Privacy Policy
What Titan Logs does with personal data — both yours as a customer, and your players', which you send us.
Version 2026-09-05 · Applies to the Titan Logs service
1. Who we are
Titan Logs is operated by Titan Software z.s., zapsaný spolek (registered association), Ametystová 702/46, 153 00 Praha, Česká republika, IČO 29738725 (“Titan”, “we”).
For questions about this policy or to exercise any right described below, contact [email protected]. We have not appointed a Data Protection Officer; whether one is required is under review.
2. Two different roles — please read this part
Titan Logs processes two very different kinds of personal data, and our legal role is different for each.
a) Your account — we are the controller
Your email address, name, organization membership, sessions and billing status. We decide why and how these are processed, so we are the controller and this policy governs them.
b) Your log data — we are a processor
Everything your FiveM server sends us: player identifiers, chat messages, ban and kick records, and anything else you put in an event. You decide what to send and why, so you are the controller for that data and we process it on your instructions. Our obligations to you for it are set out in the Data Processing Agreement, not here.
This matters because the people in that data — your players — have no relationship with us and cannot be reached by anything we publish. Informing them, and having a lawful basis for logging them, is your responsibility as the controller.
3. Account data we process, and why
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Email address, name, profile picture URL, Titan Auth identifier | Identify you, show you in your organization's member list, attribute actions | Art. 6(1)(b) — performance of our contract with you | Until you delete your account |
| Organization membership and role | Decide what you are allowed to see and do | Art. 6(1)(b) — contract | Until removed or the account is deleted |
| Session records: an opaque token hash, expiry, your IP address and browser user-agent | Keep you signed in; detect and investigate account abuse | Art. 6(1)(b) contract, and Art. 6(1)(f) legitimate interest in securing the service | 30 days maximum; deleted automatically once expired |
| Audit log: who did what, when, and from which IP address | Show your organization who changed permissions, credentials and settings; investigate security incidents; demonstrate our own accountability | Art. 6(1)(f) — legitimate interest in a secure, accountable service; Art. 5(2) accountability | 730 days (24 months) |
| Invitation records: the invited email address, the role offered | Let you invite colleagues | Art. 6(1)(f) — legitimate interest in operating a team product | Deleted 30 days after the invitation is used, revoked or expires |
| Billing status and plan, cached from Titan Auth | Apply your plan's limits and features | Art. 6(1)(b) — contract | Until changed; cleared when the organization is deleted |
| Usage counters (events and bytes per organization per day) | Billing evidence and capacity planning | Art. 6(1)(b) contract, Art. 6(1)(c) legal obligation for accounting records | Retained as billing evidence. Organization-level counters only — no personal data, no per-player breakdown. |
| Server and credential metadata, including the IP address a credential was last used from | Help you see which of your servers is connected; investigate credential misuse | Art. 6(1)(b) contract, Art. 6(1)(f) security | Until the server or credential is deleted |
We do not process special categories of personal data (Art. 9) about you, and we do not make any decision about you by automated means that produces a legal or similarly significant effect (Art. 22). We do not profile you, and we do not use your data or your logs to train machine-learning models.
4. Log data your servers send us
Acting on your instructions, we store and index whatever your FiveM server sends. The fields our API accepts for player identification are a fixed allowlist — anything else is discarded before storage:
license · license2 · discord · steam · xbox · live · fivem · ip
An event may also carry a message (which, if you log chat, contains what a player typed), a player display name for the actor and the target, and free-form metadata you control.
Player IP addresses are optional. The Titan Logs FiveM resource attaches them by default, but an owner or admin can turn that off in Settings → Privacy, and we will then discard the ip field at ingest, before it is written anywhere.
Log data is retained for the period your plan provides (3, 7, 30 or 90 days), or a shorter period if you configure one, and is then deleted automatically. See retention for the honest detail about backups.
5. Who else sees this data
We do not sell personal data, and there is no advertising, analytics or tracking product in Titan Logs. Data is disclosed only to the infrastructure providers we use to run the service, each under a written processing agreement. The current list, with what each one receives, is published at /legal/subprocessors.
Within your organization, your log data is visible to members whose role includes log access. That is your decision to make.
Titan staff can see aggregate, cross-organization counters (how many organizations, servers and events exist). They cannot browse your logs from that view, and there is no “sign in as customer” capability in the product. Every access to that internal view is recorded in an audit trail.
6. International transfers
We aim to keep all processing within the European Economic Area. Where a provider listed in our subprocessor page operates outside the EEA, the transfer safeguard relied on is stated there. Contact us if you need a copy of the relevant safeguards.
7. How long we keep things
| What | How long | Enforced by |
|---|---|---|
| Log events | Your plan's retention period (3–90 days), or shorter if you set one | Automatic sweep, every minute |
| Expired sessions | Deleted as soon as they expire (30 days maximum) | Automatic sweep |
| Audit log | 730 days | Automatic sweep |
| Used, revoked or expired invitations | 30 days | Automatic sweep |
| Application (server) logs | 90 days | Operator configuration on the log store |
| Encrypted database backups | 30 days | Backup schedule |
| Usage counters | Retained as billing evidence. Organization-level counters only — no personal data, no per-player breakdown. | Not deleted |
About backups. Deleting something from the live service does not reach into backups taken before the deletion. Those backups are encrypted, access-controlled, and rotate out after 30 days, at which point the data is gone from them too. We would rather state this than imply deletion is instantaneous everywhere.
8. Your rights
Under the GDPR you can ask us to:
- Give you a copy of the personal data we hold about you (Art. 15), in a portable format (Art. 20).
- Correct anything inaccurate (Art. 16). Your name and email come from your Titan Software account — changing them there updates them here on your next sign-in.
- Delete your account (Art. 17). You can do this yourself in Settings → Your account. Your email, name and picture are erased, your sessions and memberships are removed, and the audit trail keeps only a non-identifying reference so the record of what happened in your organizations survives.
- Restrict or object to processing based on our legitimate interests (Arts. 18 and 21) — in practice, the audit log and security logging.
Email [email protected]. We will respond within one month.
If you are a player, not a customer: we hold your data only on behalf of the server operator who logged it. Please contact that operator. If you cannot identify them, write to us and we will help route the request, but we cannot decide it ourselves.
You may also complain to the Czech supervisory authority, Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, Česká republika — https://www.uoou.gov.cz.
10. Security
Data is encrypted in transit. Ingest credentials and session tokens are stored only as hashes and can never be read back. Stored identity-provider tokens are encrypted at rest. Access between organizations is separated at the database-query level and covered by automated tests. We keep encrypted, off-host backups and test that they restore.
To report a vulnerability, please use our responsible-disclosure process.
11. Children
Titan Logs is a tool for server operators and is not directed at children. You must be at least 16 to hold an account.
We recognise that the players your logs describe may well include children. If you log chat content or player identifiers from a community with young players, that is processing of children's data and you are the controller for it — please consider carefully what you need to log, and use the player-IP setting described above.
12. Changes
Each document carries a version. When we make a change that affects you materially, we will ask you to review and accept the updated terms the next time you sign in, and your acceptance is recorded with the version and timestamp.