This is a translation for convenience. In case of any difference, the Portuguese version prevails.
1. Who handles the data
HY STUDIOS TECNOLOGIA LTDA, CNPJ 69.688.115/0001-17, is the controller of the data of store owners, their teams and visitors of the hystore.com.br website.
In stores created on the platform, the store owner decides about the data of players and buyers (controller), and Hystore processes this data on their behalf (processor). For matters about this data, talk to the store first; each store privacy policy is in its footer.
Channel for privacy matters and to reach the data protection officer: contato@hystore.com.br.
2. What data we process
Store owners and teams:
- Name, email and password. The password is stored only as a cryptographic hash (bcrypt), never as text.
- Email confirmation code, two-step verification secret and recovery codes, and open sessions.
- Stores, settings, published content and actions in the panel, recorded with date and IP address in the activity log.
- Subscription: plan, status, dates and invoices. Card data stays with Stripe or Asaas; Hystore keeps only the customer and subscription identifiers and, with Asaas, the card brand and last four digits. When the card is entered on the panel form, the number, expiry date, security code and cardholder data (name, e-mail, CPF or CNPJ, phone and address) pass through Hystore servers, over an encrypted connection, only to be sent to Asaas, and are neither stored nor logged; each submission is recorded only with the store, the account, the result, the IP and the time, for 90 days, to prevent fraud. With Pix, Hystore keeps the payer name and the masked CPF or CNPJ; the full CPF or CNPJ and the address asked for Automatic Pix go only to Woovi.
- Credentials you connect: payment providers, Discord bot token and access to the server authentication database, stored encrypted.
- Hystore partners: name, email, region, logo and site texts, Pix key and CPF or CNPJ (stored encrypted), commissions and payouts. The partner sees the name and plan of the stores that used their coupon and whether they are paying, never the owner, the email or payment data. To prevent fraud, we compare a digest of the CPF or CNPJ of who paid the store with the partner one and with other accounts that used a coupon; the digest does not turn back into the number.
- Entries and receipts of the finance module, when used.
- Questions asked to Hyler and the acceptance of the terms (version, date, IP and browser).
Players and buyers of the stores (on behalf of the store owner):
- Name, email, in-game nickname, password (stored as a cryptographic hash), language and, when provided, date of birth.
- Game account identifier (UUID). When signing in with a Microsoft account, the launcher sends a token that Hystore uses to confirm the profile with the Minecraft services.
- Orders, items, coupons, gifts, store balance, payments (status, method and transaction identifier at the payment provider) and access to digital products, with the number of downloads.
- Ticket messages, forum topics and replies, reactions, form answers and wiki ratings.
- Ranks, playtime and presence on the server (nickname, UUID, join and leave), sent by the plugin on the store server.
- Discord link: identifier, username and avatar.
- Android launcher: crash report (device model, Android and app version, graphics renderer, error stack and log excerpt) and graphics card report.
Visitors of the hystore.com.br website:
- The website does not use third-party tracking cookies or third-party analytics tools.
- Whoever comes through a Hystore partner link gets the hy_ref cookie, holding only the partner address, for 30 days, so sign up in the panel brings their coupon. The visit is counted from a digest of the IP address and browser with the date of the day, which does not turn back into the IP and is erased within 2 days.
- Preferences stay only in your browser: light or dark theme, currency and the conversation with Hyler.
- Questions asked to the website Hyler and the IP address, used to limit abuse.
All Services generate technical logs (which may contain IP address, date and time) for security and bug fixing.
3. What we use the data for
- Providing the contracted Services: creating and keeping the account and store, processing orders, delivering purchases and digital products, sending account and store emails (legal basis: performance of contract).
- Charging plans and meeting tax, accounting and legal obligations (legal basis: legal obligation and performance of contract).
- Protecting the platform and people: anti-bot check at sign up and sign in, attempt limits, activity log, investigation of fraud and abuse (legal basis: legitimate interest and fraud prevention).
- Answering questions through Hyler and generating the finance analysis, when you use these features (legal basis: performance of contract).
- Improving the Services with usage data and crash reports (legal basis: legitimate interest).
