Grimveld Privacy Notice

1. Who controls your data

1. The controller of your personal data is Externet Filip Brankiewicz, ul. Kazimierza Kantaka 10/1, 61-812 Poznań, Poland, NIP (tax ID) 6731904570, "Externet" for short, which runs Grimveld.
2. For anything about your personal data, write to privacy@grimveld.com or to the postal address above.

2. Where we get data from

• From you: website forms, your account, the game, and messages you send us.
• From the game: the server records what your character does.
• From Stripe: after a payment we receive its result, the amount, the payer's country and the payment IDs.
• From other players: a rule-violation report may name your character.

3. The grimveld.com website

1. We don't store visitors' IP addresses in our database.
2. The site runs on Cloudflare's network. Cloudflare processes IP addresses and technical request data (such as your browser) to deliver the site and protect it from attacks and abuse. Logs with request headers, including the IP address, are kept for 3 days; Cloudflare's other logs follow its own rules.
3. Legal basis: our legitimate interest in keeping the site secure (Art. 6(1)(f) GDPR).
4. Section 15 covers cookies.

4. Pre-registration

1. We store:
   • your email address,
   • the character name you reserve,
   • the language of the page you sign up on,
   • a creator's referral code, if you enter one,
   • whether you agreed to emails about the launch,
   • when you signed up and when you confirmed your email,
   • the random code from the confirmation link (as a hash only),
   • the version of this notice in force when you signed up,
   • once you create an account: which account claimed the reservation.
2. Why, and on what legal basis:
   • reserving the name and handling your sign-up, including the email with the confirmation link: providing the service you asked for (Art. 6(1)(b) GDPR);
   • emails about the Grimveld launch: only with your consent (Art. 6(1)(a) GDPR and Polish electronic-communications law). The consent is voluntary and not a condition of the reservation. You can withdraw it at any time; that doesn't affect what we did before;
   • crediting your sign-up to the creator whose code you entered, and settling with them: our legitimate interest (Art. 6(1)(f) GDPR);
   • protecting against abuse, such as mass sign-ups: our legitimate interest.
3. How long: an unconfirmed sign-up is deleted after 7 days and its name released. A confirmed one is kept until 6 December 2026. If you create an account before then, the name moves to your account (section 7). If you withdraw consent to launch emails, we stop sending them and your reservation stays.

5. Updates list and more questions

1. Under the survey you can leave your email address to get news about the server launch, more questions (short surveys and tests before launch), or both. Each topic is a separate consent (Art. 6(1)(a) GDPR and Polish electronic-communications law).
2. We store your email address, the page language, the topics you chose, the day you signed up and the day you confirmed (without the time), the version of this notice, and random codes for the confirmation and unsubscribe links.
3. We never link the sign-up to your survey answers, and we store the date only to the day, so the two can't be matched by time.
4. An unconfirmed sign-up is deleted after 7 days. We send launch news until 6 December 2026 at the latest, and more questions for 12 months from the day you signed up. Each consent then ends, and once no topic is left we delete the address.
5. You can withdraw consent with the unsubscribe link in every email, or by writing to privacy@grimveld.com.

6. The survey

1. The survey is anonymous: we store your answers and the page language, with no email address, account or IP address.
2. If you type something that identifies you into a comment, we process it on the basis of our legitimate interest in learning what players want (Art. 6(1)(f) GDPR).
3. Answers and comments are deleted when the survey ends.

7. Player account

1. Your account stores:
   • your email address, which is also your login,
   • a hash of your password (we never store the password itself),
   • when the account was created, and your Premium days,
   • whether your email is confirmed and whether the login code is on,
   • the versions of this notice and of the terms when you created the account.
2. Signing in on the website records a session: a random identifier in a cookie, with the time it was created and when it expires. We don't record your IP address or browser with it.
3. Email codes work for 10 minutes, new-password links for an hour, and sessions for 14 days. We delete them after that.
4. Legal basis: performing the contract, meaning running your account and the game (Art. 6(1)(b) GDPR).
5. We keep account data while the account exists. We delete it when you ask (section 13), except purchase records (section 9).

8. The game

1. The game server stores:
   • your characters: name, sex, appearance, level, skills, items, position, and login, logout and playing times;
   • your relationships with other players: friends list (VIP), guilds, houses, market offers and history;
   • text you write: the character comment, VIP notes, guild names and messages, house access lists, hireling names;
   • deaths and kills, with character names;
   • the IP address of each character's last login;
   • penalties: account bans and their history, name locks, IP bans;
   • rule-violation and bug reports sent in the game, and a log of game staff commands.
2. We don't store chat or private messages in the database.
3. Your character's name, level, vocation, guild and deaths are visible to other players in the game, and to anyone on the website (highscores, the online list, character pages).
4. Why, and on what legal basis:
   • running the game: performing the contract (Art. 6(1)(b) GDPR);
   • IP addresses, penalties and reports: protecting the game from abuse (cheating, bots, account theft) and moderating it, which is our legitimate interest (Art. 6(1)(f) GDPR).
5. How long:
   • the last-login IP address: up to 30 days after that login (less if the next login overwrites it); we clear it daily, except for a character who is playing at that moment;
   • an IP ban: until it ends;
   • penalty history: while the account exists;
   • in-game reports and the staff command log: at most 12 months after the case closes;
   • other game data: while the account exists.
6. After your account is deleted, your character's name may remain as plain text in other players' records: their deaths and kills, guild war kills and house access lists.

