Privacy Policy

1. Who we are

This Privacy Policy explains how the operator of Cerise ("we", "us") handles personal data when you use cerise.lol, accounts, payments, the license APIs, and the Cerise client. It works together with our Terms of Service. Cerise is run by one individual, not a company. That operator is established in Hungary and is the data controller for everything described here, which means they decide why and how this data is used and are answerable for it.

Write to privacy@cerise.lol about anything on this page, including a request to exercise the rights in section 8. We are not required to appoint a data protection officer and have not appointed one. That address reaches the controller directly.

2. Data we collect

• Account. Email, hashed password, name fields, optional username and avatar, role, account status (for example active or suspended), member number, timestamps.
• Sessions and auth. Session tokens, approximate IP, user agent, expiry times. Credential and provider rows needed for sign-in.
• Licenses and seats. License keys and plan metadata, status (including revoked or suspended), expiry and cancel times, seat limits, HWID hashes, optional device fingerprint components, seat labels, bind times.
• Activation and security logs. Every successful loader start and first seat bind, event type, outcome, reason, IP, user agent, HWID hash, and bounded security details. Those details may include a redacted launch-location category, Windows version and build, architecture, elevation, locale and UTC offset, scan-coverage status, allow-listed tool codes, VM/VPN confidence with canonical evidence codes, and a server-derived count of repeated starts. When the loader reports a security signal, the log also carries three short free-text fields so that staff can tell a broken install from an attempt to take the product apart: the path of the executable that started, the Windows account name, and the machine name. They are length-capped, shown only to staff, never used to decide anything automatically, and removed with the rest of the detail on the 30-day boundary in section 7. We do not collect environment variables, arbitrary process names, or a full process list for this log.
• Gameplay statistics. Cerise session start, end, and last-seen times, active duration, launch counts, and all supported entries shown in the in-game Currency Bag, selected other wallet and inventory valuable balances, and cumulative observed increases and decreases (earned and spent) during a session. These figures are reported by the client, may be incomplete, and are kept as a personal activity history. We do not collect chat, character names, raw inventory contents, or every individual in-game action for this feature.
• Bans. Scope and value (for example HWID), reason, creator metadata, timestamps.
• Cloud configs. Named presets and settings blobs you save from the client.
• Discord. If you connect Discord or are reported to us as a server booster, we store your Discord user id. If you applied to the community server before applications closed, we still hold that application: the handle we saw, your active time and launch count as they stood when you applied, the note you wrote, and the staff decision on it.
• Referrals and rewards. Your own referral code, the account that referred you and when, and one ledger row for every reward paid: the plan that was bought, the payment processor and its charge id, the days credited, the license they landed on, and whether a refund later took them back. Boost rewards record the Discord id, the month they cover, and the days credited.
• Beta program. A normalised form of the email address that claimed a slot. This one is deliberately kept after an account is deleted, as a marker that the slot was claimed, so the same mailbox cannot take a second slot and a second free trial.
• Billing references. For a plan bought by card before 28 September 2026, the card processor’s ids for the account, the membership, the plan, the payment and the checkout, and the plan it bought. We never stored card numbers. We no longer take cards, so nothing new is added here. Payments in crypto do not go through any payment provider. Section 2a covers them.
• Technical data. Request metadata used for rate limits, abuse detection, debugging, and hosting logs.

2a. Payments in crypto

When you pay for a plan in the coins the payment page offers (Litecoin at the moment), or a reseller adds to their balance, no payment company sits in between. The money goes from your wallet straight to Cerise’s own wallet. We open an order for it, and the order holds:

• Your account, what you are buying (a plan, or an amount of reseller balance), the coin, and the price in euro.
• The exchange rate we used, and the coin amount we asked for.
• A deposit address made for the order from Cerise’s own wallet. An address that has received money is never given to another order.
• What reached that address: money confirmed, money still waiting for a block, and money seen while the price was held. For money that arrived after that, the euro price it was counted at.
• The id of the first transaction that paid the address.
• When the order opened, when money first reached it, when its price and its watching end, when it was paid, and when the plan or balance was added, and how much balance. For a plan, the time the order opened is also our record of the consent described in section 8 of the Terms.
• If part of a payment arrived and you asked for a new price for the rest: that price, the amount it asked for, and when it ran out.
• If the order owes you money back: why, how much, the refund address you gave us and when, and for each refund we send, its transaction, what it sent, whether we paid the network fee, and who on staff sent it and when.
• If staff complete or refund the order by hand, what they decided, who decided it, when, and a short note.

