Privacy Policy

1. Data controller

• Controller: Ariel Rodríguez
• Website: cobayka.es
• Contact email: ariel@cobayka.es

For any matter related to your data or this policy, the contact channel is the email ariel@cobayka.es.

2. What data we collect

We only process the data you provide and what is strictly necessary for the site to work:

• Contact form: name, email, phone (if you provide it), company or project, the type of service, the rough budget and timeline, and the project description.
• Direct communications: the data you include if you write to us by email.
• Browsing data: basic technical information recorded in the server logs (IP address, device and browser type), used only for security and operation. The site does not use cookies.
• Plugin downloads: when you download a free plugin from the site we don't ask you for any data; only the usual technical server record remains (the same IP and browsing data as above). What the plugins do once installed is detailed in section 8.

We do not collect special categories of data (health, ideology, etc.) or deliberately collect data from minors.

3. Purpose of the processing

• Handle your contact request and reply to you.
• Prepare and send you a service proposal tailored to what you ask.
• Manage the relationship if you eventually hire a service.
• Keep the website secure and working properly.

We do not use your data for advertising or build profiles with automated decisions.

4. Legal basis

• Consent (art. 6.1.a GDPR): given when you submit the form or write to us.
• Pre-contractual measures (art. 6.1.b GDPR): when the data is needed to prepare a proposal or perform a contract.
• Legitimate interest (art. 6.1.f GDPR): to ensure the security of the site.

5. How long we keep it

We keep your data for as long as needed to handle your request and, if there is a contractual relationship, for its duration and the applicable legal periods (tax, commercial). When it is no longer needed, it is securely deleted.

6. Recipients and processors

We do not sell or transfer your data to third parties. To provide the service, the following providers —as processors, under contract— and recipients are involved:

• Hosting and infrastructure: OVH (OVH Hispano S.L.U. / OVH SAS, within the EU), provider of the server where the site is hosted and where the messages you send through the form are stored.
• Email: OVH (professional mailbox associated with the domain), to receive and reply to communications.
• Telegram: when you submit the form, alongside the email we receive a notification through our own Telegram bot, so we can get to you sooner. That notification includes the data you wrote. Telegram (Telegram FZ-LLC) acts as a recipient of that notification —not as a processor under contract with us— and handles it outside the European Economic Area (see section 7). If you prefer to avoid that channel, you can write to us directly at ariel@cobayka.es instead of using the form.
• Plugin marketplaces (for example Polymart or BuiltByBit): only if you buy a paid version of a plugin, to validate your licence. They receive the licence key, not your contact details.

We also use Google Search Console to monitor the site's ranking; this tool does not install cookies in your browser or process identifiable personal data of visitors.

Data will only be disclosed to other third parties when there is a legal obligation.

7. International transfers

The site and the messages you send us are hosted entirely within the European Union (OVH), and we do not load third-party services that track the visitor. The only flow of data outside the European Economic Area is the Telegram notification of form submissions, to Telegram FZ-LLC (United Arab Emirates), a country with no European Commission adequacy decision and for which we do not apply standard contractual clauses. This transfer relies on your explicit consent (art. 49(1)(a) GDPR): by submitting the form you authorise it, informed of the absence of adequacy safeguards and the risk it entails. If you prefer not to authorise it, write to us directly at ariel@cobayka.es: through that channel your data does not leave the EEA.

8. The plugins we publish (Bulwark, TimeGate)

At cobayka we publish some plugins for Minecraft servers. The key point: these plugins run on your own server, not ours, and by default they send us no data.

• Bulwark is a security auditor: it reviews your server's configuration —read-only, it changes nothing— and gives it a grade from A to F, with the weak points and how to fix them. All of that analysis happens on your server and the report stays with you; it is not sent to us. The part that inspects the operating system (file permissions, processes) is off by default and only runs if you enable it with a command; even then, that information never leaves your machine.
• TimeGate opens and closes access to your server on a schedule you set. It also runs entirely on your server and does not collect your players' personal data for us.

Paid versions and licensing. If you buy a paid version of a plugin, its licence is validated against the marketplace where you bought it (Polymart, BuiltByBit) using the licence key. To prevent a single-seat licence from being shared, our licence server may record its usage with the IP masked (partial) and a hash of the key —never the key in clear or the full IP—. We do not collect any data about your server's players.

9. Client area

The site includes a client area (/cuenta) meant for buyers of a paid plugin to link their licence and open support tickets. It is currently closed and not accessible to the public. When it opens, it will work without a password: your identity will be your licence verified against the marketplace. In that case we would process the link to your licence, the content of the tickets you open (which reach us as a Telegram notification) and an access log with the IP masked, solely to provide you with support. None of this is active at present.

10. Your rights

You can exercise at any time your rights of:

• Access to your data.
• Rectification of inaccurate data.
• Erasure ("right to be forgotten").
• Objection to the processing.
• Restriction of the processing.
• Portability of your data.
• Withdraw the consent given, without retroactive effect.

To exercise them, write to ariel@cobayka.es stating the right you wish to exercise. You can also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe the processing does not comply with the rules.

11. Cookies

This site does not use cookies: no technical, analytics or third-party cookies. That is why no cookie notice is shown either. Fonts are self-hosted and no analytics or external resources that could track you are loaded.

12. Security

We apply reasonable technical and organisational measures to protect your data against unauthorised access, loss or alteration (encrypted HTTPS connection, access control and site security measures).

13. Changes to this policy

We may update this policy to adapt it to legal or service changes. We will publish any change on this same page, stating the date of the last update.