Privacy Policy

This policy explains which personal data Trivolut processes, why, how long we keep it and what you can ask of us. We have tried to write it the way we would want it explained to us: specific, and with nothing hidden in the small print.

1. Who we are

Trivolut provides cloud VPS, game servers, Discord bot and application hosting, web hosting and related services from the Netherlands. For the processing described here, Trivolut is the controller under the General Data Protection Regulation (GDPR): Wagenpad 30, 8321 RL Urk, Netherlands, registered with the Netherlands Chamber of Commerce (KvK) under number 42132359.

For the personal data that business customers store on their own services, we are their processor, not the controller. Our Data Processing Agreement covers that.

You can reach us about anything in this policy at support@trivolut.com. Please put "Privacy" in the subject line.

2. The short version

• We collect what we need to run your account and your services, and to be paid for them.
• We do not sell personal data, and we do not use advertising networks, advertising cookies or third-party analytics. The ads on bot.trivolut.com come from our own advertisers and are not based on a profile of you.
• Payments are handled by Stripe. We never see or store your full card number.
• The live chat, the question box under our FAQs and some tools of our staff use AI. What goes where is described in section 3.
• Our own servers, and the services you run on them, are in the European Union.
• You can ask us for a copy of your data, or to correct or delete it, at any time.

3. What we collect and why

Your account

When you create an account we store your name, your email address, your country, your language and your password. The password is stored only as a one-way hash, so nobody at Trivolut can read it. You can add a phone number, an address, your date of birth, a profile picture and billing profiles with a company name, Chamber of Commerce number and VAT number. If you give your date of birth, we use it only to check that you are old enough to have an account. Your name, email address, country and a password are needed to create an account; without them we cannot give you one. Everything else is up to you.

We use this to give you an account, to let you sign in on every Trivolut site with one login, and to contact you about your services. Profile pictures are stored on Cloudflare's storage behind cdn.trivolut.com.

Legal basis: performance of our contract with you.

Signing in and keeping your account secure

We record the sessions you are signed in with (IP address, browser and device type, time), attempts to sign in, including failed attempts with the email address that was typed, and a log of important account activity, such as a changed password or a new two-factor method. You can see your own activity log in your account.

If you turn on two-factor authentication, we store the secret of your authenticator app in encrypted form, and the codes we email you and your recovery codes only as one-way hashes. If you mark a device as trusted, we remember it for 30 days. If you have a staff account, a cookie on id.trivolut.com (trivolut_seen) also remembers which staff accounts have signed in with that browser, for 400 days, so we can warn when a staff account is used on a new device.

On the pages to sign in and create an account, and on our abuse and newsletter forms, Cloudflare Turnstile helps us tell people apart from automated attacks. To check this, Cloudflare receives your IP address.

If you sign in with Google, Discord or GitHub, that service tells us your account ID there, your name, your email address and whether it has confirmed that address. We keep the ID, name and address to recognise you the next time you sign in that way. We do not receive your password at that service, we do not ask for access to anything else there, and we do not keep the access it gives us after you are signed in. You can disconnect a service at any time under Profile in your customer panel.

Legal basis: our legitimate interest in keeping accounts and our platform secure, and performance of our contract with you.

Finding your address

When you type your address in one of our forms, our server asks Google Maps for matching addresses, so you can pick the right one. Google receives what you type and the language of the page, but not your IP address, name or email address, because the request comes from our server and not from your browser. If the lookup is not available, you can simply type the address yourself.

Legal basis: our legitimate interest in correct addresses on invoices.

Help from our staff

To help you, our support staff can look at your account through our team panel. Some staff can also sign in as you to see exactly what you see. That lasts at most one hour, it is recorded with the reason, and it shows up in your own activity log. While signed in as you, staff cannot change your password or two-factor settings, download your data, close your account or do anything that moves money.

Legal basis: our legitimate interest in helping you, and performance of our contract with you.

