When you sign in with Discord, we receive your Discord user ID and username. We store these with an internal account ID and authentication tokens to create your account and keep you signed in. We do not receive your Discord password.

We store your uploaded liveries, showcase images, names, descriptions, vehicle choices, visibility settings, likes, selected liveries, and account status to provide the sharing service.

For planned BeamMP account features, we may receive and store your BeamMP username, user ID, and, if provided by the feature, profile picture to link your account and display your profile. This describes planned processing, not a claim that these features are already available.

We process reports and privacy emails to handle moderation, support, and data protection requests.

Our servers receive connection data, including your IP address, to deliver the website. The application logs request URLs, response statuses, and timings. URLs can contain account identifiers or query parameters.

Account and sharing features rely on Article 6(1)(b) GDPR (providing the service you request). Security, moderation, and handling general enquiries rely on Article 6(1)(f) GDPR: our legitimate interests in keeping BeamPaint working and preventing misuse. Handling statutory data protection requests relies on Article 6(1)(c) GDPR.

You can browse without an account. Signing in and sharing liveries require the relevant account and upload data. We do not use automated decision-making or profiling with legal or similarly significant effects.

We use essential login cookies: auth keeps you signed in for up to 52 weeks, and pkce supports the Discord sign-in flow as a session cookie. Successful sign-in clears the PKCE cookie; logout clears the authentication cookie. Clearing a cookie does not itself delete your account or stored server-side session records.

We run standard, cookieless Plausible Analytics on the same Hetzner server as BeamPaint, in Germany. It processes request information, including IP address and browser information, to produce aggregate visitor statistics without storing raw IP addresses or linking visits to BeamPaint accounts. We use these statistics to understand website usage, relying on our legitimate interest under Article 6(1)(f) GDPR. Aggregate statistics have no fixed deletion period and are not linked to account deletion.

The website and analytics are hosted by Hetzner in Germany. Authorized BeamPaint operators can access data as needed to run and moderate the service.

Your username and listed uploads are public. Public APIs also expose selected liveries, account status such as premium or administrator status, and mappings between external user IDs and BeamPaint account IDs. Unlisted uploads are accessible to people with their links; they are not private storage, and their IDs may appear in public selections.

Discord handles sign-in. We also send upload and edit notifications, including descriptions, uploader information, and image links, to configured Discord channels, including for unlisted uploads. Reports sent to Discord include the reporter's username and Discord ID, the report text, and the reported livery's details. Discord and people with access to those channels receive this information.

We load Google Fonts from Google, so your browser sends Google your IP address and request/browser information. Discord and Google may process data outside the European Economic Area, including in the United States. The applicable transfer safeguards must be confirmed before this draft is published. See the Discord privacy policy and Google privacy policy for their processing.

We keep account data and uploads until you request deletion, unless a legal obligation or the establishment, exercise, or defence of legal claims requires retaining particular records. Deletion requests are handled manually by email. You can also delete individual uploads through the website. For a personal-data deletion request, we delete the Discord channel containing the relevant notifications or reports. Copies already downloaded by other people are outside our control.

To complete before publication: specify the retention periods or deletion criteria for server logs and backups, including when deleted account data disappears from backups.

Subject to the GDPR's conditions, you can request access to your personal data, correction, deletion, restriction of processing, and data portability. You can object to processing based on legitimate interests on grounds relating to your situation. Where processing is based on consent, you can withdraw it for the future without affecting earlier lawful processing.

Send requests to privacy@kortlepel.com. We may need information to verify that the account belongs to you. We normally respond within one month; if the GDPR permits an extension, we will explain it within that month. You may also complain to a data protection supervisory authority, particularly where you live, work, or believe an infringement occurred.

The controller for BeamPaint is Lion Kortlepel, Germany. For privacy questions or requests, email privacy@kortlepel.com.