9. Purchases

1. We store the order: the account, the buyer's email address, the item, the price, payment IDs, your statements at checkout and when you made them, the terms version, the language and the status. Also the payment: amount, currency, the payer's country, the payment provider's fee and IDs; the delivery: what reached your account and when; and a log of changes.
2. Payments are handled by Stripe Payments Europe, Ltd. You give your card or BLIK details directly to Stripe. We never see your card number. Stripe processes data as our processor, and as a separate controller for its own legal duties and fraud prevention (stripe.com/privacy).
3. Why, and on what legal basis:
   • selling, delivering and confirming your purchase: performing the contract (Art. 6(1)(b) GDPR);
   • keeping purchase records for tax and accounting: a legal obligation (Art. 6(1)(c) GDPR);
   • handling complaints, refunds, payment disputes, and the change log: our legitimate interest (Art. 6(1)(f) GDPR).
4. How long: until 31 December of the sixth year after the year of purchase, the period for keeping tax records under Polish law (Tax Ordinance, Art. 70 § 1 and Art. 86 § 1). If you delete your account, these records stay until that date, but are no longer linked to a game account.

10. Support, reports and Discord

1. Emails to support@grimveld.com and privacy@grimveld.com arrive in a Gmail (Google) mailbox. We keep them until the matter is closed and for 12 months after. Complaints and withdrawal statements are kept as long as the purchase records (section 9).
2. Bug reports and support notes are kept in the Linear tool. They may contain a character name, never an email or IP address.
3. Discord is a separate controller on its own platform. As administrators of the Grimveld server we see messages and tickets there. Closed tickets are deleted after 12 months. Our bot reads your user ID and username only when you click one of its buttons, and stores nothing.
4. Legal basis: answering your request under our contract (Art. 6(1)(b) GDPR), legal obligations for complaints and GDPR requests (Art. 6(1)(c)), and our legitimate interest in moderation (Art. 6(1)(f)).

11. Security, logs and backups

1. Game server logs (administrator logins, the firewall, blocked break-in attempts) may contain IP addresses. We keep them for 30 days. Some server application logs are overwritten when they reach a size limit.
2. Backups of the game database, and of the sign-ups and purchases in the website database, are encrypted and stored in Cloudflare R2 in the EU: hourly copies for 2 days, daily copies for 14 days. Deleted data may therefore stay in backups for up to 14 more days, and an IP address for up to 44 days after its login.
3. Once a week we restore a backup on a temporary GitHub server to check that it works. The server is discarded after the test.
4. Legal basis: security and keeping the service running, which is our legitimate interest (Art. 6(1)(f) GDPR).

12. Who receives your data

These service providers process data for us:

Discord, Inc. (USA) is a separate controller on its own platform. We may also disclose data to authorities where the law requires it. The creator whose code you enter never gets your data, only the number of sign-ups and purchases with their code. We don't sell data or share it with advertisers.

If data leaves the European Economic Area, it is protected by the European Commission's standard contractual clauses or by the recipient's certification under the EU-U.S. Data Privacy Framework.

13. Your rights

1. You have the right to:
   • access your data and get a copy of it,
   • have it corrected,
   • have it erased,
   • restrict its processing,
   • data portability,
   • object to processing based on our legitimate interest,
   • withdraw your consent at any time, which doesn't affect what we did before.
2. Write to privacy@grimveld.com from your account's or sign-up's email address. If you write from another address, we ask you to confirm from that one. We answer within one month.
3. We can't delete purchase records before the end of the period in section 9, because tax law requires them.
4. You can complain to the Polish data protection authority, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

14. Do you have to give us data, and how old must you be

1. Giving data is voluntary, but without an email address you can't reserve a name, create an account or get updates, and without payment details you can't buy anything in the shop. We must keep purchase records by law.
2. Pre-registration, the updates list and accounts are for people aged 16 or over.

15. Cookies and browser storage

The site uses no analytics or advertising cookies. It uses only those needed for features you ask for:

Stripe's payment page (checkout.stripe.com) uses its own cookies under Stripe's rules.

16. The launcher and game client

The launcher downloads game files from cdn.grimveld.com and cdn.grimveld.pl (Cloudflare), which sees your IP address while it does. The launcher and the client send us no information about your computer. The client connects to the game server, which records the login IP address (section 8).

17. Automated decisions

1. We make no decisions about you based solely on automated processing that have legal effects on you or affect you similarly significantly.
2. The server may automatically flag suspicious behaviour in the game, such as botting, but a person decides every penalty.
3. Stripe may automatically decline a payment it considers suspicious. Stripe's privacy policy explains how.

18. Changes to this notice

If we change this notice, we publish the new version here with a new date. When you sign up or create an account, we record which version was in force.