Privacy Notice

1. Controller and scope

HyperGamers, the operator of HyperMine, controls the processing described here when it decides the purposes and means. This notice covers the Minecraft network and HyperMine web portals. The operator card gives the privacy contact channel; some providers, including Tebex, are also independent controllers for their own operations.

This notice has global scope. Mandatory rights in your country or state also apply. We honour more protective local rules and may publish a regional supplement where needed.

2. Data we may process

• Account and identity: HyperID, username, Minecraft UUID, verified email, language, avatar, optional Microsoft, Discord or supported social links, and preferences.
• Authentication and security: password hash, 2FA/passkeys, sessions, login dates, IP address—including encrypted or masked storage—device, browser, anti-fraud signals, and audit records.
• Gameplay: servers, playtime, statistics, progress, virtual economy, friends, blocks, messages, reports, sanctions, and appeals.
• Support and community: tickets, messages, files, videos, evidence, surveys, and staff communications.
• Applications: date of birth, declared name, interests, occupation, availability, experience, form answers, linked Discord, project links, media portfolios, eligibility checks, and the Human Resources decision.
• Commerce: products, digital entitlements, HyperCoin balance, subscriptions, transaction state and identifiers. HyperMine does not need to store the full card number entered into Tebex.
• Technical data: requests, errors, performance, settings, strictly necessary cookies, and local storage for session, security, language, theme, or cart.
• Legal evidence: accepted versions, time, channel, language, user agent, origin, and encrypted or masked address where available.

3. Sources

We obtain data directly from you and service use; network infrastructure; Microsoft/Mojang, Discord, Google/YouTube, Twitch, TikTok, Meta/Instagram or Kick when you link an account, and public profiles featured in the creator showcase; Tebex when it confirms a purchase; and other players or staff submitting a report, sanction, appeal, or social interaction.

4. Purposes and legal bases

• Contract or pre-contract steps: create and manage accounts, authenticate, provide the game and portals, support requests, requested actions, and purchase or subscription fulfilment.
• Requested steps to join a team: verify requirements, review the application, prevent duplicate or abusive submissions, communicate the decision, and make contact through Discord when accepted.
• Legitimate interests: secure accounts and network, prevent fraud and abuse, moderate, keep audits, diagnose errors, measure performance, defend claims, and send essential notices. We assess that these interests do not improperly override your rights.
• Legal obligations: answer valid authorities, retain business or security records, and follow tax, accounting, consumer, sanctions, and child-protection rules where applicable.
• Consent: optional promotional messages, non-essential cookies, or integrations where law requires it. You may withdraw without affecting earlier processing. We do not condition service on unnecessary consent.
• Vital interests or public interest: only in exceptional situations recognized by law, such as a serious threat to someone’s safety.

5. Recipients, providers, and payments

Access is limited to authorized personnel and providers needing data for their role. Under the current configuration reported by the operator, infrastructure may be hosted with OVHcloud in the United States or Canada and IONOS in the United States. Mailgun/Sinch transports email; Tebex processes checkout and payments as Merchant of Record; Microsoft/Mojang provides Minecraft identity; and Discord is involved only in the relevant integration or community.

Tebex determines some processing needed for payment collection, verification, tax, fraud, refunds, and chargebacks. Its privacy notice applies. HyperMine receives confirmation and identifiers needed for fulfilment and support, not full card details.

We may also disclose data to advisers, insurers, business successors, or authorities where a legal basis, necessity, and appropriate safeguards exist. We do not offer personal databases for sale or use cross-context behavioural advertising. Disclosures to creators are described in their own section.

6. Social accounts, permissions and visibility

Accounts and the creator portal share the same connections. Depending on the provider and permissions you authorize, we store the stable account or channel ID, username and public name, URL, avatar, available follower or subscriber count, verification status and dates, and encrypted OAuth access and refresh credentials. We do not receive your social password. Current permissions read identity and those metrics; they do not publish, read private messages or manage your content.

