Privacy Policy

Effective date: 18 August 2026 Last updated: 18 August 2026

This Privacy Policy explains what personal data PZStack (the "Service", "we") collects about you, why we collect it, how long we keep it, who we share it with, and the rights you have over it. It applies to the website at https://pzstack.com and to the managed Project Zomboid hosting service provided through it.

We have written this policy to comply with the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act / CPRA (CCPA/CPRA), and Türkiye's Law on the Protection of Personal Data No. 6698 (KVKK). Where those regimes give you stronger rights than this policy describes, the stronger right applies.

1. Who is the data controller?

The data controller is Hüseyin Okan Öztürk, trading as PZStack (the "Operator", "we"), based in Adana, Republic of Türkiye (Postal Code: 01010).

Contact for all privacy matters: [email protected] (or [email protected]) (Please put "Privacy" in the subject line.)

2. What data we collect

2.1 Data you give us directly

2.2 Data we collect automatically when you use the Service

2.3 Data we receive from the payment processor

When you buy a plan, our authorized Merchant of Record / payment processor handles your payment. We receive from the payment processor:

• A customer / transaction identifier;
• Subscription / order state events (created, updated, paused, cancelled, refunded);
• The plan / variant you bought.

We do not receive, see, or store your full card number, CVV, expiry, bank account, or tax identification. The handling of that data is governed by the payment processor's own privacy notice.

2.4 Data generated by your Project Zomboid server

Your Project Zomboid server produces logs, world saves, and (depending on mods) additional files. These sit on infrastructure we control so the Service can run them. We do not mine them for advertising and we do not sell them. We access them only to operate, back up, and secure the Service, to comply with law, or to investigate abuse under the AUP.

2.5 Special categories

We do not ask for, and we do not want, special-category personal data (health, political opinions, religion, sexual orientation, etc.) or biometric data. Please don't put such data in server names, descriptions, or mod payloads.

2.6 Children

The Service is not directed to children under 16. If we learn we have collected data from a child under 16 without verifiable parental consent, we will delete it. Contact [email protected] if you believe this has happened.

3. Why we process your data - and on what legal basis

Under GDPR / UK GDPR we must have a lawful basis for each purpose. Here is the mapping:

Under KVKK (Türkiye) the parallel bases are Art. 5 (expressly provided by law; necessity for a contract; legitimate interests; the data subject's consent). Under CCPA/CPRA (California) we describe "categories" and your rights in section 6.

4. Who we share your data with (subprocessors)

We share the minimum data needed with the following subprocessors. They each have a written contract with us (or their standard customer contract, which we have accepted) requiring them to protect your data.

We do not sell your personal data, and we do not "share" it in the CCPA/CPRA sense (cross-context behavioural advertising). We have no advertising partners.

4.1 International transfers

Game-server infrastructure location. Your Project Zomboid server's compute, network, and backups live on Hetzner Online GmbH bare-metal hardware in the European Union (Nuremberg and Falkenstein in Germany, Helsinki in Finland). Mod archives, job logs, and backup snapshots are stored in Hetzner Object Storage (also EU). Hetzner is a German-incorporated processor subject to the GDPR and the German Federal Data Protection Act (BDSG).

Control-plane location. The pzstack.com dashboard, API, application database, worker, and transactional-mail dispatcher run on a Hostinger International Ltd VPS in the European Union. Hostinger is established in the EU (Lithuania) and is subject to the GDPR.

Operator location. The Operator is established in the Republic of Türkiye. Staff access to production data - for the purpose of running the Service, handling support, and investigating abuse - takes place from Türkiye. Türkiye has not (at the time of writing) received an EU adequacy decision; for EU-origin data we therefore rely on the legal bases below for this administrative access.

Transfers outside the EU/EEA/UK/Türkiye. Some of the providers listed above are in the United States (our payment processor, Resend, Sentry, Cloudflare). When we transfer personal data to them, and when production data is accessed from Türkiye by the Operator, we rely on one of:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• The UK International Data Transfer Addendum for UK-origin data;
• Adequacy decisions where available (e.g. the EU–US Data Privacy Framework, if the vendor is certified);
• For KVKK, the express consent exception under Art. 9 until the cross-border transfer regime stabilises in Türkiye.