Orders, invoices and payments

We store what you order, your invoices, your billing details (name, address and, if you give one, VAT number), the balance and transactions of your wallet, and quotes and payment links we send you. If you accept a quote online, we record the name you entered, your IP address and your browser. If you give a VAT number, we check it with the European Commission's VIES service, and store the name and address it returns.

Online payments are processed by Stripe. Stripe receives the payment details you enter and tells us whether the payment succeeded. We receive a reference to the payment, never your full card number. When you order something that renews, we create a customer record at Stripe with your name, email address and language, and the way you pay is saved there where that kind of payment can be used again, so the renewal can be charged without asking you each time. We store only a reference to it. You can remove a saved payment method or stop a renewal at any time under Billing, Subscriptions in your customer panel.

Legal basis: performance of our contract with you, and our legal obligation to keep financial records.

The services you run

To provide a service we store its configuration, its IP addresses, its status and the actions taken on it, such as starts, restarts and reinstalls, with the IP address and browser of whoever took them. If you share access to a service with someone else, we store who has access and their email address.

• VPS. The root password is stored encrypted and is deleted when the server is terminated. The hostname of your server is registered with our data centre provider for reverse DNS. When you open the browser console, we record the IP address that requested it.
• Game servers. They run on our own game panel, where we create an account for you with your name, email address and a username. Your panel shows the panel's own activity log, including IP addresses. If you invite someone to a server, we email them.
• Game server features. When you search or install plugins, mods and modpacks, our servers fetch them and their icons from Modrinth and check them; your browser does not contact Modrinth. To show who played on your Minecraft server, we keep the player names and IDs your server reports, with when we first and last saw them, until the server is removed; to show a name for an ID, and when you add a player to the whitelist, operators or bans, we ask Mojang's public lookup. While your server runs, we record its processor and memory use and the number of players online every few minutes, and keep that for 8 days. If you add a Discord webhook, we send your server's start, stop, crash, restart and finished backups to it, and store the webhook address encrypted. If you pick an address on our domain, such as yourname.play.trivolut.net, we create DNS records for it at Cloudflare.
• Why did it stop? (optional). We first compare the end of your server's log with known causes ourselves. Only if that finds nothing and you press "Explain with AI", we send the last part of the log and crash report to an AI service we use, to explain it. Before sending, we remove IP addresses, email addresses, IDs, links, passwords and keys, and chat and login lines; player names can still appear inside other game messages. We keep that you asked and how much text was used, not the log or the answer.
• Web hosting. Web hosting runs on a DirectAdmin server of our partner Etheron in the Netherlands. We create an account there with your email address, a username and your domain, and the websites, email and databases you put on it are stored there.
• Discord bots. If you host a bot with us, we store its token encrypted to run it.

What you put on your servers, game servers and applications is yours. We store and process it only to provide the service to you. We do not look at it, except when you ask us to, when you give support access from your panel, or when we need to investigate abuse or a security incident.

Legal basis: performance of our contract with you; for the AI explanation, your request when you press the button.

bot.trivolut.com

If you add our bot to a Discord server through bot.trivolut.com, the bot keeps records for the modules the server's administrators turn on: for example edited and deleted messages for their logs, members joining, commands used, tickets and their transcripts, and moderation cases. The administrators of that server decide what is kept, and can see it in their dashboard. We keep it for the period of their plan: 3, 30 or 90 days. Suggestions for new modules are kept with a code made from the sender's IP address and browser, which cannot be turned back into the address.

Legal basis: our legitimate interest, and that of the server's administrators, in running and moderating their Discord server.

