Visiting the site and hosting
When you visit RustSpot, technical data is processed. It includes your IP address, the time of the request, the requested address and browser information. We use it to serve the site, diagnose errors and protect against abuse. Our legitimate interest is keeping the platform secure and available (Article 6(1)(f) GDPR).
OpenAI Ireland Ltd. provides ChatGPT Sites and processes data collected and hosted on RustSpot on our behalf for hosting, maintenance and support. It may use technical subprocessors. When hosted data from the EEA is transferred to recipients outside the EEA and Switzerland, the ChatGPT Sites Data Processing Addendum provides for an adequacy decision or EU standard contractual clauses. Contact us for information or a copy of the safeguards applicable to a specific transfer.
Sign-in, profile and emails
You can use the directory without an account. When you sign in with ChatGPT, RustSpot receives an account ID, your email address and, where available, your name from OpenAI. We use the ID to sign you in and link your listings, votes, bids and requests to your account. We may suggest the name when you set up your profile. When you create a profile, we store your account ID, chosen display name and when the profile was created. Sign-in and a profile are required to list a server or place test bids. This provides the account features you choose to use (Article 6(1)(b) GDPR). OpenAI processes your ChatGPT account data under its own privacy policy.
If the auction email setting is available and you turn it on, we store your confirmed email address, account ID, language and the time you gave consent. You can turn it off in your account at any time. The legal basis is Article 6(1)(a) GDPR. When delivery is configured, RustSpot sends the messages through the email service identified for the feature. These emails are currently inactive during public testing.
Server directory, votes and bids
For a listing we store its connection to the operator account, server name, platform, region, game mode, and the supplied description and tags. For PC servers we also store the hostname or IP address and the required ports. For connected servers we record the reported online status, current and maximum player counts, reported server name and time of the last check. The status report to RustSpot contains aggregate player counts. Once connected, directory information such as the server name, connection details, description and status is public. The public listing excludes your account ID, email address and login credentials.
For server verification, we process challenge codes, technical server details, where applicable the hosting service’s identifier for the server, the evidence submitted and the decision. For automated PC verification we use public server catalog data and may resolve the public hostname using Google’s DNS service. The check supplies the verification you request and helps prevent unauthorised listings (Article 6(1)(b) and (f) GDPR).
When you vote, we store your account ID, the server and the UTC calendar day. The total number of votes for the server is public. For a test bid, we store the server, round, amount and timestamp. The public leaderboard shows the leading servers, ranks and bid amounts. This processing provides the features you use (Article 6(1)(b) GDPR). Linking votes to accounts and checking listings also help prevent manipulation (Article 6(1)(f) GDPR).
For a binding bid, we also store the billing country and the accepted version of the auction terms, including their language and acceptance time. The bid receipt is linked to your account and available there. This processing documents and administers your bid (Article 6(1)(b) GDPR).
Favourites and external content
Your favourites and your selected favourites view are saved in your browser’s local storage. We use them to provide the feature you selected (section 25(2)(2) of the German TDDDG). You can remove saved servers individually or clear this site’s data in your browser. The sign-in provider may store or access information on your device that is necessary for your chosen sign-in to work.
The PC directory uses public data sources including GSM. For a direct request from your browser, for example as a fallback when the usual catalog request fails, GSM receives your IP address, technical request information and, where applicable, your search term or selected filters. This is used to display the server list (Article 6(1)(f) GDPR). Search terms and selected filters can be part of the page address and can be visible in your browser history or a shared link.
The embedded PS5 list loads when you enable Double Eleven in the PS5 view. Your browser then connects directly to Double Eleven and sends information such as your IP address and browser details (Article 6(1)(a) GDPR). You can close the embed and continue to use the RustSpot directory. If you select the external link, you open Double Eleven’s site directly. Its privacy policy applies to its processing.
Support, reports and abuse prevention
If the online withdrawal function is available for paid placements and you use it, we store your name, contract reference, email address, the content and timestamp of your notice, and delivery status. We send the email address and the notice to Resend so it can deliver the acknowledgement. This lets us handle your withdrawal and send the legally required acknowledgement (Article 6(1)(c) GDPR). Retention depends on handling the notice, statutory obligations and the need to document receipt.
If RustSpot offers PayPal in a paid round and you start payment, RustSpot sends PayPal the order reference, purpose, amount and currency. PayPal collects payment details on its own site. RustSpot processes order and payment references, payment status information, country data when provided by PayPal, and any refunds or payment disputes. This supports fulfilment of the placement and handling of payment cases (Article 6(1)(b), (c) and (f) GDPR). Our legitimate interest is to match payments to orders and prevent abuse. PayPal’s privacy statement applies to its own processing.
For reports and requests we store the request type, subject, message, handling information and relevant dates. When you sign in, we also store your account ID and can reply in your account. You can report a server as a guest. If you email us, we also process your sender address, any contact details you choose to provide, and any evidence you include. The email service processes your message for delivery and handling. You can submit privacy and deletion requests in your account or by email. For a deletion request we check the relevant account and any retention obligations. The legal basis depends on the request and is Article 6(1)(b), (c) or (f) GDPR. Our legitimate interest is resolving requests and protecting the service from unlawful or abusive listings.
To limit reports and verification requests, we use a daily key to derive a pseudonymous value from the account ID or, for guests, the IP address. Our application database stores that value, a count and the time window for rate limiting. Routine clean-up removes older values and keys, keeping those for the current and preceding UTC calendar days (Article 6(1)(f) GDPR).
Retention and your rights
We keep account and directory data for as long as we provide the account and its listings. Retention for requests, verifications and bids depends on the handling of the matter, the need to document the relevant round or decision and, where applicable, the defence or exercise of legal claims. Statutory retention requirements take priority. Your favourites stay in your browser until you remove them or clear the site’s stored data.
Subject to the GDPR, you can request access, rectification, erasure, restriction of processing and data portability (Articles 15 to 20 GDPR). You can object to processing based on legitimate interests on grounds relating to your particular situation (Article 21 GDPR). You can withdraw consent at any time for future processing. Contact us using the details above to exercise these rights. You can also lodge a complaint with a data protection authority (Article 77 GDPR), such as the Hessian Commissioner for Data Protection and Freedom of Information.