01
VMHeaven ("we", "us", "our") takes the protection of your personal data very seriously. This Privacy Policy explains which data we collect, process, and use when you use our services, including our website, customer panel, Telegram bot, Mini App and digital services.
This Privacy Policy is information under Art. 13 and 14 GDPR. You do not need to agree to it; we process your data on the legal bases named below.
02
03
We collect the following personal data:
Usage metrics to ensure service stability and security (no packet content or traffic data are collected)
04
We use your data for the following purposes:
05
The legal bases for processing personal data include:
06
Our website vmheaven.io, including the customer panel and the Mini App, is delivered through Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare is our content delivery network and reverse proxy and protects our website against attacks (DDoS) and abusive automated access. Every request your browser sends to our website passes through Cloudflare's network, which decrypts and re-encrypts it in transit. Cloudflare therefore processes your IP address, the address requested, the time, information about your browser and device (for example the user agent and technical characteristics of the connection) and the content of the request, including what you enter in forms.
On the sign-up form and the sign-in form of the customer panel (both also inside the order form) we use Cloudflare Turnstile to tell people from automated programs. Turnstile evaluates your IP address, technical characteristics of your connection and browser and the page you are on. To protect our website, Cloudflare may also set technically necessary cookies or read similar information in your browser; this does not need your consent because it is strictly necessary for the service you request (§ 25(2) no. 2 TDDDG).
Cloudflare processes these data on our behalf (Art. 28 GDPR) under its Data Processing Addendum, which is part of Cloudflare's Self-Serve Subscription Agreement that applies to our account. To improve its bot detection, Cloudflare also uses Turnstile data as an independent controller. We use Cloudflare on the basis of our legitimate interest in a fast, available and secure website and in protecting it and our customers against attacks and abuse (Art. 6(1)(f) GDPR); where a request serves to conclude or perform your contract, also Art. 6(1)(b) GDPR.
Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework. Transfers to Cloudflare in the USA are therefore based on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). For transfers that it does not cover, Cloudflare's Data Processing Addendum contains the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/. Data Processing Addendum: https://www.cloudflare.com/cloudflare-customer-dpa/. Turnstile: https://www.cloudflare.com/turnstile-privacy-policy/.
Other service providers, for example payment providers, our hosting and data centre providers and IT service providers that support our team, including a provider of an AI service that we use to draft answers to support requests and to answer questions about our bookkeeping, process personal data only as far as needed for their task.
07
Account and billing data are stored permanently as long as you have an account with VMHeaven.
If you delete your account or request account deletion, your personal data will be deleted in accordance with statutory retention periods.
Monitoring and usage data are retained only as long as necessary for operation, abuse prevention, and service security.
After service expiration (e.g., server provisioning), server data are generally stored for 7 days before deletion, unless legally required otherwise.
08
We do not sell or rent your personal data. Data may only be shared with:
IT service providers that support our team, including an AI service for support answers and bookkeeping questions
09
You can connect your customer account to our Telegram bot @vmheaven_bot and/or our Discord bot in the customer panel (Settings → Contact). This is entirely voluntary and only happens after you tick the consent box for the respective service and actively connect.
Telegram: when you connect, we store your Telegram user ID and, where Telegram provides them, your username, first and last name and the address of your profile picture, together with the time of your consent.
Discord: you sign in with Discord (OAuth2), which also adds our app to your Discord account and adds you to the VMHeaven Discord server. A server shared with the bot is what allows it to send you direct messages; you can leave the server at any time, the bot then can no longer message you. We store your Discord user ID, username, display name, the identifier of your avatar and the ID of the direct-message channel with our bot, together with the time of your consent. The access token Discord issues is used once to identify you and is not stored.
When the panel shows your profile picture, your browser loads it directly from Telegram's or Discord's servers.
Depending on the notification categories you choose, messages from the bots may contain:
These notifications never contain passwords or other access credentials, nor the content of support replies. Replies you write to a ticket through a bot are stored in our support system like replies written in the panel.
Telegram is operated by Telegram Messenger Inc. and Telegram FZ-LLC (Dubai, United Arab Emirates), for which no EU adequacy decision exists. Discord is operated by Discord Inc. (San Francisco, USA). Both are independent controllers outside the European Union. Chats with bots are not end-to-end encrypted on either platform, so the providers can technically access these messages. Their own privacy policies apply: https://telegram.org/privacy and https://discord.com/privacy.
The legal basis is your consent under Art. 6(1)(a) GDPR, and for the transfer to a third country Art. 49(1)(a) GDPR; for Discord, additionally Art. 45 GDPR where Discord is certified under the EU-U.S. Data Privacy Framework. You can withdraw your consent at any time with effect for the future: with /unlink in the bot, Disconnect in the panel, or by blocking the bot. Your account and services are not affected.
