Prospira Tweaks
01Who is responsible for your data
Two people in Poznań, Poland, reachable at one address.
Ask us who we are and we will tell you. Prospira Tweaks is not a registered company, so there is no company name, registered address or tax number to print here - and we would rather leave that visibly empty than fill it with something that is not true. Write to contact@prospiratweaks.com before you buy and you will be told who is behind this, by a person, in writing.
Prospira Tweaks is run by two people who decide together what happens to your data, which under the GDPR makes them joint controllers. The address below reaches both, and every right in section 07 can be exercised against either of them.
Write to contact@prospiratweaks.com about anything on this page and a person reads it. There is no data protection officer, because the operation is not large enough to need one under the GDPR - the same address is the right one for every request in section 07.
02What we hold, and why
No name on your account, and an email address only if you bought a session or joined the waitlist.
You sign in with Discord, so what we receive is a Discord id, a username and an avatar. Discord does not give us your email address, and nothing on this website asks for your name or your home address. The rest is worth saying just as plainly: we hold the country you gave when booking, the address you gave Stripe if you paid for a session, your email if you joined the waitlist, and your network address in several places. And if you use the Prospira ToolBox, section 09 applies instead - it receives your Windows username, which for most people is a first name.
| What it is | What for | What that means | How long |
|---|---|---|---|
Your Discord account | Account | Who you are, as far as we know it - Discord never gives us your email or your real name. | While your account exists |
Your payment reference | Account | Links your account to Stripe so a purchase can be found again. | While your account exists |
The PC details you typed | Booking | What you entered when booking: processor, graphics, memory, monitor, peripherals, the games you play, and the country you are in - the last one so we can offer you the session in your own time zone. | While your account exists |
The email you paid with | Booking | The address you gave Stripe at checkout, copied back to us so we can confirm your booking, remind you to back up before we erase the drive, and write once after the session. That last one is blind-copied to Trustpilot, which is how the review invitation reaches you - section 04 lists them. | While your account exists |
Your booking and what you paid | Billing | The package, the amount, the currency, the Stripe references, when it was paid and when it is scheduled. | 5 years (tax law) |
Sign-in records | Security | The address and browser you signed in from, so a stolen account can be spotted. | 90 days |
Your licensed PC | Licence | A one-way fingerprint of the machine your licence is tied to, free tier included. We cannot read hardware serial numbers out of it. | While your account exists |
Crashes you reported | Support | What you sent us from the app: the message, the technical trace and where it happened. | Until the bug is fixed and shipped |
Our own admin actions | Records | What we did as administrators and to whose account - sometimes including a short excerpt of what you wrote. | 90 days |
Waitlist sign-up | Waitlist | Your email, only if you asked to be told when the app launches, plus the exact wording you agreed to and the address and browser you agreed from. | Until you ask us to delete it |
Web server request log | Server | Every request to this website: address, browser and the page asked for. Written before any code of ours runs, so it happens whatever you answer in the storage panel. | 14 days |
This table is the server side, which you cannot inspect from where you are sitting. What you can do is ask us for a copy of all of it under section 07, and we answer within a month. The browser half is different: section 05 names every key, and you can check those against your own browser in about ten seconds. The last row is not something we chose to keep - it is the web server's own request log, and it is here because a list that skipped the largest store of all would not be worth reading.
03Why we are allowed to hold it
Mostly because you asked us to do something that needs it.
Your account, your bookings and your licence are held to perform the contract you entered into - without them there is nothing to deliver. Billing records are kept because the law requires it of anyone selling. Login addresses and crash reports are held on our legitimate interest in a service that is not trivially abused and that we can fix, and so is passing your address to Trustpilot after a session so it can ask you for a review - you can object to that one, and section 07 says how. The waitlist and analytics run on your consent, and consent is the one basis you can take back at any moment, which section 05 shows you how to do.
04Who else sees it
Ten companies, none of them buying anything from us.
We do not sell your data and we do not share it for advertising. These are the only organisations that touch it, and each only gets what its job needs.
| Company | Where | What it does |
|---|---|---|
Discord | Ireland / USA | Signs you in, and is where a support ticket physically lives. Our own alerts also send it the address and browser of every login. |
Stripe | Ireland / USA | Takes the payment. They hold the card details; we never do. |
Resend | USA | Sends our email: the waitlist confirmation and the two messages around a booked session. |
Trustpilot | Denmark | Gets a blind copy of the one email we send after a session, and uses the address on it to invite you to leave a review. Nothing else reaches them, and you are never obliged to answer. |
OVHcloud | Poland | Runs this website and its database. |
Cloudflare | EU / USA | Answers the DNS lookups that point our addresses at our server. It is not in the path of your traffic and does not see it. |
TeamViewer | Germany | Carries the remote session itself. Nothing about it is recorded by us. |
Google Analytics | Ireland / USA | Counts which pages are opened, how far they are scrolled and which outbound links are clicked - and only if you allowed it. Advertising features are switched off. |
Microsoft Clarity | USA | Records the visit as a replayable session: pointer movement, scrolling and clicks - and only if you allowed it. Its advertising side is switched off in two places, so it writes no cookie that would recognise you on another website. |
Where a company is in the United States, the transfer relies on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.
One row needs its own sentence. Discord receives more than the ticket: an internal alert sends it the address and browser of every sign-in, and once sent we no longer control how long Discord keeps it - so the 90 days in section 06 covers our copy, not that one.