Your refund address. You give it on your License page when an order owes you money back, or while a payment is still short. We use it for one thing: to send that money back. We check it is a real address for the coin you paid in, you can change it until we send, and once we have sent, it stays on the order as the address the refund went to. It is part of the order, and is kept and removed with it (section 7). When an order owes a refund, staff get an email naming the order, the coin and the amount. It carries nothing else about you.

A paid plan order also gets a row in our payment records: the plan, the euro price, and the coin amount that arrived. A paid top-up gets a row in the reseller’s ledger instead (section 2b).

We do not read or store the address you paid from. The only address of yours we keep is the refund address, if you give one. We do not store your IP address with an order, and the checkout counts requests per account, not per IP address.

Payments on these networks are public and permanent. Anyone who knows a deposit address or a transaction id can look it up on a block explorer and see what was paid, when, and from which addresses. We cannot delete or change that record, and neither can you. The chain does not carry your name or your account. Our order is what links a payment to you, and we do not publish it. The wallet or exchange you send from also sees the payment, under its own terms.

To see whether money has arrived, our server asks a public block explorer about the deposit address. By default that is litecoinspace.org for Litecoin. When it does not answer, or falls behind the chain, our server asks a backup instead: litecoinblockexplorer.net or blockbook.ltc.zelcore.io for Litecoin. We can switch to other explorers, or to a server we run ourselves. After an order closes, our server keeps asking about its address every few hours for 30 days, so money sent to it late still reaches the right order, and before an address is used for a new order it asks once more whether the address ever received anything. For a refund, it asks the explorer for the current network fee. To price an order, and money that arrives after the price stopped being held, our server asks Kraken for the euro price of each coin, and Coinbase for any coin Kraken does not price. The explorer is told the deposit address and nothing else. The exchanges are told nothing about you at all. None of them receives your account, your email address, your refund address, or your IP address, because the requests come from our server and not from your browser.

The payment page gets the order from our server only. It does not contact an exchange, an explorer, or a QR code service. The QR code is drawn in your browser.

2b. Resellers and reseller keys

Some members are resellers. Staff decide who is one. A reseller buys Cerise keys from a balance they pay in ahead, and sells them on.

If you redeem a key. We record when you redeemed it, and it becomes a license on your account with the data in section 2. The reseller who sold the key sees, for that key: your member number, when you redeemed it, when it ends and how long it has left, how many machines hold a seat on it right now, and whether it is running, paused, revoked or expired. If it is paused, they also see whether the pause came from us rather than from them. They do not see your username, your email address, your IP address, which machines you use, or anything else about your account. Redeeming counts attempts per account, not per IP address, and we do not store your IP address with a redemption.

If you are a reseller. We hold whether your reseller account is active or suspended, your discount, your balance, the keys you bought and the batch each one came in, and a ledger of every change to your balance. Each ledger row says how much, why (a top-up, a batch of keys, or a change by staff), which order or batch it belongs to, and when. A change made by staff also names the staff member and carries their note on why.

Your API key is stored only as a one-way hash, plus its first few characters so you can tell which key is live. We cannot show it to you again after it is made. An idempotency key sent with a batch is not stored either. Only a one-way hash of it is kept, as the batch id. Requests to the reseller portal and the reseller API are counted per account, not per IP address, and we do not store your IP address with anything you do there.

Staff can see all of this: each reseller’s account, balance, discount, key counts and full ledger, and which reseller sold any key. Staff may also keep notes about a reseller. Those notes are not shown in the portal, but they are part of your data, and section 8 lets you ask for them.