The link is deleted as soon as you disconnect or your account is closed. Technical records that prevent duplicate reminders are deleted after 60 days, references between bot messages and tickets after 180 days at the latest.
10
You can order and manage servers in our Telegram bot @vmheaven_bot and in our Mini App at vmheaven.io/tg, also without a vmheaven.io account. This section explains which data we process for that. The controller is VMHeaven as named in section 02.
When you use the bot or the Mini App, we process the following data:
We use these data to conclude and perform your contract, to set up and run your servers, to answer your support requests and to send you messages about your orders, payments, servers and renewals (Art. 6(1)(b) GDPR). We issue invoices and keep accounting and tax records because the law requires it (Art. 6(1)(c) GDPR with § 147 AO and § 14b UStG). We keep our services secure, prevent abuse and fraud, measure which of our ads bring customers and keep proof that our terms applied and which requests you made; this is based on our legitimate interests in a secure service, in effective advertising and in being able to defend legal claims (Art. 6(1)(f) GDPR). You can object to this processing (section 10).
Your Telegram user ID is needed to buy in Telegram, because we use it to assign your purchases to you. When the bot or the Mini App asks for a name for your invoices, giving it is needed to complete the order unless a Skip button is offered; we use it on your invoices and order confirmations. Without the data needed for the contract we cannot sell you a server.
When you accept our Terms of Service and the Acceptable Use Policy, confirm that you have read this Privacy Policy or ask us to start a service right away, we record the time, the versions of the documents, the language and whether this happened in the bot or the Mini App, as proof (Art. 6(1)(f) GDPR). Confirming that you have read this Privacy Policy is not a consent to processing.
The bot and the Mini App run on Telegram. Telegram Messenger Inc. and Telegram FZ-LLC (Dubai, United Arab Emirates) process your messages and your use of the Mini App as independent controllers under their own privacy policy: https://telegram.org/privacy. No EU adequacy decision exists for the United Arab Emirates, and chats with bots are not end-to-end encrypted. We send data through Telegram because you chose to conclude and perform your contract with us there (Art. 49(1)(b) GDPR).
Depending on the payment method you choose, Cryptomus (crypto payments), Viva.com (card payments) or PayPal receive the data needed for your payment, such as the amount and the invoice number. You enter card and account details on the provider's page; they never reach us. The providers' own privacy policies apply.
Other recipients include Cloudflare (section 06), our hosting and data centre providers, IT service providers that support our team, including a provider of an AI service that we use to draft answers to support requests and to answer questions about our bookkeeping, our tax adviser and accountant, and authorities where the law requires it.
Invoices and booking records are kept for 8 years (§ 147 AO, § 14b UStG). Order confirmations are kept for 6 years as business letters. Records of your acceptance and requests are kept until the end of the third calendar year after your last contract with us ended, longer only while a dispute is pending. Your buyer record (Telegram user ID, name, username, language, ad code) and your support tickets are kept while you use the bot and then for the same period. Mini App sign-ins are deleted 7 days after the sign-in ends, launch records after 90 days, an unfinished order in the bot after 30 minutes, and messages with login details are deleted from the chat after 15 minutes.
If you link a vmheaven.io account, your servers and open support tickets from the bot move to that account, open invoices are issued again to it, and sections 03 to 09 apply to them as well.
Your rights under section 10 apply, including the right to object to processing based on Art. 6(1)(f) GDPR. You can exercise them in the bot with /support or by e-mail to contact@vmheaven.io. We delete your data on request unless the law requires us to keep it, for example invoices.
11
Under GDPR, you have the following rights:
Right to object: you can object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR. We then stop it unless we demonstrate compelling legitimate grounds or need the data to establish, exercise or defend legal claims (Art. 21(1) GDPR).
12
We use cookies and similar technologies to enhance website functionality, improve performance, and track session data. You can manage cookies through your browser settings.
13
We implement appropriate technical and organizational measures to protect personal data from unauthorized access, alteration, disclosure, or destruction. Measures include encryption, access controls, monitoring, and regular security audits.
14
VMHeaven monitors server activity and usage metrics to ensure service stability and security.
No packet content or traffic data is analyzed or stored.
15
We may update this Privacy Policy. The date of the current version is shown at the top of this page. In the Telegram bot and the Mini App we point out a new version before your next order.
16
For questions about this Privacy Policy or to exercise your rights, please contact:
Questions about this document?
Our team answers legal and billing questions directly, with no ticket ping-pong.
