1. Controller and scope
The controller of personal data relating to NexNode is M.O. Società a Responsabilità Limitata Semplificata, VAT and tax code 09508751212, registered at Piazza Montessori 11, 80011 Acerra (NA), Italy. Contact: info@movara.it; certified email (PEC): mosrls@pec.cgn.it.
This notice covers the NexNode website, accounts, dashboards, Server & Bot hosting, Web Hosting, hosted websites, File Manager and SFTP, paid plans, credits, referrals, support systems, and related features. External services reached through links apply their own notices.
2. Personal data processed
- Technical and browsing data: IP address, date and time, requested resources, user-agent, request identifiers, security logs, errors, and network or hosting data.
- Pseudonymous security signals: keyed HMACs of the exact IP, approximate network and a random signed device identifier; ASN and VPN, proxy, Tor or hosting indicators; registration velocity and early credit, Shop and server events. NexNode does not use a hardware fingerprint and does not store raw IPs, network prefixes or device identifiers in the graph.
- Approximate location: country inferred from the IP address and browser language settings, used to propose an available language. NexNode does not determine or store precise GPS location.
- Account data: username, email address, authentication credentials, account identifier, session status, and account-panel information.
- Discord data: Discord identifiers and username, temporary linking tokens, communities, and interactions needed to link an account and use requested Discord features.
- Service data: servers, game and version, settings, permissions, status, operational logs, allocated resources, user files and content, backups where available, and administrative actions.
- Web Hosting data: domains and DNS, application and runtime, site and provider identifiers, SSL, deployments, jobs, databases, backups, SFTP, public keys, file operations, disk and traffic use, web logs, and technical measurements.
- Commercial data: plan, orders, quantities, period, price, tax and invoice details, payment status and references, credit ledger, Shop purchases, refunds, and referrals.
- Communications: support requests, abuse reports, appeals, emails, and messages voluntarily sent through official channels.
- Device preferences: privacy choice, language, and browser access token as described in the Cookie Policy.
3. Sources of data
- The User, during registration, login, dashboard use, server configuration, or support contact.
- Discord and the bot when the User starts or confirms account linking.
- Network protocols, hosting infrastructure, security systems, and service operation.
- Server or community administrators who authorise access to a shared resource.
4. Purposes and legal bases
Website and service deliveryAccounts, authentication, Server & Bot hosting, Web Hosting, websites, dashboards, and requested features.Contract or pre-contractual steps, Art. 6(1)(b) GDPR.
Orders and billingPlans, payments, credits, renewals, invoices, refunds, and referrals.Contract, Art. 6(1)(b); legal duties, Art. 6(1)(c); anti-fraud legitimate interest, Art. 6(1)(f).
Language and accessibilityPropose a language from IP country and browser settings; remember it only with consent.Legitimate interest, Art. 6(1)(f); consent for optional storage, Art. 6(1)(a).
Security and abuse preventionProtect accounts, Users, servers, and infrastructure; detect fraud, malware, attacks, and violations.Legitimate interest, Art. 6(1)(f), and legal obligations where applicable, Art. 6(1)(c).
Support and communicationsHandle requests, reports, appeals, and operational communications.Contract, Art. 6(1)(b), or legitimate interest, Art. 6(1)(f).
Compliance and disputesMeet legal duties and authority requests; establish, exercise, or defend legal claims.Legal obligation, Art. 6(1)(c), and legitimate interest, Art. 6(1)(f).
5. Required and optional data
Strictly necessary technical data are provided automatically when a page or Service feature is requested. Without them, the feature cannot be supplied securely.
Username, email, and credentials are required for an account. Discord data are required only for Discord-linked features. Service content depends on the functions selected by the User.
Consent to remember the language is optional. Refusal does not prevent use of the website or Service, but the choice may not persist on the next visit.
6. Cookies and equivalent storage
The frontend does not install analytics, advertising, or profiling cookies. The API uses a signed, Secure and HttpOnly technical cookie to recognise the device pseudonymously only for security and abuse prevention; it is not a hardware fingerprint. The website also uses technical local storage for the privacy choice and, after login, for the account access token. The selected language is stored only with consent.
The storage list, duration, and choice controls are described at /cookies. Cookie settings can be reopened from the footer at any time.
7. Recipients and processors
Data may be processed by authorised personnel and contracted processors under Art. 28 GDPR, including xCloud and providers of hosting, CDN, infrastructure, DNS, security, transactional email, payments, support, and technical maintenance.
When a User links Discord or uses the bot, necessary data are exchanged with Discord and NexNode integration systems. Discord also acts as an independent controller for its platform.
