This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use the Mastermind - ROK Helper desktop client and the online service available at rokmastermind.com (together, the "Service"). It is written to comply with Regulation (EU) 2016/679 (the "GDPR") and the Polish Act on the Protection of Personal Data of 10 May 2018.
The controller of your personal data is a natural person conducting business activity in Poland under the trade name ALLCOMP, Tax Identification Number (NIP): 6782845831, Statistical Number (REGON): 356356652, registered address: ul. Czarnogórska 18/43, 30-683 Kraków, Poland (the "Controller", "we", "us", "our").
For any matter relating to your personal data or this Policy, please contact us at support@rokmastermind.com.
When you sign in via Discord OAuth, Discord shares the following with us according to the scopes you authorise:
We also request the guilds.join scope, which is used solely to add
you to our official Discord server on request. We do not read the list of servers you belong to.
| Purpose | Legal basis (GDPR Art. 6) | Data used |
|---|---|---|
| Providing the Service (account, license activation, license validation, DM notifications from our Discord bot) | Art. 6(1)(b) — performance of a contract to which you are party | Discord ID, username, email, Governor data, machine fingerprint, hostname, OS, IP |
| Preventing license fraud and abuse (binding activations to hardware, detecting sharing, blocking bans) | Art. 6(1)(f) — legitimate interests (protecting our intellectual property and business) | Machine fingerprint, IP, activation history, audit log |
| Ensuring information security (anti-replay, HMAC signing, TLS pinning, debugger detection) | Art. 6(1)(f) — legitimate interests (protecting the Service and its users) | Request metadata, nonces, session identifiers |
| Complying with legal obligations (tax invoicing, accounting where a paid license is purchased) | Art. 6(1)(c) — legal obligation | Data required by Polish tax law |
| Responding to your enquiries and support requests | Art. 6(1)(b) or Art. 6(1)(f) | The data you provide in your enquiry and account identifiers needed to help you |
We share your personal data only with the following categories of recipients, and only to the extent necessary for the purposes described above.
Discord Inc. (USA) receives certain data from you when you sign in through Discord OAuth and when we send you direct messages via our bot. Discord acts as an independent controller with respect to your Discord account. Its privacy policy is available at discord.com/privacy.
We may disclose your data to public authorities where required by law (e.g. tax authorities, a valid court order, or a lawful request from law enforcement).
We do not sell your personal data to third parties, and we do not use it for advertising or profiling for advertising purposes.
Our infrastructure is located in the European Economic Area (EEA). However, communication with Discord (an entity established in the United States) involves a transfer of personal data outside the EEA. Such transfers are protected either by the EU-US Data Privacy Framework, by Standard Contractual Clauses adopted by the European Commission, or by other appropriate safeguards under Chapter V of the GDPR.
| Category | Retention period |
|---|---|
| Active account and license data | For as long as your account is active |
| Account data after account deletion | Deleted or anonymised within 30 days of your request or 6 months of inactivity, unless a longer period is required by law (e.g. tax records) |
| Audit log of administrative actions | 12 months |
| Server access logs (IP, endpoint, timestamp) | 30 days for operational logs; 12 months for security-relevant events |
| Anti-replay nonces | Purged automatically after their validity window (typically minutes) |
| Invoicing / accounting data (paid licenses) | 5 years from the end of the tax year, as required by Polish tax law |
Under the GDPR you have the right to:
To exercise any of these rights, contact us at support@rokmastermind.com. We will respond within one month, extendable by up to two further months where necessary due to the complexity or number of requests.
The website uses only strictly necessary cookies: session cookies for user and admin authentication, and a CSRF-protection cookie. These do not require your consent under Article 5(3) of the ePrivacy Directive and Article 173 of the Polish Telecommunications Act.
The desktop Software stores a local encrypted cache of your license information and API session keys on your device (under the application's data directory). This information does not leave your device except when needed to communicate with our servers.
We do not use advertising cookies, tracking cookies, or third-party analytics.
The Service is not directed at children under 16. We do not knowingly collect personal data from a person under 16. If you become aware that a child under 16 has provided us with personal data, please contact us and we will delete it.
We do not use your personal data for solely automated decision-making that produces legal or similarly significant effects on you within the meaning of Article 22 of the GDPR.
We implement technical and organisational measures appropriate to the risk, including:
No system is perfectly secure. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the supervisory authority in accordance with Articles 33 and 34 of the GDPR.
We may update this Privacy Policy from time to time. The "Effective date" at the top of the document indicates when the current version took effect. Material changes will be announced at least 14 days in advance via email to the address associated with your account and/or via a notice in the Service.