1. Controller
The controller of personal data on this website is [Owner legal name, address and registration details - to be completed before launch]. This policy is written with the EU General Data Protection Regulation (GDPR) in mind.
2. What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, display name | Create and verify your account, security notices, password reset | Contract |
| Game account name; game password stored only as a one-way hash in the game database | Provide the game account | Contract |
| Website password stored only as a salted scrypt hash | Authenticate you | Contract |
| IP address, used only as a keyed hash for rate limiting and abuse prevention; approximate country from the network edge | Security and fraud prevention | Legitimate interest |
| Vote records, order and payment status, delivery records | Rewards, donations, support, accounting | Contract / legal obligation |
| Messages you send us | Support | Legitimate interest |
| Cookie-less, aggregated page statistics (page, referrer site, campaign tags, device class, a daily-rotating anonymous visitor hash) | Understand how the site is used | Legitimate interest (you can opt out with Do-Not-Track or Global Privacy Control) |
We do not sell personal data, run advertising trackers or send marketing email. Payment card data is handled entirely by the payment provider (Stripe or PayPal); we never see or store it.
3. Who processes data for us
Cloudflare (DNS and web proxy), Google (SMTP service used to send our transactional emails), Stripe and PayPal (payments, only when enabled), Discord (only if you follow a link to our server). Data is hosted on the operator’s own server.
4. Retention
Account data is kept while the account exists. Raw analytics events are kept for a limited period (default 90 days). Security and audit logs are kept for up to 12 months. Order records are kept as long as the law requires. [Owner to confirm periods.]
5. Your rights
You may request access, correction, deletion, restriction, portability, or object to processing, and lodge a complaint with your data protection authority. Contact us through the website contact form.
6. Security
Passwords are hashed, sessions are server-side with secure cookies, administration requires roles and two-factor authentication, and databases are not exposed to the Internet.
DRAFT. Prepared for the project owner; it must be completed and reviewed by a qualified legal adviser before launch.