Privacy Policy

1. Data Controller

The data controller within the meaning of the GDPR is Nyvoro UG (haftungsbeschränkt), Johann-Georg-Fischer-Straße 18, 73079 Süßen, Germany (registered at Amtsgericht Ulm, HRB 750468). We are the data controller for the personal data processed through this website (voxel-mind.com), our Minecraft mod integration, and our backend services.

Contact for privacy inquiries: info@voxel-mind.com

2. What We Collect

• Account data: Email address, display name, and authentication data when you sign in via Google or Discord OAuth.
• Bot configuration: Bot names and personality parameters (OCEAN model) that you configure.
• Gameplay data: Your AI agents’ in-game state, including spatial memory (locations visited), events (actions taken), and learned knowledge. This data is generated during simulation and stored per agent.
• Payment data: If you purchase a subscription or Spark packs, our payment processor handles your payment information. We only store your customer ID and subscription status — we never see or store your credit card details.
• Minecraft mod: The VoxelMind Minecraft mod communicates with our backend servers via encrypted connections. It transmits gameplay state and receives AI decisions. No data is stored locally beyond authentication tokens.

3. Purposes and Legal Bases

• Service delivery (Art. 6(1)(b) GDPR): To provide and operate the VoxelMind AI simulation platform, including AI decision-making, memory persistence, and gameplay features.
• AI processing (Art. 6(1)(b) GDPR): To generate AI agent decisions, the agent’s current game state (inventory, health, surroundings, chat messages) is sent to the Gemini API and Anthropic API for processing. This is essential for the core functionality of the service.
• Payment processing (Art. 6(1)(b) GDPR): To handle subscriptions, Spark purchases, and billing.
• Communication (Art. 6(1)(a) GDPR): To send you a welcome email and product updates, based on your consent.
• Product improvement (Art. 6(1)(f) GDPR): To improve our product based on aggregated, non-personal usage patterns. Our legitimate interest is the further development and optimization of our service.

4. AI Processing

VoxelMind uses Google’s Gemini API and Anthropic’s Claude API to power AI agent behavior. When an agent is active, the following data is sent to the AI services for each decision cycle:

• Bot state: health, hunger, position, inventory
• Environment: nearby blocks, entities, and players
• Recent actions and events (short-term memory)
• Stored memories: spatial locations, learned knowledge
• In-game chat messages directed at the bot

Google Gemini API: This data is processed by Google (Google LLC, USA) under their API terms of service. Google processes this data as a processor on our behalf. Data transfers to the USA are covered by Google's Data Processing Addendum and Standard Contractual Clauses (SCCs). We do not use the Gemini API for model training — your data is used solely to generate responses and is not retained by Google for training purposes.

Anthropic Claude API: For certain planning and reflection tasks, we use Anthropic's Claude API (Anthropic PBC, USA). Anthropic processes data as a processor on our behalf, covered by Standard Contractual Clauses (SCCs). Anthropic does not use your data for model training.

5. Automated Decision-Making

VoxelMind uses AI-powered processing (Google Gemini API, Anthropic Claude API) to control AI agent behavior in-game. No automated decisions are made about you as a person that produce legal effects or similarly significantly affect you (Art. 22 GDPR). AI decisions relate exclusively to agent gameplay behavior within Minecraft.

6. Data Sharing & Processors

We do not sell your data. We use the following third-party services to operate VoxelMind:

• Supabase (Supabase, Inc.) — Authentication and database. Data stored in EU region (Frankfurt, Germany).
• Hetzner (Hetzner Online GmbH, Germany) — Backend server hosting (Brain server). Data processed and stored in Germany.
• Google Gemini API (Google LLC, USA) — AI decision-making engine. See Section 4 for details. Data transfer under SCCs.
• Anthropic Claude API (Anthropic PBC, USA) — AI planning and reflection tasks. Data transfer under SCCs.
• Stripe (Stripe, Inc., USA) — Payment processing. Stripe handles all payment data directly and is PCI-DSS certified. Data transfer under SCCs.
• Netlify (Netlify, Inc., USA) — Website hosting and content delivery. Data transfer under SCCs.
• Resend (Resend, Inc., USA) — Transactional emails (welcome emails). Data transfer under SCCs.
• Google OAuth / Discord OAuth — Authentication providers. When you sign in, the respective provider shares your email and profile name with us per the OAuth consent you grant.

We have Data Processing Agreements (DPAs) in place with all processors listed above in accordance with Art. 28 GDPR.

7. Data Retention

• Account data: Stored until you delete your account, then deleted within 30 days.
• Bot gameplay data: Bot memories, events, and knowledge are stored until you delete them (via Settings) or delete your account. Events older than 3 hours are automatically decayed.
• Payment data: Billing records are retained as required by German tax law (§ 147 AO, up to 10 years for invoices).
• Server logs: 14 days.
• AI interaction data: Game state sent to the AI APIs is not stored by us after the AI response is generated.

8. Data Deletion

You can delete your data at any time from your dashboard settings:

• Delete Bot Data: Removes all bot memories, events, and knowledge while keeping your account intact.
• Delete Account: Permanently removes your account and all associated data, including bots, bot data, and authentication records. This action cannot be undone.

Alternatively, you can request deletion by emailing info@voxel-mind.com

9. Your Rights (GDPR)

You have the right to:

• Access your personal data (Art. 15 GDPR)
• Rectify inaccurate data (Art. 16 GDPR)
• Request deletion of your data (Art. 17 GDPR)
• Restrict processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdraw consent at any time (Art. 7(3) GDPR)
• Lodge a complaint with a supervisory authority (Art. 77 GDPR)

11. International Data Transfers

Some of our processors are based in the United States (Google, Anthropic, Stripe, Netlify, Resend). For these transfers, we rely on Standard Contractual Clauses (SCCs) adopted by the European Commission to ensure an adequate level of data protection. Where available, we also leverage the EU-U.S. Data Privacy Framework.

12. Cookies

This website uses only technically necessary cookies for authentication (session management via Supabase). We do not use tracking cookies, analytics cookies, or third-party advertising cookies.

13. Children

VoxelMind is not intended for persons under 16 years of age. We do not knowingly collect personal data from persons under 16. If we become aware that a person under 16 has provided us with personal data, we will delete that data promptly.

14. Supervisory Authority

The competent supervisory authority is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW), Königstraße 10a, 70173 Stuttgart.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice on our website. The “last updated” date at the top indicates the most recent revision.

VoxelMind is not affiliated with or endorsed by Mojang Studios or Microsoft Corporation. Minecraft is a trademark of Mojang Studios.

In case of discrepancies between the German and English versions of this privacy policy, the German version shall prevail.