3. Why we use data

• Provide accounts, sessions, and the website.
• Sell and deliver access, bind seats, verify signed license grants, and run the client protocol.
• Enforce the Terms: suspend accounts, revoke licenses, ban HWIDs, rate-limit abuse, investigate fraud and chargebacks.
• Process payments and reconcile processor webhooks.
• Take payments in crypto by watching their deposit addresses, send back money an order owes to the refund address you give, and run the reseller program, including showing a reseller the keys they sold.
• Provide support and fix product issues you report.
• Show you personal session history and summaries of time played, launches, and observed changes in supported resource balances.
• Secure the Service and improve reliability.
• Meet legal obligations where they apply.

Where GDPR or similar laws apply, we rely on performance of a contract (providing the Service you request), legitimate interests (security, fraud prevention, enforcement, product improvement), and legal obligation when required. We do not sell your personal data.

3a. Our legal bases

Under the GDPR every use of personal data needs a lawful basis. Ours are these, and each one covers only what is listed beside it.

• Performance of a contract. Creating and running your account, delivering access, issuing and checking licenses, binding and releasing machine seats, taking payment, and giving support. Without this data there is no way to provide what you bought.
• Legitimate interests. Keeping the Service secure and available, preventing fraud, abuse and license sharing, keeping audit records of enforcement decisions, and running the referral and boost programs. We weigh these against your interests, which is why the security records are compact, are limited to what an operator has to be able to check, and are removed on the schedule in section 7.
• Consent. Optional things you choose to add, such as an avatar, a profile banner, or linking a Discord account. You may withdraw consent at any time by removing them, and doing so does not affect what was lawful before.
• Legal obligation. Keeping payment and tax records for as long as accounting law requires, and answering lawful requests from a competent authority.

Sections 2a and 2b rest on the same bases. Taking a payment in crypto, sending back money an order owes, crediting a top-up, and running a reseller account are performance of a contract. Keeping those orders is also a legal obligation where accounting law requires it. Showing a reseller what section 2b lists about a key they sold is a legitimate interest, ours and theirs: it lets them support the key and see that it is in use. That purpose needs no name or contact details, so they get none.

Where we rely on legitimate interests, you have a right to object. See section 8.

4. Enforcement and automated checks

Seat limits, replay protection, ban lists, account status, and rate limits may automatically deny activation or other API calls. Staff may also manually suspend accounts, revoke licenses, or ban hardware. Those actions use the data above and may permanently affect your ability to use Cerise.

Tool, VM, VPN, launch-location, and repeated-start telemetry is shown only to staff for review. It is client-reported, can be incomplete or spoofed, and does not by itself automatically ban, suspend, revoke, or deny access. Challenge-authenticated debugger and integrity reports use a separate path that authenticates the current loader session. It does not independently prove every client observation.

Some of these decisions are taken automatically, without a person looking first: refusing an activation because a license has expired or its seats are full, refusing a machine or account that is on the denylist, and rate limits. They decide whether the software runs for you. They do not profile you, they are not based on anything sensitive, and they follow directly from the contract you entered into. Bans and suspensions of an account are decided by a person, not by the client’s own reports.

If an automated refusal affects you and you think it is wrong, write to privacy@cerise.lol. You are entitled to have a person review it, to put your side, and to contest the outcome.

5. Who we share with

• Discord for connecting your Discord account, for running our Discord servers and bot, and for seeing who is boosting the server.
• Resend for account email, meaning address confirmation, email change approval, and password resets.
• Public block explorers, litecoinspace.org unless we change them, with litecoinblockexplorer.net and blockbook.ltc.zelcore.io as backups, to see what arrived at a deposit address. They are told the address and nothing else. See section 2a.
• Kraken and Coinbase for coin prices in euro. Nothing about you is sent to them.
• The reseller who sold you a key, if you redeem one. They see what section 2b lists and nothing more.
• Hosting, database, and infrastructure providers that run cerise.lol and store data under our instruction.
• Professional advisors or authorities when required by law or to protect our rights and users.

We do not sell personal data. We do not run advertising trackers or analytics scripts, and we do not build profiles for advertisers. Every page loads only our own code.

6. International transfers

The database and the mail sender are hosted in the European Union. Some of the providers in section 5 are established outside the EEA or process data there, so personal data may be transferred outside it.

