Privacy Policy

1. Introduction

Welcome to Bloxburg Sunset Resorts ("we", "our", or "us"). This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website and related services (the "Service"), including our Discord bot.

By using our Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of the Service.

2. Information We Collect

2.1 Information You Provide

We collect the following information when you interact with our Service:

• Discord account information — username, user ID, profile picture, and email address — collected when you authenticate via Discord OAuth2
• A contact email address if you voluntarily add one in your profile settings, used for appeal and GDPR request notifications
• Room booking requests including your selected resort, room type, preferences, and booking responses
• Staff and employment applications submitted through our application system
• Appeal submissions, including your written responses to moderation questions
• GDPR requests you submit through our privacy request portal
• Any messages or communications sent through our platform or Discord bot

2.2 Information Collected Automatically

When you use our Service, we may automatically collect:

• Your Discord server roles and membership status to verify VIP, Gold Customer, staff, and admin access
• Your Roblox account information (display name, user ID) when resolved via Bloxlink during in-game check-ins
• Room check-in records including room number, room type, resort, all-inclusive status, and Gold Customer status
• Loyalty programme data including points earned, tier status, point history, and redemption records
• Moderation records including warnings, bans, notes, and moderation log entries created by our staff
• Staff HR records including leave requests, LOA applications, and session absence records
• Ticket records from our Discord support ticket system
• Message activity counts within our Discord server
• Suggestion submissions made through our Discord bot
• Session hosting records where you served as host or co-host
• Usage data such as pages visited and features used
• Technical data including browser type and IP address for security purposes

3. How We Use Your Information

We use the information we collect to:

• Authenticate your identity and manage your account via Discord OAuth2
• Verify your Discord server roles (VIP, Gold Customer, Admin, Management) to grant appropriate access and apply applicable discounts
• Process and manage room booking requests and check-ins
• Award and track loyalty programme points, calculate tier status, and apply tier-based discounts and perks
• Log room check-ins to Google Sheets for session management purposes
• Send booking confirmations, appeal decisions, and account updates via Discord DM and optionally via email
• Process GDPR and data subject requests submitted through our portal
• Manage staff HR records including leave requests and session absences
• Operate and improve our Service and Discord bot
• Respond to your enquiries and provide support
• Detect and prevent fraudulent or unauthorised activity
• Comply with legal obligations

4. Loyalty Programme Data

Our loyalty programme collects and processes the following data to operate:

• Points earned from room check-ins and confirmed bookings, including the room type, price paid, and date
• Your current loyalty tier (Bronze, Silver, Gold, Platinum) calculated from your total points
• A history of all point-earning and point-deduction events
• Credits exchange requests, which are processed via a moderation ticket
• Your tier perks and applicable booking discounts, which are determined by your current tier

Loyalty points have no real-world monetary value and cannot be transferred to other users. Your tier and points balance are visible on your profile page and are used to apply discounts during check-ins.

5. Google Sheets Integration

During in-game sessions, room check-in data is written to a private Google Sheet accessible only to authorised BSR staff. The following information is written to the sheet at the time of check-in:

• Your Roblox display name
• Your Gold Customer status
• Your All Inclusive status
• Your loyalty tier at the time of check-in

This data is used solely for session management and is not shared with third parties. The sheet is hosted on Google Drive and subject to Google's Privacy Policy (policies.google.com/privacy).

6. Sharing of Information

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• With our staff and administrators to process booking requests, manage sessions, handle appeals, and fulfil HR functions
• With Discord, as our authentication provider — please review Discord's Privacy Policy at discord.com/privacy
• With Google, for Google Sheets session logging and Google Drive document management — see policies.google.com/privacy
• With Bloxlink, to resolve Roblox usernames to Discord IDs during check-ins — see blox.link/privacy
• With Roblox, to look up display names and user IDs — see en.help.roblox.com/hc/articles/115004630823
• If required by law or to protect the rights, property, or safety of our users or the public

7. Data Storage and Security

Your data is stored securely in MongoDB Atlas, a cloud database service provided by MongoDB, Inc. We implement reasonable technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction.

Our website is hosted on Vercel and our email infrastructure runs on Mailcow. Data in transit is encrypted using TLS. However, no method of transmission over the Internet or electronic storage is 100% secure.

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. Specifically:

• Booking records are retained indefinitely for operational and administrative purposes
• Moderation records (warnings, bans, notes, modlogs) are retained for the integrity of our community safety systems
• Loyalty programme history is retained for the lifetime of your account
• Staff HR records (leave requests, LOAs, session absences) are retained for internal HR purposes
• GDPR request records are retained as required to demonstrate compliance
• Upon a verified data deletion request, personal data will be removed subject to legal retention obligations — certain booking records may be retained in anonymised form

9. Your Rights (GDPR and Applicable Law)

Depending on your jurisdiction, you may have the right to:

• Access — request a copy of all personal data we hold about you
• Rectification — request correction of inaccurate or incomplete information
• Erasure — request deletion of your personal data ('right to be forgotten')
• Restriction — request that we limit how we use your data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to our processing of your data in certain circumstances
• Withdrawal of consent — withdraw consent at any time where processing is based on consent

You can exercise your data export, deletion, and rectification rights directly through our Privacy Request Portal on the website. Your request will be handled by our compliance team and fulfilled within 30 days.

For all privacy enquiries, contact us at compliance@bloxburgresorts.com.

10. Third-Party Services

Our Service integrates with the following third-party services, each with their own privacy policies:

• Discord (authentication, notifications, bot) — discord.com/privacy
• MongoDB Atlas (data storage) — mongodb.com/legal/privacy-policy
• Vercel (website hosting) — vercel.com/legal/privacy-policy
• Google (Sheets session logging, Drive document management) — policies.google.com/privacy
• Roblox (game platform, username lookup) — en.help.roblox.com/hc/articles/115004630823
• Bloxlink (Roblox-to-Discord account resolution) — blox.link/privacy
• Mailcow / self-hosted SMTP (transactional email delivery)

11. Cookies

Our Service uses session cookies to maintain your authentication state after logging in with Discord. We do not use advertising cookies or third-party tracking cookies.

12. Children's Privacy

Bloxburg Sunset Resorts is a Roblox community platform open to players aged 13 and over, consistent with Roblox's Terms of Use. We do not knowingly collect personal information from children under the age of 13. If you believe a child under 13 has provided us with personal information, please contact us immediately at compliance@bloxburgresorts.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by updating the "Last updated" date at the top of this document. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

14. Contact Us

For privacy and data protection enquiries:

• Compliance Email: compliance@bloxburgresorts.com
• General Email: co@bloxburgresorts.com
• Discord Server: https://discord.bloxburgresorts.com
• Privacy Request Portal: https://bloxburgresorts.com/gdpr