Until 19 August 2026 this list also carried three address-lookup services, which turned a visitor address into an approximate city for a map only we looked at. That is gone: the map now uses the country our own network provider already reports, so nothing is sent anywhere to place a dot.
05Cookies and what sits in your browser
One cookie keeps you signed in. Everything else is your own settings, and analytics only if you said yes.
One cookie: prospira_session, which keeps you signed in for 30 days. If you allow analytics, Google sets _ga and _ga_145ZTLN2CR, two years each, and Microsoft Clarity sets _clck for a year and _clsk for a day. Everything else this site stores is your own settings and never leaves your browser: your language, your cart, the PC details you typed, an unsent message, and your answer to this question.
The panel that appears on your first visit says the same in the same words, and lists what each one is for. You can reopen it here and change your answer - that is the whole mechanism, and it works from any page through What we store in the footer.
Nothing in that list follows you to another website, and that is a checked claim rather than a promise. Clarity is capable of writing five further cookies on Microsoft domains, two of which exist to recognise a browser across other sites and to serve advertising. We switch that side off in the code, and the site refuses to load those domains at all, so neither can happen even by accident. Opening this site on 29 August 2026 with analytics allowed produced the four cookies named above and nothing else.
There is no advertising network here, no tracking pixel and no third-party script beyond the ones named in section 04. If you decline analytics, neither Google Analytics nor Clarity is loaded at all, and withdrawing consent afterwards deletes what Clarity had stored.
06How long we keep it
Four rules: a timer (14, 30 or 90 days), 5 years for billing records, a trigger, or until somebody deletes it - and the table in section 02 says which one each thing falls under.
On a timer, by a job. Sign-in records after 90 days. The web server log after 14 days. On the ToolBox system: the record of an activation and our own admin audit trail after 90 days each. Those are mechanisms rather than intentions - you can hold us to them.
On a trigger. Crash reports go once the bug is fixed and shipped. Your account, your licensed device and the PC details you typed go when the account does. Your waitlist entry goes when you ask. We would rather name the trigger than print a number nothing enforces.
Kept because we must. Billing records - what you bought, what you paid and the Stripe references. Polish tax law requires records of a sale to be retained for five years, and that obligation does not end when you ask us to go away, so an invoice outlives the account it belonged to. It is held for that and nothing else.
Until somebody deletes it. On the ToolBox system: the diagnostic logs and files you send us, remote-support session records, and support tickets. Nothing expires those automatically today.
Ask us to delete your account and everything except the billing record goes with it. Two copies stay beyond our reach whatever we do: the one Stripe keeps, and any sign-in alert already delivered to our Discord.
07What you can ask us to do
See it, correct it, delete it, take it with you, or tell us to stop - by email, free, within a month.
You have the right to access what we hold, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on consent, you can withdraw it at any time without that affecting anything done before.
Write to contact@prospiratweaks.com. We answer within one month. There is no charge and no form to fill in - the only thing we may ask is that you prove the account is yours, by sending from the address on file or by messaging from the Discord account itself.
If you think we have handled your data badly, you can complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), uodo.gov.pl, or to the authority in the EU country you live in.
08Where it is stored
On our own server inside the EU, in Poland.
This website and its database run on a server rented from OVHcloud in Poland. OVH is a French company, which is why you will sometimes see it described as French hosting; the hardware your data sits on is Polish. The separate system behind the Prospira ToolBox runs on that same server.
That is our own server, and we move nothing off it. Several of the companies in section 04 do hold data outside the EU on their own systems - Discord stores your ticket, Stripe stores your payment, Resend sends your mail, Google Analytics counts your visit if you allowed it. Each is named there with the safeguard the transfer relies on. What we can say plainly is what is ours: it stays here.
Deleting your data from our side does not reach those copies. Section 06 says which ones and why.
09The Prospira ToolBox
A second system, a second database, and different data about the same people.
Everything above describes this website. The Prospira ToolBox is a separate system with its own database, and it knows you by different things: not a Discord id, but your machine.
When you use the ToolBox we receive your Windows username and computer name, a description of your hardware - processor, motherboard, graphics, memory, BIOS - and a fingerprint derived from it that ties your licence to that one PC. Diagnostic logs you send us carry the same details. If you ask for remote support we record that the session happened, the address it came from, and the output of any script we ran on your machine. Support tickets opened from inside the app include what you wrote plus your licence and hardware identifiers.
The two systems keep separate records and neither queries the other. The one thing that appears in both is the fingerprint of your licensed PC, which is what ties a licence to an account - so the datasets can be matched on that if we ever need to, and you should know it rather than be told they are unconnected. The same two people are responsible for both, and every right in section 07 covers both equally.
It is held on the same server in Poland as everything else. It is reachable only through accounts we control.
Retention there follows section 06: activation records and the admin audit trail go on a timer. The rest - logs you send us, files, remote support sessions and tickets - stays until somebody deletes it, and we would rather write that than publish a schedule nothing enforces.
10People under 13
This is not for under-13s, and we do not knowingly hold their data.
Signing in requires a Discord account, and Discord sets its own minimum age. If you believe a child under 13 has an account here, write to contact@prospiratweaks.com and we will delete it and everything attached to it.
11Changes to this policy
The date at the top changes whenever this page does.
If we ever start collecting something genuinely new, or send data somewhere new, we will say so here before it happens rather than after - and the storage panel in the corner will ask you again if the change is one that needs your consent.