Privacy Policy

Last Updated: September 3, 2026

1. Controller and Scope

LIMITBRAVITY - LDA, trading as VYKIX (“VYKIX”, “we”, “us”), is the controller for client accounts, orders, billing, support, website operation, network security, and the optional Steam-linking process described below. Registered office: Rua Das Costeiras 103, 4835-421 Guimarães, Portugal. VAT: PT517675110. Contact: [email protected].

For content that a hosting customer stores or runs on a game server, VPS, or bare-metal service, the customer normally decides the purposes and means of processing and is the controller; VYKIX acts as processor under our Data Processing Agreement. VYKIX remains controller for its own account, billing, fraud, security, abuse, and legal-compliance records.

This notice applies under the GDPR and Portuguese Law 58/2019. Where VYKIX offers services to an individual in the United Kingdom, the UK GDPR and Data Protection Act 2018 also apply to the relevant processing.

2. Data Protection Contact and DPO Assessment

VYKIX has not appointed a Data Protection Officer. VYKIX is not a public authority, does not conduct large-scale regular and systematic monitoring of individuals as a core business activity, and does not process special-category or criminal-offence data on a large scale as a core activity. On that basis, VYKIX currently concludes that appointment is not mandatory under Article 37 GDPR. We will review that conclusion if the nature or scale of our processing changes so that an Article 37 criterion may be met.

Send privacy requests to [email protected]. We may request proportionate information to verify identity before disclosing or deleting account data.

3. Personal Data and Sources

• Account and contact data: name, email, postal address, telephone number if supplied, country, company details, VAT number, account identifier, authentication and account-security information. You or an authorized account user supplies this data.
• Order and service data: selected product, location, configuration, IP allocations, service identifiers, renewal and cancellation records, accepted Terms version, Order Summary, consent acknowledgements, and service status.
• Billing and payment data: invoices, tax location evidence, payment status, transaction references, and limited payment-method information. Payment providers receive full payment credentials directly; VYKIX does not need to store complete card details.
• Support and communications: tickets, emails, chat messages, attachments, delivery events, and complaint or abuse records. Live chat runs on Chatwoot, which VYKIX self-hosts on VYKIX-controlled hardware, so chat content is not routed to an external chat vendor. Where you contact us through a community channel such as Discord, that platform also processes your message and profile under its own notice. VYKIX may use AI assistance only for live chat and Level 1 (basic first-line) support. An authorized staff member may submit the relevant message text and minimum context needed to help prepare a response. The AI tools do not receive automatic access to hosted servers, customer files, WHMCS, billing records, or payment credentials and are not authorized for any other customer-data purpose.
• Newsletter and marketing data: the email address held for your account or order, the marketing preference you selected, the date and place at which you selected it, any later change or unsubscribe event, and delivery events such as delivery status and bounces. If you opt out, we keep a minimal suppression record so that we can continue to honour that choice.
• Website and portal security data: IP address, request time, URL, user agent, authentication and anti-fraud signals, server logs, and Cloudflare security events.
• Consent decision and audit data: a random, device-scoped subject identifier and the decision history needed to enforce and demonstrate the choice, including the decision time, policy fingerprint, and allowed or denied purposes. The public consent submission payload and the consent and audit database rows omit your name, email address, VYKIX account identifier, IP address, and user agent. Web-server, reverse-proxy, firewall, and infrastructure-security logs may separately process the IP address, user agent, request time, and URL when the consent API is requested. Those security records are not attached to the consent decision as evidence.
• Optional analytics data: after consent only, Google Analytics receives online identifiers, page paths, site-interaction events, and device/browser information through Google Tag Manager. The website does not contact Google Tag Manager or send cookieless analytics if you decline.
• Hosted-service and network data: customer content processed on the customer's instructions; and IP addresses, packet or routing headers, protocol, port, timing, volume, and limited traffic samples where reasonably necessary to detect, investigate, or mitigate attacks or abuse.
• Optional Steam-link data: SteamID64, link status, eligible Rust service, activation request, and partner-benefit eligibility. Steam OpenID is the source of the identifier you choose to link.

Account, billing, tax-location, and service-configuration fields identified as required are necessary to create or perform the contract or meet legal obligations. Without them we may be unable to open the account, calculate tax, accept an order, or supply the service. Analytics, advertising, marketing email, and Steam linking are optional and refusing them does not affect the service.

4. Purposes and Legal Bases

Where we rely on legitimate interests, we consider the necessity, expected impact, safeguards, and the individual's rights. You may object as described in Section 8.

