Privacy Policy

Last updated: June 2026

This policy explains how Carbon Stealth VCC (“data controller”) processes your data in АСО, in accordance with the General Data Protection Regulation (GDPR).

1. What data we collect

• Account: email, player name, hashed password (argon2id).
• External sign-in: when signing in with Google/Facebook — identifier and email from the provider.
• Game and economy: rating, levels, virtual chips and gems, inventory, match history.
• Payments: processed by Stripe; we keep only a record of the purchase (no card numbers).
• Technical: IP address and logs for security and abuse prevention.

2. Why we process it (legal bases)

• Performance of a contract: providing the account, the games and the purchases.
• Legitimate interest: security, fair play, fraud prevention.
• Consent: optional cookies/notifications, where applicable.
• Legal obligation: accounting records for purchases.

3. Sharing

We share data only with processors and recipients necessary for the service. We do not sell personal data. Recipients:

• Stripe — payment processing.
• Email provider — registration confirmation and password recovery.
• Hosting infrastructure — providing the service.
• Discord Inc. — on registration we send the player name to an internal event channel (operational log). Discord is established in the USA; the transfer relies on the EU–US Data Privacy Framework (DPF) and/or standard contractual clauses (SCC).
• Sentry — technical error data (diagnostics and service stability).

4. Transfers outside the EU

Where a recipient is outside the EU/EEA (e.g. Discord, and in certain configurations an error-tracking or hosting provider), the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework) or standard contractual clauses adopted by the European Commission.

5. Retention

We keep account data while the account is active. Upon deletion we anonymize personal data; purchase records may be retained in anonymized form for accounting purposes for the statutory period.

6. Your rights

You have the right to access, rectification, erasure, restriction of processing (Art. 18 GDPR), portability and objection. Where we process on the basis of consent, you may withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal. Directly from the app you can:

• download your data (Profile → Privacy → Download my data);
• delete your account (Profile → Privacy → Delete account).

You can also lodge a complaint with the Commission for Personal Data Protection (CPDP).

7. Security

Passwords are hashed with argon2id; sessions use httpOnly cookies. We apply technical and organizational measures to protect data.

8. Contact

Privacy enquiries: privacy@carbonstealth.eu.

See also Terms and Cookies.