The requested link verifies ownership and keeps your social profile URL current, including in the game through SocialProfiles. The verified name and URL become part of that profile and may be viewed by other users through the service’s visibility features. If you select channels for an application, the marketing team reviews their identity and metrics to assess requirements and manage the collaboration. The public creator showcase contains the profile, image and links published for that collaboration.

Optional provider authorization relies on your consent; handling the application or collaboration you request relies on the applicable pre-contract or contract basis. You do not need creator status to connect an account. Instagram OAuth verification supports professional accounts admitted by its API; a manual link, where offered, neither verifies ownership nor updates automatically.

You may withdraw through Accounts or Creator connections and through the provider, even with an open application. Disconnecting removes credentials and linked channel data from our active database, its synchronized profile link and authorized showcase metadata. It does not delete data at the external platform. Synchronization failures may require retries; contact privacy support for help and deletion.

7. Google and YouTube information

We use YouTube API Services. Google’s Privacy Policy is linked on this page. You can also revoke access through your Google account permissions. Use and transfer of information received from Google APIs will comply with its User Data Policy, including Limited Use requirements where applicable. We do not use it for personalized advertising, data sales or training general-purpose AI models.

API data subject to the 30-day rule is refreshed or deleted. Requested deletion or revoked access is handled as soon as possible and within the seven-day deadline applicable to those requests. Deleting data at HyperMine does not delete YouTube content. Contact privacy support with questions or complaints.

8. Campaigns, domains, referrals and creator access

The initial connection domain (access_domain), registration date and player ID classify origin as direct entry, referral, server list, acquired domain or server, or creator. Authorized staff may correct the domain with an audit record. We combine origin with subsequent purchases, activity, sessions and sanctions to evaluate acquisition and profitability, including purchases after the advertising month. Country comes from the profile or an IP estimate; the map does not expose precise location.

Authorized staff view costs, revenue and profit after taxes and fees where available, and composition of registrations, web access and online players. This does not track your browsing across other websites. Evaluating our campaigns and preventing incorrect attribution relies on legitimate interests, subject to necessity, proportionality and your right to object; collaboration payments also use the applicable contractual or legal basis.

An active creator may see players attributed to their domains: game ID and username, profile or avatar, registration date, account type, approximate country and online presence. They see aggregate sanctions and playtime statistics and historical online counts. Creators with revenue participation may view attributed purchases with player name and ID, product, date, status, purchase amount, taxes and commission needed to verify that participation. This is disclosed to that creator, not to the public or other creators.

The creator portal does not disclose the buyer’s email, IP address, password, private messages or full card details. Access is limited to the relevant collaboration and ends with it. Unauthorized disclosure or commercial contact is prohibited. You may request origin correction, object to legitimate-interest processing and request human review of attribution or new-subscription restrictions; requests are assessed and any lawful exception explained.

For creators we also process individual agreements, rates, collaboration status and history, settlement references, costs and encrypted Tebex Wallet reference. Management access is limited to the account holder and authorized staff. Tebex processes checkout, commission allocation and withdrawals under its policy; panel amounts may await reconciliation.

9. International transfers

The providers and servers above may process data outside your country, including in the United States and Canada. For data under GDPR, UK GDPR, or similar transfer rules, we use the required mechanism: adequacy where available, standard contractual clauses or another valid instrument, plus suitable contractual, access, and security measures. You may request information about applicable safeguards through support.

10. Retention

Specific periods depend on purpose, the ongoing relationship, data sensitivity and applicable legal periods. Contact privacy support for the period or criterion applicable to your data. Potential future statistical value does not justify indefinite retention of identifiable information.

