Last updated: 13 November 2026
This policy explains what personal data rotaidem.com, the HeavyPro app, RotaHub and the Rotaidem Discord bot use, why, for how long, and what your rights are. We keep it short and in plain words.
Rotaidem
We are responsible for your data (the “controller” under the EU General Data Protection Regulation, GDPR). Questions or requests: write to the email address above.
What we collect and why
| What | Why | Legal basis |
|---|---|---|
| Your account: name, email, a secure hash of your password (never the password itself), when you accepted the terms | To give you an account, your licences and support | Contract |
| Orders and licence keys: product, price, date, payment reference, the consent you gave at checkout | To deliver what you bought and keep our books | Contract, legal obligation (bookkeeping) |
| Computers using a licence: a computer ID and the computer's name, first and last time seen | To check the licence and let you move it to a new computer | Contract |
| Logged-in devices: IP address, browser, when last used | To keep your account safe; you can log devices out under My account | Legitimate interest (security) |
| Messages you send us (contact form, support tickets, Discord /support) | To answer you | Contract or legitimate interest |
| Newsletter: your email address | To send release news you asked for | Consent (unsubscribe at any time) |
| Downloads: which product, when, and for 30 days the IP address | To stop abuse of downloads | Legitimate interest |
| Discord, if you link it: your Discord ID and name; and what you do with our bot (tickets, reminders, suggestions, form answers, warnings from moderators; flights you log, quiz answers, screenshots you enter and votes, thanks, group flights you join, and your birthday as day and month if you give it) | To give licence holders their role and run the community features you use | Contract, legitimate interest |
| Affiliates: your code, the sales you referred, your PayPal email for payouts | To pay your commission | Contract |
| Partner links, remembered in your browser: the partner code you arrived with and the label of the link | So the partner who sent you gets credit if you buy later | Consent (cookie banner) |
| Partner links, counted: that a partner link was opened, on which page, and the name of the site that linked to us (for example "YouTube"). No IP address is kept: for one day we hold a scrambled value that cannot be turned back into an address, so the same visitor is counted once. | So partners see how their links perform | Legitimate interest |
| Partners: what you wrote when you applied, your links and discount code | To run the partner program | Contract |
We do not sell your data, and we do not use advertising or analytics trackers. We do not make automated decisions about you.
Who helps us (processors)
These companies handle data for us, only for the purposes above, under data processing agreements:
- STRATO (Germany): hosts the website and database.
- Stripe: takes card payments on its own checkout page. We never see your card number.
- Resend: sends our emails (licence keys, confirmations, replies, newsletters).
- Discord: only if you use our Discord server or link your account.
- PayPal: pays commissions to affiliates.
- Endorsely: affiliate tracking, only if you accept it in the cookie banner.
- YouTube (privacy-enhanced mode): a video loads only when you press play.
- Links to Trustpilot and social media are plain links: nothing loads until you click them.
Some of these companies are based in the USA or may process data there. Transfers are protected by the EU–US Data Privacy Framework or the EU's standard contractual clauses.
How long we keep it
- Your account: until you delete it (My account → Delete my account).
- Orders and payment records: 7 years, as Swedish bookkeeping law requires. After you delete your account they no longer show your name or email.
- Discord bot: what you logged or entered stays until you delete it or your account (birthdays:
/birthday forget:True). Airport weather is fetched from aviationweather.gov without anything about you. - Partner link visits: 13 months as plain counts (page, source site, date); the scrambled visitor value is erased after 2 days.
- IP addresses: downloads 30 days, admin logs 180 days, failed licence checks 2 days.
- Logged-in devices: until you log out, or after 60 days without use.
- Messages to us: deleted 2 years after they were handled.
- Newsletter: until you unsubscribe (every email has a one-click link).
- Discord reminders: 30 days after they were sent; giveaway entries: 90 days after the giveaway.
Your rights
You can ask to see, correct, download, or delete your data, to limit how we use it, or object to it, and you can withdraw a consent at any time. Most of it you can do yourself: My account → Download my data and Delete my account; cookie choices under Cookie settings at the bottom of every page. For anything else, email us and we answer within a month.
If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY, imy.se) or the authority in your own country.
Children
Our services are not for children under 13. If you are under 18, you need a parent's or guardian's permission to buy. If you believe a child under 13 gave us data, contact us and we delete it.
Security
Passwords are stored as secure hashes, the site only works over HTTPS, admin access is limited and logged, and licence tokens are signed.
Changes
If we change this policy in a way that matters, we tell you by email or on the website before it applies. See also our cookie policy, terms and refund policy.