5. Recipients and Roles

Access is limited to VYKIX employees and authorized contractors who need it for their work and are subject to confidentiality obligations. We may disclose limited data to professional advisers, accountants, insurers, courts, regulators, or law-enforcement bodies where necessary and lawful.

On the Client Portal payment step, WHMCS keeps Stripe card payment and PayPal available so that a customer can choose or change methods without rebuilding the checkout. Both providers' browser SDKs may therefore load before the final method is selected. At that stage each provider may receive device, network, and security data needed to present and secure its payment option, determine eligibility, authenticate the payment, and prevent fraud. Payment credentials are entered into the applicable provider's fields, and the transaction is completed only through the method the customer confirms. VYKIX does not use this SDK loading for website analytics or advertising, and separable promotional, advertising, or merchant-analytics components are not authorized by this release.

• Cloudflare: proxied DNS/CDN, web security, and traffic protection. Cloudflare processes request, device, IP, and security data under its applicable terms and data-processing arrangements.
• Postmark (an ActiveCampaign service): delivery of transactional email and, where you have opted in, of newsletter and marketing email. It receives recipient addresses, message content, and delivery metadata such as delivery status, bounces, and unsubscribe events. Where open or click measurement is enabled for the relevant message stream, Postmark also records that interaction.
• Moloni (Moloni Portugal): certified Portuguese invoicing and accounting software. VYKIX shares the billing data needed to issue a compliant invoice or tax receipt and to meet Standard Audit File for Tax (SAF-T) obligations, which normally means name, email address, telephone number where supplied, VAT or tax number where supplied, and billing address. Use of certified invoicing software is required by Portuguese tax law, and Moloni may also deliver tax receipts by email to business customers.
• Stripe: Stripe processes payment and transaction data and may collect contact, billing, device, and network information through its checkout technology. Stripe acts as a processor when it facilitates a payment on VYKIX's instructions. It acts as a controller for purposes it determines, including fraud and loss prevention, security, regulatory compliance, and analysis and development of Stripe's services. The responsible Stripe entity depends on the customer's location, product, and processing context. Read Stripe's Privacy Policy.
• PayPal: PayPal processes account, contact, transaction, payment-method, device, network, authentication, fraud-prevention, and regulatory information for PayPal payments. PayPal acts as an independent controller for the PayPal payment, account, fraud-prevention, and compliance purposes it determines. It acts as a processor only for processing that a specific PayPal merchant-product agreement expressly covers in that role. The responsible PayPal entity depends on the customer's location and selected service. Read PayPal's Privacy Statement.
• Domain registrar and registry parties identified during the domain order: registration, renewal, WHOIS/RDAP, registry, and compliance functions. They act under applicable registry, ICANN, and data-protection rules; they are not merely VYKIX hosting subprocessors.
• Global Secure Layer, Eranium B.V., or VYKIX-operated protection: DDoS routing and filtering may vary by service, location, capacity, or threat. A selected external provider processes network identifiers and traffic information necessary for mitigation. Listing both approved providers does not mean both receive every connection.
• NorthC (European locations) and SBA Edge (West Chicago): physical colocation for VYKIX-owned hardware. These providers supply the building, power, cooling, and network cross-connects. They have no routine logical access to VYKIX disks, hosted services, or WHMCS data, and are therefore facility providers rather than processors of your data.
• Google Tag Manager and Google Analytics: only after analytics consent, Google receives the analytics data described above. The VYKIX configuration uses basic consent mode, so nothing is requested from Google before you choose.
• Anthropic (Claude), Google (Gemini), and OpenAI: VYKIX may use one of these providers only to assist authorized staff with live chat and Level 1 (basic first-line) support. Only the relevant message text and minimum necessary context may be submitted. No AI-assisted reply is sent to a customer without review by an authorized staff member. These providers are not authorized to connect to hosted servers, browse customer files, access WHMCS, retrieve billing or payment data, make abuse or account decisions, perform higher-tier technical work, or process customer data for any other VYKIX purpose. Provider processing and retention depend on the business product, settings, and contractual terms used by VYKIX.

WHMCS, the c15t consent service, the self-hosted Chatwoot live-chat application, and disaster-recovery copies run on VYKIX-owned hardware, disks, and a VYKIX-administered network. Only authorized VYKIX personnel hold routine operating-system, application, database, and network-administration credentials. Because Chatwoot is self-hosted, chat transcripts are not disclosed to an external chat provider; the AI limits described above still apply to any text an authorized staff member submits for assistance. A software supplier does not receive routine access merely because VYKIX uses its software; any exceptional support access must be specifically authorized, limited, and recorded.

