Privacy Policy

1. Controller (Verantwortlicher)

Controller under Art. 4(7) GDPR:

• Entity/name: Arcane
• Email: realraced@gmail.com

Data Protection Officer: Not appointed.

2. Data Categories

• Discord account data: user ID, username, avatar, email address, the list of servers you are in (to check membership), and your server membership. We use Discord's "join servers" permission to add you to the Arcane server when you sign in.
• Game account data you give us to run a bot: login email, password (encrypted at rest with AES-256-GCM), game session tokens (encrypted), device identifiers used to sign in, and your governor's ID, name, avatar, alliance, power and kill points. If you sign in with an email code, no password is stored.
• Bot configuration, status and activity data (instances, settings, licenses, gem and resource statistics).
• Payment data: amount, product, method, status, timestamps, discount or referral codes, the account the payment was sent to, any payment screenshots and messages you send as proof, and for crypto payments your sending wallet address and transaction hash.
• Support tickets and messages.
• Technical logs and security events.
• A session cookie that keeps you signed in. We do not use analytics or advertising cookies.

3. Purposes and Legal Bases (Art. 6 GDPR)

• Contract performance and pre-contractual steps (Art. 6(1)(b) GDPR).
• Legal obligations (Art. 6(1)(c) GDPR), including accounting/tax duties.
• Legitimate interests (Art. 6(1)(f) GDPR), such as security, fraud prevention, platform integrity, diagnostics, and service improvement.
• Consent where required (Art. 6(1)(a) GDPR), with withdrawal possible at any time.

4. Recipients and Processors

• Lilith Games, the game operator: your game credentials are used to sign in to your game account on your behalf.
• Discord: sign-in, bot messages and support.
• Hosting: DigitalOcean (web server in Frankfurt, Germany, and database), Contabo and Hostinger (bot servers in the EU).
• 2captcha: solves captchas that appear during game sign-in.
• Payment receivers: PayPal payments go to individual payment processors who work with Arcane. They see the payment and can confirm it. Crypto payments are recorded on a public blockchain.
• Resellers: if you bought through a reseller server, that reseller can see and manage your orders and bots.
• Authorities, only where legally required.

5. International Transfers

Some recipients are outside the EU/EEA, including Discord and PayPal (USA), Lilith Games (China) and resellers in Vietnam. Where no adequacy decision applies, we rely on Standard Contractual Clauses or, where these are not available, on the transfer being necessary to provide the service you ordered (Art. 49(1)(b) GDPR).

6. Storage Periods

• Game session tokens are deleted 7 days after a bot is suspended, and passwords 14 days after (about 15 days after a license ends).
• Unfinished sign-in attempts are deleted after 7 days.
• Payment screenshots and the messages sent with them are deleted 15 days after upload, or once the order is settled if that takes longer.
• Technical logs and support tickets are deleted after 15 days.
• Payment records are kept for the statutory period of up to 10 years (§ 147 AO, § 257 HGB).
• Other account data is kept while you use Arcane and deleted on request unless the law requires us to keep it.

7. Public Information

Leaderboards show your Discord name and gem totals. You can hide your name with /privacy hidden: True in Discord or with the switch on the leaderboard page.

8. Your GDPR Rights

Subject to legal requirements, you have rights under Art. 15-22 GDPR, including:

• Access (Art. 15), rectification (Art. 16), erasure (Art. 17), and restriction (Art. 18).
• Data portability (Art. 20).
• Objection rights under Art. 21, including objection to processing based on legitimate interests.
• Withdrawal of consent (Art. 7(3)) with effect for future processing.

9. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), especially in your habitual residence/workplace or at the controller's seat.

10. Obligation to Provide Data

Some data is required to provide Arcane services. Without required data, contract performance may be impossible or limited.

11. Automated Decision-Making

Arcane does not carry out automated decision-making producing legal or similarly significant effects within the meaning of Art. 22 GDPR, unless explicitly stated otherwise.

12. Changes to This Policy

Arcane may update this Privacy Policy. Changes are effective on publication with an updated date.