Privacy policy: audience measurement

1. Who is responsible for this processing

The website https://alama.host and the hosting service “Alama Hosting” (hereafter “Alama”) are published and operated by Maxime Carlier, sole trader, 1 allée de Bruxelles, 54500 Vandœuvre-lès-Nancy, France. He is the controller of the processing described here. Contact for any question about your data: maxime@alama.host.

2. What this text covers, and what it doesn't

It only covers audience measurement on the sites open to the public: the main website (alama.host), the shop (shop.alama.host), the game panel (panel.alama.host), the site of the YAWBDB Discord bot (yawbdb.alama.host) and the webmail (mail.alama.host). The first three share the measurement cookie described in point 8; the YAWBDB site and the webmail set none and are counted without a cookie (point 5.4).

It doesn't cover the management of your account, billing, support tickets, or the data the YAWBDB bot processes for its own operation (Discord IDs, command statistics). Account, billing and support are described in article 13 of the terms and conditions; the YAWBDB bot has its own privacy policy, separate from this one.

3. Why this data is collected

• Understanding the traffic of each site: how many visits, which pages, which technical errors, where visitors come from (only the name of the site that sent them to us, never the full address).
• Following a visitor's path between our own sites (main website, then shop, then panel), to know for example how many people who visit the main website then go on to order, always in aggregate (“12 out of 100”), never by pointing to a person.
• Spotting outages and intrusion attempts (error pages, automated probes).
• Telling people from robots: a visit that presents itself as a robot or that comes from a hosting provider's network is marked “probable robot” and is left out of the traffic figures.
• The game panel's security log: who logged in or acted on a server, for account security. This is a different purpose from audience measurement, described separately (point 7).
• Only if you accept it on the main website: rebuilding, on Alama's tracking screen, your path from one site to another (“a visitor from Lyon: main website, shop, panel”). Without this consent, each visit stays an isolated fact, never linked to another.
• Advertising (Google Ads): on the main website only, and only if you accept it, the Google Ads tag tells Google that one of our ads brought a visit. This is not our “in-house” measurement described above: it is a separate third-party service, subject to the consent banner. Google Analytics is not used.
• Protecting the contact form (Google reCAPTCHA): on the contact page only, and only if you have accepted the banner, reCAPTCHA checks that a message is not sent by a robot. Without this consent, reCAPTCHA does not load, the form cannot be sent, and you can write to us directly at contact@alama.host.

What we don't do: no advertising profile, no resale of data, no matching between a measured visitor and a customer account, no retargeting.

4. On what legal basis

• Basic audience measurement (visits, pages, aggregated path, errors) is exempt from consent within the meaning of the CNIL recommendation on audience measurement cookies: it serves only Alama, produces only statistics, is not cross-referenced with any other processing (billing, customer account, panel security log) and meets the technical conditions set by the CNIL (truncated address, no advertising identifier). Its legal basis is Alama's legitimate interest in understanding the use of its own sites, strictly limited to this purpose.
• Tracking your path (point 3) relies on your consent, collected by the main website's banner under the name “detailed measurement”. Without this consent, or if you arrive without going through the main website, you stay under the exempt regime.
• The panel's security log (point 7) relies on the legitimate interest of Alama and its customers in the security of their accounts and servers, within the framework of the CNIL recommendations on logging.
• Keeping your IP address with your visits (box unchecked by default in the banner, point 6) relies on your consent, given in addition to the one for detailed measurement.
• Google Ads, and reCAPTCHA on the contact page, fall outside the exemption (Google reuses the data for its own purposes) and therefore rely on your consent, collected by the main website's banner before anything loads.

5. What is collected, site by site

5.1 Main website (`alama.host`)

• The page visited, the response code, the browser family and major version, the system (Windows, macOS, Android…), the device type, the browser's preferred language without region, the name of the site that sent you to us (never the full address), an approximate city and the access network (number and name of the operator or hosting provider), both derived from the IP address. To recognise a script that goes through many pages in a few seconds, each page view also keeps a pseudonym of the network it comes from (an address range, never the address), which changes every day.
• The IP address itself is only kept in full in two cases (point 6): a robot, or you if you check the “Keep my IP address with my visits” box in the banner.
• A random measurement identifier (cookie alama_v, point 8), which makes it possible to count the same visitor only once across the three sites and to read the path in aggregate.
• If you accept “detailed measurement” in the banner: your path shows up on Alama's tracking screen (city, site, page, never your e-mail; your IP address only if you also checked the box above).
• Google Ads, if you accept the banner (identifier AW-16577672550).

5.2 Shop (`shop.alama.host`)

• The same technical information as on the main website, plus the steps of the ordering path (configuration, cart, sign-up, payment, order placed), read from the page address, never from the content of a form: the measurement reads neither your order nor your billing details.
• The same measurement identifier alama_v as on the main website and the panel.

5.3 Game panel (`panel.alama.host`)

• The same technical traffic information (pages, errors) as on the other sites.
• Successful logins to the panel, read from the security log (city, time, identifier that changes every day): see point 7. The rest of this log (actions on a server, files, keys) is not audience measurement and doesn't leave the panel.