6. International Transfers

VYKIX is established in Portugal and hosts core client-area data on VYKIX-controlled hardware. Some providers may process data outside the EEA, including in the United States, or permit support access from another country. Depending on the recipient and transfer, VYKIX relies on an applicable adequacy decision, an active EU-US Data Privacy Framework certification, or completed European Commission Standard Contractual Clauses with any required supplementary assessment and measures. UK restricted transfers require the corresponding UK adequacy regulation, International Data Transfer Agreement, or UK Addendum as applicable.

You may contact us for information about the safeguard applicable to a specific transfer, subject to protection of confidential security and commercial information.

7. Retention

• Live accounts and services: kept while active and then removed when no longer needed, subject to the specific service-deletion rules below and records that must be retained for tax, legal, fraud, or dispute purposes.
• Renewing paid services: where an invoice remains overdue, service suspension begins 72 hours after the due timestamp and cancellation and deletion of active service data begin 168 hours after the due timestamp, as stated in the Terms. A timely end-of-term cancellation is recorded when submitted and deletion begins when the paid service ends.
• Free trials: no automatic charge or conversion; suspension occurs 48 hours after activation and active trial data is deleted seven days after suspension.
• Backup copies: backups are held on VYKIX-controlled hardware and are not a customer archive. A residual copy may remain isolated from active use until the applicable recovery set is overwritten or expires under the actual operational rotation. It is not restored except for disaster recovery, security, legal compliance, or dispute preservation.
• Invoices and tax records: retained for the statutory Portuguese accounting and tax period, normally 10 years. Account fields copied into those records remain with the record.
• Support, security, abuse, and legal records: kept only for the period reasonably necessary to resolve the request or incident, protect the service, enforce rights, meet a legal duty, or defend a claim, then deleted or anonymized. Live-chat or Level 1 support text submitted for AI assistance may also remain for the period set by the applicable VYKIX business account and provider terms.
• Newsletter and marketing: your marketing preference and the record of when and where you selected it are kept while the preference is active and for a limited period afterwards as evidence that the sending was lawful. A minimal suppression record, normally the email address in hashed or reduced form, is kept for as long as we operate the mailing list so that an unsubscribe continues to be honoured.
• Analytics choices: the browser record expires after 180 days or when the notice version changes. This is a VYKIX retention choice, not a statutory period. Pseudonymous server-side consent and audit records are kept for 730 days after the decision unless a longer period is required for a specific legal claim or regulatory request. Google Analytics data follows the retention setting in the VYKIX Google property and Google's applicable controls.
• Steam link: kept while the link and relevant eligible benefit remain active, then removed unless a limited record is needed for security, dispute, abuse, or legal compliance.

8. Your Rights and Complaints

Subject to the conditions and exceptions in applicable law, you may request access, correction, erasure, restriction, portability, or information about recipients; and withdraw consent without affecting earlier lawful processing. You may also complain to the Portuguese CNPD. UK individuals may complain to the UK Information Commissioner's Office.

Right to object under Article 21: Where we rely on legitimate interests under Article 6(1)(f), you may object at any time on grounds relating to your particular situation. We will stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is needed to establish, exercise, or defend legal claims. You may object at any time to processing for direct marketing, including related profiling. If you do, we will stop processing your personal data for direct marketing. You can object using the email address below; for marketing, you may also use the unsubscribe link or client-area preference.

Send requests to [email protected]. We will respond within one month of receiving the request. Where a request is complex, or where you have made several requests, we may extend that period by up to two further months; if we do, we will tell you within one month of receiving the request and explain why. We do not charge unless a request is manifestly unfounded or excessive and applicable law permits a reasonable fee.

We also accept data-protection complaints at that address. We acknowledge a UK data-protection complaint within 30 days, investigate it without undue delay, keep you informed where the response is delayed, and explain the outcome. This does not limit your right to complain directly to the ICO or another competent authority.

9. Security and Breaches

VYKIX uses measures proportionate to the service and risk, including transport encryption where supported, account and role-based access controls, network filtering, Cloudflare protection for proxied web traffic, provider-dependent DDoS mitigation, logging and monitoring, patching, and access-restricted backups on VYKIX-controlled hardware where enabled. Authorized contractors with access to WHMCS are bound by confidentiality obligations. For live chat and Level 1 support, staff using AI assistance must minimize the submitted text, exclude passwords, authentication secrets, full payment credentials, identity documents, and unrelated records, and review the output before sending it. These measures reduce risk but no system can be guaranteed completely secure.