Ads on bot.trivolut.com

• Watching an ad for online time. When you watch an ad to keep your free bot online, we record which ad, for which bot, when it started and whether it was watched to the end. To stop abuse we also keep a code made from your IP address and browser that changes every day and cannot be turned back into the address. We never build a profile of you; an ad is chosen only by your bot's language and the category you chose for your server.
• Advertisers. To advertise, you give us your full name, address, country, phone number and date of birth (18 or older), and for a business its Chamber of Commerce and VAT number, which we check in the EU's VIES service. We keep these details encrypted with your advertiser account, because we must know who is behind an ad, and we may hand them to the police if an ad breaks the law. Files you upload are kept on our own servers. Advertisers see only totals per day: views, full views and clicks.

Legal basis: performance of our contract with you; for the abuse codes and the advertiser details, our legitimate interest and our legal obligations.

Support

When you contact us, whether through a ticket in your panel, the form on support.trivolut.com, the contact form on our website, email, our Discord or the live chat, we keep the conversation, the files you attach and the details you give us, so we can help you and refer back to it later.

Legal basis: performance of our contract with you or, if you are not a customer, our legitimate interest in answering your question.

The AI assistant and AI tools of our staff

The live chat on our websites and the question box under our frequently asked questions are answered first by an AI assistant. It says that it is an AI, it cannot look into your account, and a colleague can take over the chat at any time; you can ask for one.

To write an answer, the assistant sends text to an AI service we use, which processes it on our behalf: in a chat, the most recent messages of the conversation, including what the assistant and our colleagues wrote; in the question box, your question. The address of the page you are on goes with it. We do not add your name, email address or account details, but anything you type yourself goes along, so please do not type passwords or payment details. We only use paid AI services whose terms do not allow them to use this content to train their models or improve their own products.

• A chat is kept like any other support conversation.
• Of a question in the question box we keep that it was asked, on which page, and a code for that day made from your IP address and browser, which cannot be turned back into either, so that we can hold everyone to a daily limit. When a question is unusual or goes unanswered, we keep its text as a note for our team, so that we can improve our help articles.
• If the assistant considers messages in a chat abusive more than once, it stops answering in that chat and a colleague can take over. This has no other consequences for you or your account.
• When a colleague answers your ticket or chat, they can ask for a draft reply. The subject, the conversation in that ticket (including what the assistant wrote and our internal notes on it), your first name and any instruction from the colleague are then sent to an AI service we use, which processes it on our behalf under the same terms. The colleague reads and edits the draft; nothing is sent to you without them.
• On a long ticket, a colleague can ask for a short summary of it, and they can have a message in your ticket translated into their language, or their reply into yours. For a summary, the conversation in that ticket, including our internal notes, is sent to an AI service we use; for a translation, only that message or reply. Email addresses, IP addresses and anything that looks like a password or key are taken out first, except in a colleague's own reply. We keep the summary and the translations of your messages with the ticket, so they are not made again. Only our staff see them, and they go when the ticket goes.
• Our AI assistant also reads each new message in a support ticket, whether it came by email, through your account, from a chat that became a ticket or from a ticket on our Discord server, to sort it by topic and prepare an answer. The conversation in that ticket (without our internal notes) and your first name are sent to an AI service we use, which processes it on our behalf under the same terms; email addresses, IP addresses and anything that looks like a password or key are taken out first. If no colleague has answered within a short time, or for kinds of questions where we let it, the assistant sends its answer itself, marked as written by our AI assistant, and a colleague stays involved. It never promises refunds or credits, never changes your services or account, and never confirms a change of your identity or email address. We keep its drafts with the ticket, together with how our colleagues used them, to check and improve its answers; they go when the ticket goes.
• On our Discord server, our bot can answer support questions with the same AI assistant: in tickets you open there, in a help channel, and when you mention it or reply to one of its answers. Your question and up to eight earlier messages in that channel are then sent to an AI service we use, with email addresses and similar details taken out, together with whether your Discord account is linked to a Trivolut account, but nothing from that account. Its answers say that they come from AI. To answer each question only once, we keep for 30 days which message was answered, without its text.
• Our support and billing staff can also use an AI helper in our team panel, to find information and to prepare drafts, such as a summary of a ticket or a draft invoice. When a task needs it, the helper sends the relevant parts of your account to an AI service we use (for example your name, country, services, invoices or the messages in your ticket), limited to what that staff member is allowed to see. Passwords, security codes, payment details and bank details are never sent, and neither are your email address, address and phone number. Internal notes go along only when the helper drafts a reply to your ticket, as described above. Every time account data is used, we record which records, but not the question or the answer. Nothing is changed or sent to you until a member of our staff has checked it.
• Our team also uses AI tools from external providers to help build and maintain our platform. While doing that work, these tools can process personal data from our systems. We limit that to what the work needs.