Data stored on Hetzner and Hostinger infrastructure does not leave the EU under normal operation; the only routine egress is administrative access by the Operator from Türkiye and the US-based subprocessor interactions described above.

5. How long we keep data

6. Your rights

6.1 Under GDPR / UK GDPR / KVKK

You have the right to:

• Access - ask for a copy of the personal data we hold about you;
• Rectification - ask us to correct inaccurate data;
• Erasure - ask us to delete your data ("right to be forgotten"), subject to retention we must keep for legal reasons;
• Restriction - ask us to stop processing while a dispute is resolved;
• Portability - receive key data in a machine-readable format;
• Object - to processing we do on the basis of legitimate interests;
• Withdraw consent - at any time, for anything we do on the basis of consent (this does not affect past processing);
• Lodge a complaint with your local data-protection authority. For EU residents this is the authority of your Member State; for Türkiye this is the KVKK Authority (Kişisel Verileri Koruma Kurumu); for the UK it is the ICO.

To exercise any of these rights, email [email protected] from the address on your account. We may ask for additional verification if the request is unusual. We will respond within 30 days (extendable to 90 days for complex requests, with notice).

6.2 Under CCPA / CPRA (California residents)

You additionally have the right to:

• Know what personal information we have collected about you in the past 12 months, including categories, sources, purposes, and recipients;
• Delete your personal information (with exceptions allowed by law);
• Correct inaccurate personal information;
• Opt out of sale or sharing - we do not sell and we do not "share" as defined by CPRA, so there is nothing to opt out of, but you can confirm this with us;
• Limit use of sensitive personal information - we do not use SPI beyond what is necessary to provide the Service;
• Non-discrimination for exercising these rights.

You can have an authorised agent make these requests for you; we will verify the agent's authority.

6.3 Under KVKK (Türkiye)

In addition to the GDPR-parallel rights above, you have the right under KVKK Art. 11 to:

• Learn whether your personal data is processed;
• Request information on the processing;
• Learn the purpose of processing and whether it is used for that purpose;
• Know the third parties to whom your data is transferred, in Türkiye or abroad;
• Request that incomplete or inaccurate data be corrected;
• Request erasure or destruction;
• Object to results produced by automated systems analysing you;
• Claim compensation for loss caused by unlawful processing.

To exercise any KVKK right, email [email protected]. Under VERBIS, our processing will be registered if and when the Operator becomes subject to the registration obligation; we will publish the VERBIS reference once it exists.

7. Security

We take security seriously because the Service runs other people's servers and is a natural target. Our defences include:

• Passwords hashed with Argon2id; plaintext never stored;
• Refresh tokens stored only as SHA-256 hashes, one row per device, rotated on every refresh, with theft-detection on replay;
• HttpOnly, path-scoped auth cookies;
• Per-route rate limits on authentication endpoints and a tighter cap on /register to block account-spam;
• Two-step, OTP-gated destructive actions (account email change, password reset, server deletion);
• HMAC-signed and version-pinned agent ↔ API traffic;
• Encrypted TLS in transit for all web and API traffic;
• Encrypted-at-rest object storage for backups and mod archives;
• Role segregation: only staff with a real operational need can reach production data, and we log administrative access.

No system is perfectly secure. If you believe you have found a vulnerability, see our security contact below.

8. Cookies

A full breakdown is in our Cookie Policy. In short: we set strictly-necessary cookies for authentication, CSRF protection, and rate-limiting. Non-essential cookies (if we ever add analytics) are loaded only after you consent via the banner.

9. Automated decision-making

We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing.

10. Changes to this policy

If we make a material change we will email registered users and show a notice in the dashboard at least 14 days before it takes effect. We keep older versions archived; on request we can send you the version that applied when you signed up or when a specific event happened.

11. Contact

• Privacy / DSAR / KVKK / CCPA requests: [email protected]
• Security issues / responsible disclosure: [email protected] (subject: "security")
• Postal address: Hüseyin Okan Öztürk, Adana, Republic of Türkiye (Postal Code: 01010)

_This policy is deliberately written in plain language. If anything is unclear, email us and we will explain it in even plainer language._