Where that happens, the transfer relies on the European Commission’s Standard Contractual Clauses in the provider’s data processing terms, or on an adequacy decision for the country concerned, or on the EU-US Data Privacy Framework where the provider is certified under it. You can ask us which applies to a particular provider, and we will tell you.

7. Retention

We keep account and product data while your account exists and as long as needed to provide the Service, resolve disputes, prevent fraud, and meet legal duties. Detailed loader endpoint snapshots, including IP, user agent, and client-reported security context, are scheduled for removal after 30 days by a retention worker that sweeps once a day, and more often than that on a busy instance. A compact authentication or license-audit row may remain for up to 90 days. A compact, current-challenge-verified debugger or integrity signal may remain for up to 180 days. Ban records may remain longer so banned hardware cannot simply re-register around a block.

Compact gameplay session summaries and resource totals are kept while your account exists so the Stats page can show long-term history. They are removed when the account is deleted, except where a limited record must be retained for a legal or security reason.

Two records deliberately outlive the account they came from. The normalised email that claimed a beta slot is kept so the same mailbox cannot claim a second one, and a referral reward row is kept after an invited account is deleted, because the days really were paid out. That reward row stops pointing at the deleted account when it goes.

An order for a payment in crypto, with the refund address and refunds on it, and the payment record it creates, are billing records. We keep them for as long as accounting law requires (section 3a). If the account is deleted, they stay and stop pointing at it. A reseller’s record and its ledger are removed when the account that holds them is deleted. Keys that reseller sold stay with the buyers who redeemed them. The payment itself stays on the public chain whatever we delete, as section 2a explains.

Records of a card charge made before 28 September 2026 may also remain with the processor that took it, under its own retention rules.

8. Your choices and rights

You can update certain profile fields in Settings and end sessions by signing out. You may contact us to request access, correction, or deletion of account data we control, subject to law.

We may refuse or limit deletion or anonymization where we must keep data for security, fraud prevention, license enforcement, legal claims, or accounting. Deleting an account does not automatically create a refund right under the Terms.

If the GDPR applies to you, you have the following rights over your own personal data, and you exercise any of them by writing to privacy@cerise.lol. We answer within one month, and tell you if we need longer.

• Access. A copy of the personal data we hold about you, and an explanation of what it is used for.
• Rectification. Correction of anything inaccurate, and completion of anything incomplete.
• Erasure. Deletion, subject to the limits in this section.
• Restriction. A pause on processing while a dispute about accuracy or legitimate interests is resolved.
• Portability. The data you gave us, in a structured, commonly used, machine-readable form, and sent directly to another controller where that is technically feasible.
• Objection. An objection to processing we base on legitimate interests. We stop unless we can show compelling grounds that override your interests, or we need it for legal claims.
• Withdrawal of consent. For anything we do on consent, at any time, without affecting what was lawful beforehand.
• Human review. Of the automated refusals described in section 4.

Exercising these is free. We may ask you to confirm who you are before we act, so that somebody else cannot obtain or delete your data by asking.

If you think we have handled your data wrongly, please tell us first so we can put it right. You also have the right to complain to a data protection supervisory authority, in the country where you live, where you work, or where the problem happened. Ours is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), naih.hu. Complaining to an authority does not require you to contact us first.

9. Cookies and similar tech

We use cookies and similar storage for authentication, security, and basic site function. Disabling cookies may break sign-in.

Opening a member's referral link sets one cookie holding that member's referral code, for 30 days. It is what tells us who to credit if you go on to buy, and it is read only when you sign up, sign in, or open your referrals page. It is cleared as soon as it has been used, it holds nothing about you, and nothing else reads it.

10. Security

We use HTTPS, hashed passwords, signed license envelopes, access controls on admin tools, and operational practices aimed at protecting data. No system is perfectly secure. Protect your password and devices.

11. Children

Cerise is not directed at children under 16. If you believe a child created an account, contact us and we will remove it where appropriate.

12. Changes

We may update this policy. The "Last updated" date will change when we do. Continued use after a change means you accept the updated policy.

13. Contact

Privacy questions and requests under section 8: privacy@cerise.lol. Legal notices and takedown requests: legal@cerise.lol.

Quick questions: Discord. Also see the Terms of Service.