Skip to content
CtrlPanel Market
Sign in

Privacy policy

Last updated: 21 October 2026

This policy explains which personal data we process when you use market.ctrlpanel.gg (the "Marketplace"), why we do it and which rights you have.

1. Controller

Ctrlpanel OSS Software E-mail: info@ctrlpanel.gg

We have not appointed a data protection officer, as we are not legally required to.

2. Hosting and server logs

The Marketplace runs on servers of netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, in a data centre in Germany. netcup processes the data on our behalf under a data processing agreement (Art. 28 GDPR).

Every time you open a page, the web server logs your IP address, the date and time, the requested address, the referring page, your browser's user agent, the status code and the amount of data transferred. The application also writes error logs, which can contain the same information. We use these logs to run the Marketplace securely and to find errors. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in secure and stable operation). The logs are deleted after 14 days at the latest.

To protect against abuse, the number of requests per IP address or account is counted for some actions (for example sign-in, checkout and downloads). These counters expire after one minute.

3. Cookies

We only use cookies that are technically necessary:

  • ctrlpanel-market-session: keeps your session, for example your cart and your sign-in. It expires two hours after your last activity.
  • XSRF-TOKEN: protects forms against cross-site request forgery. Same lifetime as the session.
  • remember_web_…: keeps you signed in until you sign out, for at most 400 days.

The session data on the server also contains your IP address and browser user agent; it is deleted shortly after the session expires. Legal basis: § 25(2) No. 2 TDDDG for storing the cookies, Art. 6(1)(b) and (f) GDPR for the processing. We do not use tracking, analytics or advertising cookies. Fonts are served from our own server.

4. Account and sign-in with Discord

You sign in with your Discord account. We redirect you to Discord, and with your approval Discord sends us your Discord user ID, user name, display name, the address of your profile picture, your e-mail address and whether Discord has verified it. We store this data in your account and only keep the e-mail address if Discord has verified it. Discord also tells us at every sign-in whether two-factor authentication is switched on for your Discord account; we store only this yes/no value. We need it because administrators must have two-factor authentication and store owners need it to request a payout. Legal basis: Art. 6(1)(b) GDPR (providing your account).

For users in the EEA, Discord is operated by Discord Netherlands BV, Schiphol Boulevard 195, 1118 BG Schiphol, Netherlands. Discord may process data in the USA; according to its privacy policy, Discord complies with the EU-U.S. Data Privacy Framework. Discord's handling of your data is described in its privacy policy.

While you are signed in, your profile picture is loaded directly from Discord's servers (cdn.discordapp.com). Your browser transmits your IP address to Discord for this.

We store your account data for as long as your account exists. You can delete your account yourself (section 13).

5. Data from the previous shop

If you had an account in the previous shop at market.ctrlpanel.gg, we have carried over your account data (name, e-mail address, user name), your orders and your download access, and as a vendor your store data and balance. We did this so that you keep access to your purchases and your balance. Legal basis: Art. 6(1)(b) GDPR (continuing your contracts), Art. 6(1)(c) GDPR (retention obligations) and Art. 6(1)(f) GDPR (our legitimate interest in moving to the new system). Your old account is linked to your Discord account on your first sign-in if your verified Discord e-mail address matches.

6. Purchases and payment with PayPal

When you buy something, we process the order data: the products, prices, order number, time of the order, your account and e-mail address, your confirmation of the checkout note and, if you redeem one, the voucher code. Legal basis: Art. 6(1)(b) GDPR.

Payment is processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. We transmit the order number, the amounts and the product names to PayPal. PayPal sends us the payment status, the PayPal order and transaction IDs, the fees, your PayPal payer ID and the e-mail address of your PayPal account, as well as notifications about refunds and disputes. PayPal is responsible for the data it processes itself; see the PayPal privacy statement. Legal basis: Art. 6(1)(b) GDPR.

Vendors see which of their products were sold, the order number, price, commission and their credit. They do not see your name or e-mail address; if you contact a vendor or review a product, the vendor sees your display name (section 10).

We keep order and payment records for the retention periods required by German tax and commercial law (up to 10 years). Legal basis: Art. 6(1)(c) GDPR.

7. Downloads

When you download a file, we log your account, the product, the file, the time, your IP address and your browser user agent. We use this to prove delivery, for example in a PayPal dispute, and to detect abuse. When a payout is reviewed, our administrators can see whether several accounts that bought from a store use the same IP address, or the same address as the store owner, to detect fake purchases. Legal basis: Art. 6(1)(b) and (f) GDPR. The IP address and the user agent are deleted after 180 days, or immediately when you delete your account; the remaining log entry is kept.

Some products are downloaded from external servers chosen by the vendor. When you open such a link, the operator of that server processes your data under its own responsibility.

8. Vendors

If you open a store, we process your store name and description, the PayPal address for payouts, your declaration that you sell as a private person (with the time of the declaration), your products, your sales, your balance and your payouts, including the PayPal transaction IDs. Your store name, description and products are public. For payouts we transmit your PayPal address and the amount to PayPal. Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for records we have to keep.

