Privacy Policy

Last updated: 3 October 2026

Controller and contact

The controller for 5mstart (fivemstart.com) is KOIL CONTENT CREATION PTY LTD, Australian Company Number 634054309, registered in Docklands VIC 3008, Australia. Our operating address is Welfenstraße 1, 76137 Karlsruhe, Germany. Privacy and customer requests can be sent to [email protected]. Further company information is available in our imprint.

Data we process

Depending on how you use 5mstart, we process your email address and account details, order details (framework, package, selected scripts, amount), build and download records, support messages and technical data such as IP address, browser information, request time, security events and diagnostic logs. We do not receive or store full payment-card numbers.

Why we process data

  • Orders, accounts and downloads: to conclude and perform the purchase contract, sign you in via email link, build your server package, provide downloads and rebuilds and answer support requests.
  • Payments and fraud prevention: to initiate and confirm payments, prevent abuse, investigate failed or disputed transactions and protect customers and the shop.
  • Legal records: to keep invoices, transaction records and evidence required by tax, accounting, consumer-protection and legal-claims obligations.
  • Service security and reliability: to protect the site, rate-limit abuse (for example daily download and rebuild limits), diagnose failures and restore service after an incident.
  • Communications: to send sign-in links, order confirmations and "your server is ready" messages. We do not use these contact details for unrelated marketing without a valid legal basis.

The corresponding legal bases are performance of a contract, compliance with legal obligations, our legitimate interests in operating and protecting the service, and consent where the law requires it. Consent can be withdrawn for future processing at any time.

Recipients and services

Personal data is disclosed only where needed for the purposes above. We use the following service providers:

  • Website hosting: OVH SAS, France (the server that delivers this website and builds the server packages).
  • Backend and database: Convex (accounts, orders, builds).
  • Payments: Stripe (payment processing and payment-risk checks).
  • Email: Amazon Web Services (Amazon Simple Email Service) for sign-in links and transactional email.
  • File storage and delivery: Cloudflare (storage of the finished server packages and download delivery).

These providers process data under their own terms and, where applicable, data-processing agreements.

Cookies and local storage

We only use storage that is strictly necessary: your sign-in session and your current configurator selection are kept in your browser's local storage so you don't lose them while signing in. We do not use analytics or advertising cookies.

International transfers

The operator and some service providers are located outside the European Economic Area. Where European data-protection law applies, transfers are based on an applicable adequacy decision, standard contractual clauses or another legally recognised safeguard. You may contact us for information about the safeguard relevant to a particular transfer.

Retention

Order, invoice and payment evidence is retained for the period required by applicable tax, accounting and consumer law. Account and order data is retained while the account or continuing download access is needed, subject to mandatory records. Finished server packages are deleted from storage after 30 days. Support and dispute records are kept while the issue is active and for the period needed to establish, exercise or defend legal claims. Security logs are retained only for their operational security cycle. Data is deleted or anonymised when its purpose and any mandatory retention period end.

Your rights

Where the GDPR or equivalent law applies, you may request access, correction, deletion, restriction, portability or objection, and you may withdraw consent for future processing. You also have the right to complain to a competent data-protection authority. For the German operating location, this includes the Baden-Württemberg data-protection authority. Send a request to [email protected]; we may need to verify your identity before disclosing account or order data.

Automated risk signals

Payment and security providers may use automated signals to detect fraud or abuse. If a legitimate order or account action is blocked, contact support so that the case can be reviewed.

Changes to this policy

We update this notice when the shop, providers or legal requirements materially change. The current version and update date are published on this page.