Privacy information

Operator and purposes

The verified identity and contact details of the person or organisation responsible for this website have not yet been published. These disclosures, the applicable legal bases and contact procedures must be completed before commercial release. VESPER Admin is a product name, not a substitute for the legal operator’s identity.

The intended account processing supports Steam sign-in, purchase verification, licence administration, seat assignments and protection against replay, fraud and unauthorised access. Infrastructure providers also process technical requests needed to deliver and secure the website.

• Legal notice and disclosure status

Information used by the account service

Steam sign-in verifies a 17-digit Steam ID. The application does not ask for your Steam password or request your friends list. The account database holds Steam IDs, hashed session and login-security values, expiry times, order identifiers and payment status, price and currency, licence and seat assignments, hashed server keys, and limited payment-event records.

A licence owner can enter other users’ Steam IDs. Those users’ IDs are then associated with the owner’s licence and visible to that owner. Owners should inform their team before assigning their identities. The information and rights process for people whose data is supplied by an owner must be completed before release.

Payments and external services

Stripe-hosted Checkout is the selected payment integration. When an authorised checkout is started, the server sends Stripe the owner Steam ID together with internal order, product and price identifiers to reconcile the transaction. Payment and billing details entered in Stripe’s checkout are handled by Stripe; the VESPER commerce database does not store card numbers or bank credentials. The actual Stripe test checkout and its privacy behaviour still require end-to-end verification.

The website is hosted through Sites on Cloudflare infrastructure. Cloudflare also provides domain and DNS services. Supabase hosts the server API and PostgreSQL database in Frankfurt. Valve operates Steam identity verification. These services have their own applicable privacy information and contractual roles; they should not all be described as VESPER processors without reviewing the relevant arrangements.

IP addresses, browser information and request or security logs may be processed by hosting and infrastructure services. The commerce tables do not store visitor IP addresses. Exact log-retention periods, processor agreements, international-transfer safeguards and the final controller disclosures still require verification.

• Stripe privacy information
• OpenAI privacy information
• Cloudflare privacy information
• Supabase privacy information
• Steam privacy information

Cookies and browser storage

The implemented Steam sign-in flow uses __Host-vesper_steam_nonce, a login-security cookie with a ten-minute lifetime, and __Host-vesper_session, a session cookie with a seven-day lifetime. Both are Secure, HttpOnly and SameSite=Lax. Signing out invalidates the current application session.

The current storefront does not include advertising pixels or analytics trackers, and its fonts are served from this website. Its account and checkout screens do not use localStorage or sessionStorage for account data. The decorative particles do not transmit data. An available checkout redirects to Stripe after sign-in. Stripe’s hosted services may use additional cookies or browser storage under Stripe’s privacy information; their actual behaviour must be checked before release.

Retention and security

Session and login records have validity limits. Physical cleanup is bounded and happens during later login starts, so an expired record is not necessarily deleted at the instant its validity ends. Orders, licences, seat assignments and payment-event records currently have no automatic deletion schedule.

Before commercial release, retention periods or clear retention criteria must be adopted for each purpose, including necessary accounting, dispute and security records. The final notice must distinguish those records from data that can be removed sooner. No fixed deletion period is promised here for infrastructure logs or purchase records.

Private server keys are stored as hashes and are revealed to the licence owner only when generated. Payment API keys and private server credentials do not belong in public mod packages. Access controls reduce risk; this page does not promise that any service is immune to incidents.

Your rights and the remaining contact requirement

Where applicable, data-protection law provides rights of access, correction, erasure, restriction, portability and objection, and a right to complain to a supervisory authority. Any processing based on consent must allow that consent to be withdrawn. The availability of a particular right depends on the processing and its legal basis.

A verified operator contact for privacy requests has not yet been configured. This must be supplied and supported by a working request process before release. Provider privacy links let you contact those providers about their own processing; they do not replace the operator’s responsibilities.

• Contact status