Vendors can create vouchers and assign them to specific accounts by entering the account's Discord user name or e-mail address. We store which accounts a voucher is assigned to and show the assigned accounts the voucher under "My vouchers". The vendor sees the accounts they assigned and how often the voucher was redeemed, but not who redeemed it; if a voucher is assigned to a single account, the vendor can tell from this number whether that account used it. We keep the assignment for as long as the voucher exists. Legal basis: Art. 6(1)(b) GDPR (providing the voucher to you) and Art. 6(1)(f) GDPR (the vendor's interest in giving discounts to selected buyers).

9. E-mails

We send you e-mails related to your account: a welcome e-mail, order confirmations, messages in your support conversations, new versions of products you own, vouchers a store gave you, and as a vendor e-mails about your store, sales, reviews of your products and the review of your products by us. Admins receive e-mails about products and reviews waiting for approval. Except for order confirmations and e-mails about your account, you can switch these e-mails off under "Notifications". The e-mails go to the e-mail address from your Discord account and are sent through our own mail server, which is hosted by netcup GmbH in Germany. Legal basis: Art. 6(1)(b) GDPR. We do not send newsletters or advertising.

If you contact us by e-mail or on Discord, we process your message and contact details to answer you. Legal basis: Art. 6(1)(b) or (f) GDPR. Messages on Discord are also processed by Discord.

10. Reviews, support conversations and Discord messages

Reviews. If you review a product, we store the rating, your text, the time and our moderation decision. After approval by our team, the review is public together with your display name; the vendor can publish an answer. You can change or delete your review at any time. Legal basis: Art. 6(1)(b) GDPR.

Support conversations. If you contact a vendor about a product, we store the conversation (subject, messages, times, the product and the related order). The vendor sees your display name and the messages, but not your e-mail address. Our team can read every conversation and answer, for example to settle a dispute. We keep conversations as long as your account exists. Legal basis: Art. 6(1)(b) and (f) GDPR (our interest in resolving disputes).

Discord messages and customer role. Optional notifications (sales, reviews, support messages, product updates, vouchers) are also sent as direct messages by our bot on the CtrlPanel Discord server, using your Discord user ID. Accounts with at least one product in "My downloads" receive the "Customer" role on that server, owners of an active store the vendor role; the vendor role is removed while a store is suspended. For this we transmit your Discord user ID and the message content to Discord. You can switch Discord messages off per topic under "Notifications"; you receive them only if you are on the server and allow direct messages from its members. Legal basis: Art. 6(1)(b) GDPR and, for the roles, Art. 6(1)(f) GDPR (our interest in recognising customers and vendors in our community).

Reports. If you report a product or a review, we store your report (the item, the reason, your optional text of up to 500 characters, the time and the decision). Only our administrators see it. Legal basis: Art. 6(1)(f) GDPR (our interest in a safe marketplace). Reports are kept after you delete your account, without your name.

Notification settings. We store which notifications you switched off. Security notices, for example that the PayPal payout address of your store was changed, and messages to store owners about payout decisions, payment disputes and the status of the store are always sent by e-mail and Discord message and cannot be switched off. Addresses in them are shown in shortened form.

11. Security log

We log security-relevant actions, for example sign-ins linked to an old account, changes to payout addresses, payout decisions and admin actions, together with the IP address. Legal basis: Art. 6(1)(f) GDPR (security and traceability of financial processes). The IP address is deleted after 180 days, or immediately when you delete your account; the entries themselves are kept as long as they are needed as proof of the processes. Administrators also use these IP addresses when they review a payout (section 7).

12. Recipients

Your data is passed on only as described in this policy: to netcup (hosting and e-mail, on our behalf), Discord (sign-in, direct messages and the customer and vendor roles), PayPal (payment and payouts), to vendors (the sales data in section 6 and your support conversations with them, section 10), to the public (approved reviews with your display name, section 10), and to authorities or advisers where we are legally required to.

13. Your rights

You have the right to access your data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). You can download your data and delete your account yourself under "Your data" in the account menu. The download is a JSON file with your profile, orders, downloads, reviews, your support messages, reports and, if you have a store, the store with its products and payouts. When you delete your account, we remove your name, e-mail address, Discord link, profile picture, notification settings, reviews and voucher assignments and the IP addresses in the download and security logs, and we close your store. We keep what we are legally required or entitled to keep: orders and payments without your e-mail address and the accounting records (up to 10 years, Art. 17(3)(b) GDPR), the download history, your messages in support conversations (for the other party and for resolving disputes, Art. 17(3)(e)), reports and the security log. These records are no longer linked to your name; they refer to "Deleted user". Deletion is not possible while money or a payment dispute is open (for example a balance in your store or an unresolved PayPal dispute); the page shows what is missing. You lose access to your purchases. For all other requests, or if you want a message you wrote removed, write to info@ctrlpanel.gg.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement.

14. Further information

You are not obliged to provide your data, but without an account you cannot buy or sell on the Marketplace. We do not use automated decision-making or profiling. The Marketplace is intended for users aged 16 and over.

We update this policy when our processing changes. The current version is always available at market.ctrlpanel.gg/legal/privacy.