Data may be disclosed to authorities, law enforcement, advisers, or rights holders where required by law or necessary to protect rights and security. Personal data are not sold or disclosed for behavioural advertising.
8. International transfers
Some technology providers or Discord may process data outside the European Economic Area. Transfers rely, as applicable, on an adequacy decision, the Data Privacy Framework, European Commission Standard Contractual Clauses, or another safeguard under Articles 44 and following GDPR.
Information on applicable safeguards may be requested at info@movara.it.
9. Retention
- Account and profile: for the account lifetime and the technical deletion period, unless legal duties, security, or disputes require retention.
- Browser access token: until logout, expiry or invalidation, browser-data deletion, or automatic removal after an invalid session.
- Servers, settings, and files: for the server lifetime and according to inactivity, deletion, and backup periods shown in the plan or dashboard. Deleted data may remain temporarily in isolated backups until overwritten.
- Hosted websites, files, databases, and settings: for the site lifetime and according to inactivity, deletion, and backup periods shown in the plan or Web Control.
- Orders, invoices, payments, and credit entries: for statutory accounting, tax, anti-fraud, refund, and dispute periods or as needed to defend rights.
- Technical and security logs: for a period proportionate to security, diagnosis, abuse prevention, and incident investigation; longer only for a specific incident or obligation.
- Trust & Abuse Graph events: normally 90 days. The device cookie normally expires after 180 days; account-linked HMAC signals follow the account lifetime, while signals included in a security decision may be retained longer to prevent circumvention and handle appeals.
- Support, abuse, and appeal records: for handling and then as needed for legal obligations and defence of rights.
- Privacy choice and language: no more than six months unless changed or deleted earlier.
- Records subject to tax, accounting, or legal duties: for statutory periods.
10. Security
NexNode applies risk-appropriate technical and organisational safeguards, including HTTPS encryption in transit, access controls, role separation, security-event logging, updates, backups where available, browser security policies, and incident procedures.
No system is risk-free. Users must protect credentials, use unique passwords, keep independent copies of important data, and report suspicious access promptly.
11. Children
The Service is not intended for anyone under 13 or any higher age required by Discord or local law. Consent-based processing for information-society services follows the age set by national law; in Italy, a child may consent from age 14, otherwise parental-authority authorisation is required.
NexNode may verify age or authorisation where reasonably necessary and delete data collected contrary to these rules.
12. Automated decisions and profiling
NexNode does not perform advertising profiling or make decisions based solely on automated processing that produce legal or similarly significant effects under Art. 22 GDPR.
Automated systems may flag anomalies, abuse, or security risks. Relevant measures may be reviewed and challenged through support.
13. Data subject rights
- Access and a copy of personal data.
- Rectification of inaccurate or incomplete data.
- Erasure and restriction where the legal conditions apply.
- Portability of data provided by the User, where applicable.
- Objection to processing based on legitimate interests.
- Withdrawal of consent at any time, without affecting prior lawful processing.
- Information on safeguards for international transfers.
Requests may be sent to info@movara.it or mosrls@pec.cgn.it. The controller normally responds within one month and may request proportionate information to verify identity.
14. Complaints
A data subject may complain to the Italian Data Protection Authority at www.garanteprivacy.it or to the competent supervisory authority in their Member State, without prejudice to other administrative or judicial remedies.
15. Updates and contacts
This notice may be updated when features, providers, legal bases, or applicable law change. Material changes will be communicated appropriately before taking effect where required.
Privacy information and rights: info@movara.it. Formal communications: mosrls@pec.cgn.it.
16. Dane Web Hostingu i rola Użytkownika
NexNode przetwarza niezbędne dane domeny, DNS, aplikacji, xCloud, SSL, wdrożeń, baz, kopii, File Manager/SFTP, logów i użycia. Dla WordPress przetwarzane są login i e-mail administratora; hasło początkowe służy jednorazowemu wyświetleniu, nie przechowywaniu w czytelnej formie. Użytkownik odpowiada za dane odwiedzających.
17. Zamówienia, płatności, kredyty i polecenia
NexNode przetwarza zamówienia, plany, ceny, faktury, status i referencje płatności, rejestr kredytów, zakupy Shop, zwroty i sygnały antyfraudowe. Polecenia obejmują kod, konta, przypisanie i bonus w celu realizacji promocji i ochrony przed nadużyciami.
18. Dostawcy, dostęp i przechowywanie
xCloud, infrastruktura, DNS, e-mail transakcyjny, płatności, bezpieczeństwo i upoważniony personel mogą przetwarzać niezbędne dane. Pliki podlegają cyklowi strony; logi, pomiary, zamówienia i audyty są przechowywane przez okres proporcjonalny lub prawnie wymagany.