5.4 Site of the YAWBDB Discord bot (`yawbdb.alama.host`) and webmail (`mail.alama.host`, `webmail.alama.host`)

1. The traffic of these sites is counted like that of the others, from the log of the entry server (page, city, browser, access network), without a cookie: a visitor is represented there by an identifier calculated from the already truncated address and the browser, which changes every day and becomes unreadable two days later.
2. When Alama turns on the sending, it receives four global counters from the bot: the number of Discord servers that added the bot, the number that removed it, the number of accounts created on the YAWBDB site and the number of wiki pages viewed. No Discord ID, no command used, no server data goes to Alama: this data stays in YAWBDB, under its own privacy policy.

5.5 What is not measured

Player connections on the game servers themselves are not measured by Alama. If that changes one day, this text will be updated beforehand.

6. What we don't keep, and the two exceptions

The IP address is used once, to find a city and an access network (GeoLite2 databases kept on our servers, see point 11), then it is thrown away: the record of a visit doesn't carry it. The entry server that receives visits writes a technical log where the address is already truncated before being written to disk (the last byte in IPv4, the last 80 bits in IPv6), and this log is deleted after 90 days. No e-mail is collected by this measurement.

Two exceptions, where the full address is kept with the visit, for the same duration as the rest of the detail (90 days):

• A robot: when the software presents itself as a robot (search engine, script), probes an address that only exists for scanners (/wp-login.php, /.env…) or sends no software name, the address is kept, because a robot is not a person. Alama may then ask the address registries (whois) who owns the network; it never does this for a visitor.
• You, if you ask for it: only if you accepted “detailed measurement” and checked the box, unchecked by default, “Keep my IP address with my visits” in the banner (cookie alama_ip_ok, point 8). Refusing or withdrawing your consent from the “Cookies” link erases the addresses already kept for this browser.

7. The panel's security log, a separate purpose

The game panel keeps its own log of logins and account actions (creating a server, opening a console…). This log serves security, not audience measurement, and is not mixed with it: audience measurement only reads its successful logins (the rest of the log never leaves the panel). The person who logged in only appears there under an identifier that changes every day and becomes permanently unreadable 48 hours later, and the action is reduced to a category without detail (never the name of a file, never an e-mail change).

The full log, with the IP address in clear and the person's real identifier, stays managed by the panel itself, with its own retention period: 180 days, then automatic purge every night.

8. The identifiers stored on your browser (cookies)

alama_v, alama_c and alama_o are set by our own servers, never by a third party, with the attributes Secure, HttpOnly and SameSite=Lax. alama_ip_ok is set by the main website's banner itself, with Secure and SameSite=Lax. Your choice in the banner (accepted or refused) is kept for six months in your browser's local storage (cookieConsent), not in a cookie sent to our servers. The YAWBDB site and the webmail use none of these cookies.

If you withdraw your agreement on the contact page after giving it, the page removes reCAPTCHA, but the code your browser has already loaded stays active until you change page; the cookies Google has already set are deleted from your browser's settings.

9. How long each piece of data is kept

10. Your right to object, and your other rights

Objecting to audience measurement: the “Don't count me” link, at the bottom of every page of the main website and in article 15 of the terms and conditions (address /analytics/opt-out, which also applies to the shop and the panel), immediately stops all measurement concerning you on this browser: the measurement cookie is erased, the detailed measurement cookie and the IP address one too, a refusal cookie is set for 13 months, and nothing from this browser is logged afterwards, not even error pages.

Withdrawing your consent to detailed measurement without objecting to everything: the “Refuse” button of the banner, which the “Cookies” link at the bottom of every page reopens, erases the alama_c cookie; the paths already rebuilt for this browser are undone (each visit becomes an isolated fact again) and the addresses kept with them are erased, without touching the global count. The same refusal cuts off Google Ads: the tag no longer loads from the next page on and its cookies are erased.

Your rights of access, rectification, erasure, restriction and objection (Articles 15 to 21 of the GDPR): most audience measurement data is pseudonymised and doesn't, in practice, make it possible to find a specific person without the cookie of their own browser (Article 11 of the GDPR). In that case, write to us describing the browser or the period concerned, and we'll do our best. Contact: maxime@alama.host, the same address as in the terms and conditions.

Complaint: you can also lodge a complaint with the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr).

11. Who receives this data

• No one outside Alama and its hosting provider, for the “in-house” audience measurement: the service that processes it runs on Alama's servers, hosted by Hetzner Online GmbH (Germany). Never with any other third party.
• MaxMind (GeoLite2): location by city and by access network is done with two databases downloaded and kept on our servers; no address and no visit data is sent to MaxMind. A free MaxMind key is only used to download updates of these databases.
• The address registries (whois): the address of a robot, never that of a visitor, may be sent to them to find out who owns its network.
• Google (Google Ads, and reCAPTCHA on the contact page), only on the main website and only if you accept the banner: see point 12 for the transfer outside the European Union.

12. Transfers outside the European Union

Alama's servers that process the “in-house” audience measurement are located in the European Union (Germany, with Hetzner Online GmbH). No data from this measurement leaves the European Union.

Google (Google Ads, and reCAPTCHA on the contact page), when you accept the banner, transfers data to the United States. This transfer relies on your consent, given in the banner, and it is covered by the EU-US adequacy decision of 10 July 2023 for certified organisations. If you refuse, nothing from Google loads and nothing is sent.

13. Updates to this policy

This policy may change, in particular if our servers change or if a new measurement is turned on. The date of the last update is shown at the top of the page.