Legal basis: our legitimate interest in answering questions quickly, at any hour, and in helping our staff work quickly and accurately; for customers also the performance of our contract with you.

Reporting abuse

Anyone can report illegal content or abuse on our services at trivolut.com/abuse or by email to abuse@trivolut.com. Along with the report itself (what and where it is, why you think it is illegal or against our rules, and any evidence or files you add), we ask for your name and email address, and your organisation if you want to give it. A report about child sexual abuse material can be made without a name or email address. If you are signed in, the report is linked to your account.

We use your details only to handle the report: to assess it, to ask you for more if we need it, and to tell you what we decided and how you can challenge that decision. The report becomes a support ticket that our staff handle. We do not give your name or email address to the customer whose service you reported, unless the law requires it. Where the law requires it, we pass a report on to the police or another competent authority.

Legal basis: our legal obligation under the EU Digital Services Act to offer a way to report illegal content and to act on reports, and our legitimate interest in keeping our platform free of abuse.

Asking for a review

When you have used a service of ours for 14 days, counted from the first of your services that is still running, we may ask you once for a review on Trustpilot. We ask with a card on the dashboard of your customer panel and, if you created your account after 12 October 2026, by email, but never more than once in total. We ask everyone the same way, whatever they think of us, and we offer nothing in return. If you have a support request open, we wait until it is closed.

For this we use your name, email address and language, and which of your services has been running longest and since when. The link opens Trustpilot's own page for writing a review. We do not send Trustpilot your email address or anything else about you; what you write there falls under Trustpilot's privacy policy. We record that we asked you, and whether you went to Trustpilot or closed the card, so that we do not ask again.

You can say no at any time: under Settings, Account in your customer panel, or with the link at the bottom of the email, which turns it off in one click without signing in. Turning it off also means you will not see the card.

Legal basis: our legitimate interest in hearing how our services work for our customers. For the email, article 11.7(3) of the Dutch Telecommunications Act, which allows it for customers who were given the chance to say no when they gave their email address, and can still say no at any time, free of charge.

Our Discord server

If you join the Trivolut Discord server, our own bot keeps a few records there so our moderators can keep the server safe and our staff can help you.

• Server log. For messages in the server, we keep the text, who wrote it and in which channel for 14 days, and a copy of images for 7 days, so moderators can see what an edited or deleted message said. We also log when members join or leave, with the date the account was created and the invite that was used, and when someone joins or leaves a voice channel. These entries are also posted in a log channel that only our staff can see, where they stay until we remove them.
• Statistics. We count, per member per day, how many messages they sent and how long they spent in voice, without any content, and keep these counts for 120 days. That someone joined or left, and through which invite, we keep for 400 days. Our staff see only totals and charts.
• Moderation. Warnings, bans and other moderation actions are recorded with their reason and the moderator who took them, and kept for one year. A warning stops counting after 90 days. A new account that looks suspicious, for example because it is very new, is asked to confirm with a button before it can post; a moderator can always lift that. We also keep a log of the commands members use, for 90 days.
• Linking your account. If you use /link, we connect your Discord account (its ID and username) to your Trivolut account, so the bot can give you the customer roles that match your services. It checks this every 10 minutes. You can undo it at any time with /unlink or under Settings, Security in your customer panel.
• Levels, streaks and gems. For chatting and for time in voice with others, members earn points (XP) and levels; we keep their XP, level, chat streak and the gems they claimed, and up to 26 weeks of weekly totals, until 90 days after they leave the server. Level-ups, streak milestones and the weekly top 10 are shown in the server with your server name.
• Voice time. We keep when you join, leave or move between voice channels, how long you were there, and whether you were alone, muted or deafened, for 90 days, and daily totals per member for one year. Only administrators of the server can see these per member; you see your own total on your rank card.
• Ghost pings. If you mention someone in a message and delete it, or edit the mention away, within 10 minutes, the bot posts in the same channel that you did, with the text of that message, so the person you mentioned knows why they were notified. Messages a moderator removes are not reposted.
• Level rewards. If your Discord account is linked, reaching certain levels gives you a personal discount code by direct message. We keep which levels earned a code for your account.
• Tickets. Support tickets in Discord are kept like any other support conversation. When one is closed, the bot may ask you by direct message for a rating of one to five stars and an optional comment, which we keep with the ticket.