- Exercising rights in proceedings and responding to authorities (legal basis: regular exercise of rights and legal obligation).
We do not sell personal data and we do not use store players data for Hystore advertising.
4. Who we share it with
We share only what is needed with providers that help us deliver the Services:
- Stripe: billing of Hystore plans, and payments in stores that use it.
- Asaas: billing of Hystore plans by card, for stores in reais, with the card and cardholder data (name, e-mail, CPF or CNPJ, phone and address) and the payer IP, entered on the Asaas payment page or on the Hystore panel form, which passes them to Asaas without storing them.
- Woovi: billing of Hystore plans by Pix and Automatic Pix, with the payer name, CPF or CNPJ and, for Automatic Pix, the payer address and the account e-mail.
- Mercado Pago, PayPal and PicPay: payments in stores that connect them, with the store owner own account.
- Cloudflare: DNS, content delivery, file storage (images, digital product files, launcher builds and backups) and anti-bot check (Turnstile).
- Anthropic: artificial intelligence model of Hyler and the finance analysis.
- Umbler: sending emails.
- Google (AdSense): ads in stores on a free plan, when opened through the Hystore address and only after the visitor accepts.
- Discord: running the store bot and account linking.
- Microsoft and Mojang: profile confirmation when signing in with a Microsoft account.
- The infrastructure provider where our servers are hosted.
A store players data is visible to the store owner and their team, according to each person permissions. We may also share data when the law or an order from an authority requires it.
5. Transfers to other countries
Some of these providers, such as Stripe, Cloudflare, Anthropic, Discord, Microsoft, PayPal and Google, may process data outside Brazil. These transfers follow the LGPD and rely on the contractual data protection safeguards offered by these providers.
6. How we protect the data
- Encrypted connection (HTTPS) on every address.
- Passwords stored as cryptographic hashes (bcrypt) and two-step verification for the panel.
- Payment provider credentials, Discord tokens, access to external databases and license keys stored encrypted.
- Panel session in cookies that the page JavaScript cannot read, ended on logout.
- Isolation between stores: every query is limited to the store of whoever asks.
- Database backups every 6 hours, encrypted, kept for up to 30 days.
- Internal access restricted to whoever needs it.
No system is completely immune. If an incident may cause relevant risk, we notify those affected and the Brazilian National Data Protection Authority (ANPD), as required by law.
7. How long we keep it
- Store owner account: while it is active. Deletion can be requested through the contact email.
- Store: when the plan expires and the store is suspended, it is deleted 20 days later (10 days, if the suspension came from a refund). Media files are erased and the store record is deactivated. Orders and payments may be kept for the time required by tax and accounting laws.
- Player: can delete their own account in the account area of the store. Name, email, nickname, date of birth, password and external identities are erased and the account becomes inactive; orders and transactions remain as accounting records. An account with store balance can only be deleted after the balance is used.
- General Hyler answers, without personal data, are kept for up to 30 days to answer faster.
- Backups: up to 30 days.
- Panel activity log (with date and IP): kept as a security record of the store.
- Application technical logs: up to 14 days, or longer when there is a legal obligation or a request from an authority.
- Digest of visits through partner links: up to 2 days. Partner commissions and payouts: for the time required by tax and accounting laws.
8. Your rights
Under the LGPD, you can ask for: confirmation that we process your data, access to it, correction, anonymization, blocking or deletion of what is unnecessary, portability, information about who we share it with, review of automated decisions and withdrawal of consent, when consent is the basis of the processing.
Ask by email at contato@hystore.com.br. We may ask to confirm your identity before answering. If you are a player of a store, the request is made to the store owner, and we help them answer.
You can also complain to the Brazilian National Data Protection Authority (ANPD).
10. Children and teenagers
Store owner accounts are for people over 18 or who are represented. Game stores may have underage players: handling their data must follow their best interest, as required by article 14 of the LGPD, and it is up to the store owner to obtain the consent of parents or guardians when the law requires it.
11. Changes to this policy
We may update this policy. The date at the top shows the version in force, and relevant changes are announced by the account email or in the panel.