Privacy Policy
Last updated: June 2026
Solen Plugins respects your privacy and is committed to transparency in the processing of your personal data. This Privacy Policy explains how we collect, use, store and protect your personal information in full compliance with the General Data Protection Regulation (GDPR) and applicable Portuguese laws.
Please read carefully. If you have questions, contact us at [email protected].
Table of Contents
Data Controller
Solen Plugins is the controller responsible for processing personal data collected through the website solenplugins.com.
For any privacy inquiries, contact: [email protected]
What Personal Data Do We Collect?
Solen Plugins collects only personal data necessary to provide our services:
2.1 — Authentication and Account Data
- Email — for account verification, authentication and transactional communications
- Username — for system identification
- Password — stored in hash format (never in plain text)
- Session Tokens — to keep you authenticated (expires in 1-7 days)
2.2 — Transaction and Payment Data
- Email — shared with Stripe for payment processing
- Transaction amount, currency, reference
- Payment status
- Purchase history
We do not collect or store credit card data. Stripe is responsible for that information per their Privacy Policy.
2.3 — Plugin License Data
- License keys — generated after purchase
- Minecraft server IP (optional) — for license validation
- Activation fingerprint — for tracking activations
2.4 — Support Data
- Support ticket content — any information you share with us
- Contact email
2.5 — Technical and Preference Data
- Language preference
- Theme preference (dark/light)
- Functional cookies (only necessary for website functionality)
Legal Basis for Processing
The GDPR requires us to explain the legal basis for collecting data:
3.1 — Contract Performance (Article 6(1)(b) GDPR)
We collect authentication, transaction and license data because they are necessary to fulfill the plugin sales contract. Without this data, we cannot deliver the product or process your payment.
3.2 — Legal Obligation (Article 6(1)(c) GDPR)
We collect transaction data due to legal retention requirements.
3.3 — Legitimate Interest (Article 6(1)(f) GDPR)
We may send communications about product updates, account security or compliance based on our legitimate interest in maintaining a secure and functional service. You always have the right to object.
With Whom Do We Share Your Data?
We only share personal data with third parties when absolutely necessary:
4.1 — Stripe (Payment Processing)
Data shared: Email, user ID, transaction amount, reference. Stripe is a legitimate data processor with adequacy certification for EU/US transfers.
4.2 — Brevo (Transactional Email Sending)
Data shared: Email, username, verification tokens. Brevo is a European company (France) processing authentication and password recovery emails.
We do not sell, rent or share data with third parties for marketing purposes.
How Long Do We Retain Your Data?
According to GDPR (Article 5), we retain data only as long as necessary:
- Email and Username — while your account is active
- Password (hash) — while your account is active
- Session Tokens — 1-7 days (automatically expire)
- Transaction Data — 6 years (legal compliance requirement)
- License Keys — while the license is valid
- Support Tickets — 3 years (dispute resolution)
Cookies and Similar Technologies
We use minimal cookies only for essential functionality. We do not use analytics cookies (Google Analytics, Hotjar, etc.) or marketing cookies. Your browsing is not tracked for advertising purposes.
Your GDPR Rights
You have fundamental rights regarding your personal data:
7.1 — Right to Access (Article 15 GDPR)
You can request a copy of all data we hold about you. Contact [email protected] with subject "Data Access Request".
7.2 — Right to Rectification (Article 16 GDPR)
You can correct inaccurate data on your settings page or by contacting support.
7.3 — Right to Erasure (Article 17 GDPR)
You can request deletion of your account and all personal data (except data retained by legal obligation). After 30 days notice, we will proceed with deletion. Contact [email protected] with subject "Request Account Deletion".
7.4 — Right to Data Portability (Article 20 GDPR)
You can request a copy of your data in machine-readable format (CSV or JSON). Contact [email protected] with subject "Data Portability Request".
7.5 — Right to Object (Article 21 GDPR)
You can object to data processing based on legitimate interest. This will affect only non-essential communications. Legal communications (security, compliance) will continue.
Security of Your Data
Under GDPR (Article 32), we implement technical and organizational measures to protect your data:
- Passwords stored in BCrypt hash (never in plain text)
- Sensitive data (Stripe keys, Brevo credentials) stored in environment variables, not in code
- PostgreSQL database with authentication
- HTTPS connections for all traffic
- No credit card data stored locally (Stripe is responsible)
International Data Transfers
Stripe (US) has adequacy decision for EU-US transfers via Standard Contractual Clauses. Brevo is EU-based.
We do not transfer to countries without adequate protection.
Changes to This Policy
We may update this Policy. Important changes will be communicated by email or website notification. Continued use implies acceptance of changes.
Contact and Complaint Rights
For privacy inquiries: [email protected]
- Portuguese Data Protection Commission (CNPD): www.cnpd.pt
- Online Complaints Book: www.livroreclamacoes.pt
If you believe your rights have been violated, you can file a complaint with:
Have questions about your privacy? We are available to help.