Introduction
Corallium Studios ("we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights regarding it.
We operate the Corallium Studios Customer Hub at coralliumstudios.net and related services. Our registered business operates globally; if you are located in the European Union, your data rights under the General Data Protection Regulation (GDPR) apply in full.
Data We Collect
Account Data
When you register for an account, we collect your username, email address, and a securely hashed password. We also store a unique user ID (UUID) to identify your account across services.
Purchase & Payment Data
Payments are processed exclusively by Stripe, Inc. We do not store your card number, CVV, or full payment details on our servers. We receive a Stripe customer reference ID, a record of completed transactions, and license keys issued to your account.
Usage Data
We may log IP addresses, browser type, and request timestamps for security and abuse prevention. We do not use tracking pixels, third-party ad networks, or cross-site behavioral tracking of any kind.
Support Communications
If you open a support ticket, the message content, attachments, and correspondence are stored to allow our team to respond and track resolution.
Product-Specific Data
Some products may collect additional data to function — for example, NautilusControl may store server configuration data you enter, and FabledCreatures stores game progress. This data is documented within each product's own documentation.
How We Use Your Data
We use your data only to operate and improve our services:
- To provide the services — account authentication, license issuance, and product access.
- To process payments — passing necessary data to Stripe to complete transactions.
- To provide support — responding to tickets and resolving issues.
- For security — detecting abuse, preventing fraud, and investigating unauthorized access.
- Legal obligations — retaining transaction records as required by applicable tax and financial law.
We do not sell your personal data. We do not use your data for advertising. We do not share your data with third parties except as described in "Third-Party Services" below.
Storage & Security
Your data is stored in MongoDB Atlas, a managed cloud database hosted in secure, access-controlled facilities. Passwords are hashed using bcrypt with a suitable cost factor — we cannot retrieve your password in plaintext.
All data transmission to and from our servers is encrypted using TLS. Authentication tokens are short-lived JWTs stored in your browser and expire automatically.
We retain your account data for as long as your account remains active. Transaction records are retained for up to 7 years to comply with financial regulations. If you request deletion of your account, we will delete or anonymize personal data within 30 days, except where retention is required by law.
Third-Party Services
| Service | Purpose | Data Shared |
|---|---|---|
| Stripe, Inc. | Payment processing | Email, purchase amount, billing details |
| MongoDB Atlas | Database hosting | All account & application data |
| Discord (OAuth) | Optional login method | Discord user ID, username (if you choose to link) |
Each third-party service has its own privacy policy. We encourage you to review Stripe's and Discord's privacy policies independently.
Your Rights
If you are located in the European Union or United Kingdom, you have the following rights under GDPR / UK GDPR:
- Right of Access — Request a copy of the personal data we hold about you.
- Right to Rectification — Correct inaccurate data (much of this can be done from your Account page).
- Right to Erasure ("Right to be Forgotten") — Request deletion of your account and personal data, subject to legal retention obligations.
- Right to Portability — Receive your data in a machine-readable format.
- Right to Restrict Processing — Limit how we use your data in certain circumstances.
- Right to Object — Object to processing where we rely on legitimate interests.
- Right to Withdraw Consent — Where processing is based on consent, you may withdraw it at any time.
To exercise any of these rights, please submit a request through our support ticket system. We will respond within 30 days.
You also have the right to lodge a complaint with your local data protection authority. In the EU, this is your national supervisory authority (e.g., the ICO in the UK, CNIL in France).
Children's Privacy
Our services are not directed to children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it promptly.
Users between the ages of 13 and 18 should ensure they have parental or guardian consent before creating an account or making any purchase.
Policy Changes
We may update this Privacy Policy from time to time. We will notify registered users of material changes via the in-platform announcement banner or by email. Continued use of our services after the effective date of any change constitutes acceptance of the updated policy.
The "Last updated" date at the top of this page reflects when the policy was most recently revised.
Contact
For any privacy-related questions, data requests, or to report a concern, please use our support ticket system:
Open a Privacy Request Ticket