What you post in our server is also processed by Discord, under its own privacy policy.

Legal basis: our legitimate interest in keeping our community safe and in helping you there, and for a linked account the performance of our contract with you.

The partner programme

If you take part in our partner programme, we keep the name under which you appear, your codes and links, the orders credited to you, your commission and your payouts. To pay you, we keep the payout method you choose and, for a bank transfer, the account holder, IBAN and BIC, stored in encrypted form, and whether you are paid as a private person or as a business, with your business name and VAT number.

If you follow a partner's link, we count the visit with a code for that day made from your IP address and browser, which cannot be turned back into either, and the page that sent you. If you use a partner's code and order, we record which partner the order is credited to. The partner sees amounts and totals, never who you are.

To prevent partners from earning commission on their own orders, we compare the details of an order with those of the partner, including the IP addresses they signed in from in the last 180 days. A match does not lead to an automatic decision: it puts the commission on hold until one of our staff has looked at it.

Legal basis: performance of our contract with the partner, our legal obligation to keep financial records, and our legitimate interest in preventing fraud.

Newsletter, status updates and announcements

You can sign up for our newsletter and for emails about outages and maintenance on trivolut.com, in the footer of our websites, when you create an account, or under Settings, Account in your customer panel. We only add you after you confirm by clicking the link in the email we send you. We keep your email address, your name if you give it, your language, which lists you are on, where you signed up and when you confirmed. The list runs on our own server, mailing.trivolut.com, and we send these emails from our own mail server. Every email has a link to unsubscribe, and when you close your account we remove you from every list.

You can also have status updates sent to a Discord or Slack webhook of your own. We store the webhook address encrypted, and send it nothing but our status updates. Our status page and its RSS and Atom feeds do not record who reads them.

If you close an announcement on our websites, we remember that, in your browser and, when you are signed in, with your account, so it does not come back.

Legal basis: your consent for the newsletter and status emails, which you can withdraw at any time by unsubscribing; for webhooks and announcements, performance of our contract with you.

Visits to our websites

When you visit trivolut.com, our customer panel, our sign-in pages, bot.trivolut.com, our support site or our jobs site, our own servers record the visit: your IP address, your browser, the page you arrived on, the page that sent you and the pages you view, and your account if you are signed in. We use this to see how our sites are used and to spot abuse. From your IP address we also work out which country you are in, with the IP to Country Lite database by DB-IP (db-ip.com, CC BY 4.0), to suggest a language or currency and to show our staff where a chat comes from. This lookup runs on our own server, and we keep only the country code.

This happens on our own servers, without extra cookies and without third-party analytics. The IP address and browser details are deleted 24 hours after your last activity, and the list of pages you viewed after 7 days.

Separately, the servers that pass traffic to all our websites keep a technical access log of every request: your IP address, the address you requested, the time, the result and your browser's user agent. We keep it for 14 days, to protect our platform and to detect and stop attacks and abuse. When an IP address scans or attacks our servers, we share that address, the kind of attack and the time with CrowdSec, a security company in France. CrowdSec combines such reports from many websites to recognise attacking addresses, and we receive its list of addresses known for attacks so we can block them.

