuil, France.
- Discord: only if you link your Discord account, to grant your customer roles on our server.
- cdn.tailwindcss.com: stylesheet loaded by your browser; this provider technically receives your IP address when the page loads.
Only site administrators can access account data, for license management and support.
Cookies and local storage
We only use strictly necessary or preference trackers, which are exempt from consent:
- CUSTOM_SESSID (cookie, 7 days): keeps you signed in. Secure, HttpOnly, SameSite=Strict.
- CUSTOM_LANG (cookie, 1 year): remembers your language.
- theme (browser local storage): remembers light/dark mode.
No analytics, advertising or social media cookies are set, so no consent banner is required.
Security
Passwords are hashed (bcrypt), connections are encrypted (HTTPS/HSTS), IP addresses used by the launcher are pseudonymised with a keyed hash (HMAC-SHA256), and login attempts are rate-limited against brute-force attacks. Database access is restricted to administrators.
Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection (Art. 15-21 GDPR), and the right to set instructions regarding your data after your death.
- Export your data: Client Area → "Download my data" (JSON file).
- Delete your account: Client Area → "Delete my account". All data tied to your account is erased immediately; configs you shared stay available but anonymised.
- Any other request: email contact@matrixblue.eu. We answer within one month.
If you believe your rights are not respected, you may lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the authority of your country of residence.
Changes
This policy may be updated to reflect changes to the service or regulations. The last update date is shown at the top of this page.