SOLUM

Legal

Privacy

Last updated 2026-09-20

This is the whole list. Solum collects what it needs to sell you a key and hand it over, and nothing beyond that — no analytics, no advertising, no trackers, no third-party scripts on any page.

Controller
[set LEGAL_ENTITY in .env]
Country
[set LEGAL_COUNTRY in .env]
Address
[set LEGAL_ADDRESS in .env]
Contact
[set LEGAL_PRIVACY_EMAIL in .env]

What is stored

  • Your Discord account. You sign in with Discord, so the account is your Discord user ID, with your username, display name, avatar and banner as Discord reports them at each sign-in. We never get your Discord email or password, and we keep no Discord access token after you are signed in.
  • The email you pay with. Stripe asks for it at checkout; it is stored on the order so the receipt has somewhere to go.
  • Your orders. What you bought, what it cost, when, and which keys were handed over — needed for the invoice, for support and for tax records.
  • Your licence keys. The codes themselves, so a key that did not reach you can be sent again, and so a reseller can see and download the keys they bought.
  • When you joined the Solum Discord server. Signing in adds you to it; it is where support and updates live, and where the customer role is granted.
  • Sessions. Each signed-in browser stores a random session ID, the address it signed in from and its browser user-agent string, so a stolen session can be traced and ended.
  • Rate-limit counters. Short-lived counts against an address or an account, so sign-in cannot be brute-forced.
  • Server logs. Request lines and errors. Secrets and licence codes are stripped before anything is written.

What is not stored

  • No card details, ever. Payment happens on Stripe's own pages. We are told that an order was paid and how much — never the card number.
  • No real name, address, date of birth or ID document. We do not ask and do not want them.
  • No analytics, no advertising identifiers, no cookies except the one that signs you in.
  • Nothing at all about what you do inside the game. Solum does not report to this site.

Why, and on what basis

  • To perform the contract: the account, the order, the key, the receipt. Without these there is nothing to sell you.
  • Legitimate interest: rate limits, logs and the audit trail — keeping the shop from being broken into or drained.
  • Legal obligation: keeping records of sales and tax for as long as the law requires.
  • Consent: linking Discord. You choose to, and you can unlink it.

Cookies

One cookie, named solum_session. It holds a random session ID and its signature, nothing about you, and it is HttpOnly and SameSite so another site cannot read it. It lasts until it expires or you sign out. There is no cookie banner because there is nothing to consent to.

Who else sees anything

  • Stripe — payments. They get your email and the amount, and they hold the card details we never see. Their own privacy notice covers that.
  • Discord — sign-in. With your permission we read your ID, name, avatar and banner, add you to the Solum server, and grant it a role when you buy.
  • Our email provider — to deliver receipts.
  • Our hosting provider — the server the site runs on.
  • Susano — when you redeem a key on their site, that is between you and them. We do not send them anything about you.

Nothing is sold, rented or handed to anyone for advertising. Data is disclosed otherwise only where the law requires it.

How long

  • Account and keys: until you ask us to delete the account.
  • Orders and invoices: kept for as long as tax law requires, even after the account is deleted. This is the one thing deletion cannot clear.
  • Sessions: until they expire or you sign out.
  • Rate-limit counters: minutes to hours.
  • Logs: a short rolling window, long enough to investigate a problem.

Your rights

You can ask for any of these, and it costs nothing:

  • A copy of what we hold about you.
  • A correction, if something is wrong.
  • Deletion of your account — subject to the invoice retention above.
  • An export of your data in a machine-readable file.
  • To object to processing based on legitimate interest.

Write to [set LEGAL_PRIVACY_EMAIL in .env] from the address on the account. We answer within 30 days. If you are in the EU or UK and you are not satisfied, you can complain to your national data protection authority.

Security

  • Everything is served over HTTPS.
  • There are no passwords to leak: you sign in through Discord, and Discord's own two-factor protects your Solum account too.
  • A content security policy forbids third-party scripts on every page, which is why this site loads no CDN.
  • Secrets and licence codes are stripped from logs before they are written.

No system is perfect. If we find a breach that puts you at risk, we tell you and the regulator within the time the law allows.

Children

Solum is not for anyone under 18. If you believe someone under that age has an account, write to [set LEGAL_PRIVACY_EMAIL in .env] and it will be removed.

Changes

If this notice changes in a way that matters, the date at the top moves and the change is announced in the Discord.

Contact

[set LEGAL_PRIVACY_EMAIL in .env]