We also compare your IP address with public lists of VPN, Tor and private relay networks. This happens on our own server, and we keep only a daily count per network, not your address. Some of our websites may ask you to turn off a VPN, unless your account may use one. When a request says it comes from a search engine, we check its IP address with DNS and remember the outcome for up to a day. On your first visit, a short security check may run in your browser; when it passes, a cookie remembers that for 7 days (see our Cookie Policy).

Legal basis: our legitimate interest in running and securing our websites.

Job applications

If you apply for a job at Trivolut, we receive your name, email address, phone number and motivation, and use them only for that application procedure. If we hire you, your application becomes part of your personnel file. If we do not, we delete it 4 weeks after the procedure ends, unless you agree that we keep it for up to a year. If you sign up for job alerts, we add you only after you confirm your address with the button on the page our email links to. We keep your email address, your language, when you confirmed and which alerts we sent you, and use them only to send those alerts until you unsubscribe, with the link in every alert.

Legal basis: steps taken at your request before entering into a contract, and your consent for job alerts.

Email we send

We send email that belongs to your account and your services: address verification, security alerts, sign-in codes, order confirmations, invoices, renewal notices and notices that a server is ready. We send it from our own mail server. Apart from the single review request described above, which you can turn off, we do not send marketing email unless you have signed up for it.

4. Who we share data with

We share personal data only when it is needed for the purposes above:

Trustpilot is not in this table: we give Trustpilot nothing. We may also disclose data when the law requires it, for example to comply with a court order or a request from a competent authority. We do not sell personal data, and we do not share it for advertising.

5. Data outside the European Union

Our own servers, and the services you run on them, are in the European Union. Some of the providers above can process data outside the European Economic Area. Where we work with them under an agreement, they rely on the safeguards the GDPR requires, such as the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission. The services your browser contacts directly, for our fonts and for Discord server icons on bot.trivolut.com, receive only your IP address and browser details, under their own terms.

6. How long we keep data

When you close your account, we delete or anonymise your personal data, including your profile picture, except what we have to keep by law, such as invoices, and the records the table above says we keep longer.

7. How we protect your data

• All our websites use encrypted connections (HTTPS).
• Passwords, recovery codes and emailed sign-in codes are stored as one-way hashes, and authenticator secrets, VPS root passwords, bank details and webhook addresses are encrypted.
• Two-factor authentication is available on every account and required for our staff.
• Only staff who need it for their work can access personal data, and the actions they take on accounts and services are logged.

8. Your rights

Under the GDPR you have the right to:

• see the personal data we hold about you and receive a copy of it;
• have incorrect data corrected;
• have your data deleted when we no longer need it, or when you withdraw your consent;
• restrict or object to processing that is based on our legitimate interest;
• receive the data you gave us in a machine-readable form, to take elsewhere;
• withdraw consent you gave earlier, such as for the newsletter or job alerts, at any time.

You can request a copy of your data and close your account yourself under Settings, Account in your customer panel. For anything else, send your request to support@trivolut.com. We answer within one month, and we may ask you to confirm who you are before we act on it.

If you think we handle your data incorrectly, please tell us first. You also have the right to file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or with the authority in the EU country where you live.

9. Automated decisions

We do not make decisions about you that are based solely on automated processing and that have legal or similarly significant effects for you. Where our systems flag something, such as a possible own order of a partner, one of our staff decides.

10. Children

Our services are meant for people of 18 and older. Younger people need permission from a parent or guardian, and must be at least 16. We do not knowingly collect data of children under 16. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

When we change this policy, the date at the top of this page changes with it. Until our official launch, a change takes effect when we publish it. After the launch, if a change affects how we use data you have already given us, we tell you by email before it takes effect.