Where VYKIX acts as controller, it assesses personal-data breaches and notifies the competent authority and affected individuals when legally required. Where VYKIX acts as processor, it notifies the customer-controller without undue delay after becoming aware of a personal-data breach affecting customer data.

10. Hosted Players and Other End Users

VYKIX sells infrastructure services, not player-monitoring or profiling services. People who connect to a customer's hosted service provide network identifiers directly through their connection. VYKIX processes limited network and security data as controller where necessary to route and protect traffic. During a suspected attack or abuse event, a limited traffic sample may technically include payload information; access is restricted to the security purpose and is not used to inspect ordinary gameplay.

The hosting customer controls its game configuration, plugins, databases, logs, player profiles, and gameplay processing and must provide its own lawful player notice. VYKIX processes such hosted content only on the customer's documented instructions, except where law or VYKIX's independent security obligations require otherwise.

11. Optional Steam Linking and Rust Partner Benefits

For an eligible paid Rust server, a customer may choose to link a Steam account using Steam OpenID. Linking is not required to use the core hosting service. VYKIX stores the SteamID64 with the client account to verify the link, confirm eligibility, support service checks, and activate a partner benefit requested by the customer.

Purchasing a Rust server does not cause automatic sharing. Only after the customer voluntarily links Steam and requests the relevant benefit does VYKIX share the SteamID64 and eligibility information with the selected partner, such as Galium or RankEval. VYKIX does not sell the identifier. Unlinking stops future sharing by VYKIX and may end the linked benefit.

Galium and RankEval are independent providers. A partner plugin or service may process broader player data—such as gameplay events, behavioural or anti-cheat signals, scores, enforcement information, histories, or public profiles—under the partner's notice and the server operator's instructions. That processing is not transformed into a VYKIX service merely because access is an included optional benefit. Before activation, the customer must receive the applicable partner notice and terms and is responsible for giving players any notice and choice required for its server configuration. We will not enable partner telemetry or share SteamID64 before the customer's affirmative activation.

12. Children and Automated Decisions

VYKIX client accounts and contracts are for persons aged 18 or over. Hosted customers may operate services used by younger players; the hosting customer is responsible for the lawful configuration of that service and any age-related notices or consents. No AI-assisted reply is sent to a customer without review by an authorized staff member. VYKIX does not use client-account data for solely automated decisions that produce legal or similarly significant effects and does not use client-account data to build advertising profiles.

No advertising pixel, remarketing tag, or advertising audience technology is deployed on this website in this release. Before adding one, VYKIX will update this notice and the Cookie Policy, name the technology and recipients, issue a new policy revision, and obtain a separate consent where required.

13. Social Media and Community Channels

VYKIX maintains a presence on Discord, TikTok, Instagram, and Facebook to answer questions and share product information. This website directs pre-sales and support questions to the VYKIX Discord community. If you contact us on a social platform, we process the message, your public profile name, and any details you choose to send, in order to answer you. The legal basis is our legitimate interest in responding to people who approach us through the channel they prefer, or pre-contractual steps where you are asking about buying a service.

These platforms are operated by independent companies that process your data for their own purposes under their own notices and settings, and we cannot control that processing. Where a platform provides audience statistics about a VYKIX page or profile, VYKIX and the platform may be joint controllers for that specific statistical processing, while the platform remains solely responsible for the wider processing it carries out on its own account. Please do not send account credentials, payment details, or identity documents through a social platform; use [email protected] or the client portal instead.

14. Visitors in the United States and Do-Not-Track Signals

VYKIX sells services to customers in the United States, including capacity in Chicago and New York, and this notice applies to those customers.

Most browsers and mobile operating systems offer a Do-Not-Track (“DNT”) setting that signals a preference not to be tracked across websites. There is still no finalised, uniform standard for how websites must interpret DNT signals, and VYKIX does not currently respond to DNT signals or to other automated mechanisms of that kind. This website loads no analytics or advertising technology at all unless you actively allow the matching purpose in the consent control, which gives you a clearer and more specific choice than a browser-wide signal does. If a binding standard for DNT is adopted that applies to us, we will follow it and describe the change here.

VYKIX does not sell personal data for money and does not deploy cross-context behavioural advertising technology on this website in this release. If you are a California resident and believe that California privacy law gives you a right in relation to our processing, contact [email protected] and we will consider the request and respond.

15. Changes

We may update this notice when services, providers, or law change. We will update the date above and give additional notice where a change materially affects individuals or requires a new consent.