• Account and progress: while active, then only as reasonably needed for closure, restoration, disputes, security, and legal obligations.
• Acceptance receipts: for the relationship and the later period needed to prove the accepted version and establish or defend rights.
• Security, sanctions, and audit: based on severity, repeat risk, appeals, and legal periods; reduced or anonymized when no longer needed.
• Purchases and accounting: for applicable tax, accounting, chargeback, and consumer periods.
• Support and files: during handling and a proportionate follow-up period for continuity, abuse, and claims.
• Applications: during assessment and afterwards for the proportionate period needed to enforce the submission interval, document decisions, handle claims, and manage any resulting engagement. Portfolios and answers are deleted or minimized when no longer needed; a permanent block retains only the minimum record needed while it remains active.
• Social API data and credentials: while the connection is authorized and needed, subject to provider refresh and deletion limits. Local disconnection and detected revocation remove credentials; loss of verification removes API identity and metrics. Application, payment and audit evidence is kept separately only as necessary for lawful claims or duties; it is not a reason to retain revoked tokens.
• Attribution and collaborations: identifiable information only while needed for active attribution, justified settlement, disputes or legal duties; ending a collaboration removes its portal access. Older analysis should use anonymous aggregates when player identity is no longer needed.
• Backups: rotated for a limited period and isolated until overwritten, unless a legal hold or incident applies.

11. Security

We use proportionate technical and organizational controls, including password hashing, 2FA/passkeys, address encryption or masking where appropriate, TLS, permissions, rate limits, audit logs, backups, and incident procedures. No system is infallible; where a breach requires notice, we notify authorities and affected people within applicable legal deadlines.

12. Your rights in any region

Depending on where you live, you may request access/knowledge, correction, deletion, portability/copy, restriction, or objection; withdraw consent; appeal a refusal; and complain to an authority. We verify identity proportionately and answer within the legal deadline. We limit or refuse only under a valid exception and explain why where required.

You may use an authorized agent where allowed. We do not discriminate for exercising rights. Some data cannot be deleted immediately where needed for security, free expression, legal compliance, transactions, claims, or others’ rights.

13. Regional information

• EEA, United Kingdom, and Switzerland: access, rectification, erasure, restriction, portability, objection, and complaint to the authority where you live or work. You may object to legitimate interests; objection to direct marketing is absolute.
• United States: applicable state laws may grant knowledge/access, correction, deletion, copy/portability, opt-out of sale, sharing or targeted advertising, sensitive-data limits, appeal, and non-discrimination. Any applicable opt-out of sale, sharing or targeted advertising can be exercised through the privacy contact; disclosures to creators are described in this notice. California also permits requests for categories, sources, purposes, and recipients.
• Canada: you may know about existence, use, and disclosure, access, correct, and challenge compliance; we apply accountability, identified purposes, minimization, safeguards, and openness under applicable law.
• Brazil: the LGPD may grant confirmation, access, correction, anonymization/blocking/deletion, portability, sharing and consent information, revocation, and review of automated decisions.
• Australia and New Zealand: you may request access and correction and complain about compliance with applicable privacy principles; transfers and breaches follow the relevant local rules.
• Other countries: we honour equivalent rights and mandatory localization, representative, consent, or retention requirements for a service offered in your territory.

14. Exercising rights

Submit a support request marked “Privacy” and name the right you want to exercise. Never include passwords or 2FA codes. We may request limited information to verify account ownership. If dissatisfied, request review or contact the competent privacy authority where you live.

15. Cookies and browser storage

We use technologies needed for authentication, session and CSRF security, language or theme, cart, and requested functions. Externally hosted images, embedded players and checkout may send your IP address, headers and technical information to their provider when loaded. Third-party services, including YouTube, may display advertising and use their own technologies under their policies. Non-essential technologies subject to consent require prior information and authorization that can be withdrawn; general acceptance of terms does not replace it.

16. Moderation and automated decisions

Rules and automated signals may detect fraud, abuse, spam, or risk and prioritize reviews. We do not intend solely automated decisions with legal or similarly significant effects without the safeguards, information, and human review required by law.

17. Children’s privacy

We do not direct the service to children under 13 or knowingly collect their data without required authorization. Higher local digital-consent ages apply. If you believe a child supplied data improperly, contact support; we will verify and delete or restrict it where appropriate.

18. Changes and contact

We publish the version and effective date. For material changes, we may send a service email and request a fresh acknowledgement. Acceptance history is not used as blanket consent.

Use the operator card for questions, rights, or complaints. The operator card identifies the controller and its contact details. This channel also handles questions about a regional representative or data protection officer where appointed or required.