Privacy Policy
Last updated 2026-09-10.
1. Who is responsible for your data
The data controller is Foto & Graafika OÜ (registry code 12950563), Sõpruse pst 179-60, 13415 Tallinn, Estonia. For anything in this policy, including any request about your data, contact [email protected].
2. When you buy something
You can order without creating an account. If you do, we still hold what the order needs:
- Email address — to confirm the order and contact you about it.
- Delivery name and address — for physical items only.
- Order contents, amount and status, and a payment reference from our provider. We never receive or store your full card number.
- A game or community identifier, only if you give one so that a membership benefit can be applied.
Legal basis: performance of your contract for the order itself, and our legal obligation to keep accounting records afterwards.
3. When you play on our servers
Our game servers record gameplay events — connections, deaths, kills, positions and similar — against your in-game identifier, and some of that is shown publicly on our statistics site, for example on leaderboards and profiles. We also keep server and moderation records, including bans and their reasons.
Legal basis: our legitimate interest in running a fair, moderated community and in showing the statistics the community is built around. You can ask us to restrict what is shown publicly about you.
Different parts of that rest on different bases, stated here rather than folded into one line: public profiles and leaderboards on our legitimate interest in running the statistics the community is built around; moderation records on our legitimate interest in running a fair, safe community; linking a Discord identity on your consent, given when you choose to link it; fraud and chargeback checks on our legitimate interest in preventing abuse of the store; and optional name recognition, such as the Founders Wall, on your consent, given when you opt in.
4. Who else sees it
Only the parties needed to complete what you asked for. We do not sell your data, and we do not use it for advertising.
- Payment providers — to take payment and handle refunds and disputes. They process the transaction only; we are the seller for every product, including memberships.
- Our print and fulfilment supplier — receives your delivery name and address in order to produce and ship physical items, and nothing more than the order needs.
- Discord — only if you choose to link a Discord identity for a membership benefit.
- Authorities — where we are legally required to disclose.
Some of these providers operate outside the European Economic Area — currently our payment processor (Stripe, United States), our print and fulfilment supplier (Printful, United States), and, if you link a Discord identity, Discord (United States). Each transfer relies on the European Commission's standard contractual clauses with that provider. Email us if you would like a copy of, or a reference to, the safeguard used for a specific transfer.
5. How long we keep it
Transaction and accounting records are retained for 7 years from the end of the relevant financial year. Records required under the EU OSS or IOSS VAT schemes are retained for 10 years from the end of the year in which the transaction occurred. Other personal data is deleted or anonymised when no longer needed for fulfilment, support, disputes or legal obligations.
We keep these because the law requires it, not because we want the data. The two periods differ because they come from different rules — general accounting law and the EU VAT schemes — and we state both rather than applying the longer one to everything, since holding personal data longer than necessary is not a safe default.
Gameplay records are kept for as long as the server and season they belong to remain part of our published statistics and season history, and are deleted or anonymised if that season's data is retired. Moderation records, including bans, are kept for as long as the sanction remains in effect and until any appeal or dispute about it is resolved, plus a short period afterwards so a closed decision can still be checked if it is raised again. Support messages are kept until the matter is resolved and for a limited period afterwards in case it needs to be reopened.
6. Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable form. Email [email protected] and we will respond within one month.
Where we rely on your consent — for example linking a Discord identity or opting into name recognition — you can withdraw it at any time, which stops that specific processing going forward without affecting anything already done under it. Data marked required at checkout is needed to fulfil your order; without it we cannot process the order. Everything else is optional.
Two honest limits. We cannot delete an order record we are legally required to retain, though we can restrict its use to that purpose alone. And we will not delete a ban record on request, because doing so would defeat the moderation it exists for — but you can contest it.
If you think we have handled your data wrongly, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee), or to the supervisory authority where you live. We would rather you told us first.
7. Cookies and similar storage
We use cookies and browser storage that the site needs to work — keeping you signed in, remembering your cart, remembering which server you are viewing, and protecting forms against cross-site request forgery. These are strictly necessary and are not used to track you across other websites. We do not run third-party advertising or analytics trackers.
8. Children
The store is not intended for children, and purchases should be made by an adult or with the permission of one. If you believe a child has given us personal data, contact us and we will remove what we are not required to keep.
9. Security
Access to order data is restricted to the people who operate the store, connections to the site are encrypted, and payment card data never reaches our systems. No system is perfectly secure; if a breach occurs, we will notify the supervisory authority, and affected individuals, where required by law and within the timeframes it sets.
10. Changes
If we change this policy in a way that materially affects you, we will say so on the site rather than changing it quietly.