Privacy Policy

Who is responsible

Arena Carry operates this site and decides how the data described below is used. Reach us at privacy@arenacarry.gg.

What we collect

• Account: email address, and a password stored only as a scrypt hash. If you sign in with Google or Discord we receive your email, display name and avatar from them instead.
• Order: Battle.net tag, character name, realm, faction, class, current and target rating, Discord tag, and any note you write.
• Support: the messages you send us in the site chat.
• Payment: Stripe handles the card. We store only the payment reference and its status, never card numbers.
• Technical:a session cookie, your cart in your own browser’s local storage, and the IP address seen by our bot check at checkout.

We do not run advertising trackers or third-party analytics, and we do not sell or rent personal data to anyone.

Why, and on what legal basis

• To deliver your order and support it: performance of a contract.
• To take payment and prevent fraud: contract and our legitimate interest in not being defrauded.
• To keep the site up and block bots: legitimate interest in security.
• To keep accounting records: legal obligation.

Who else sees it

• Stripe: payment processing. Stripe is its own controller for card data.
• Cloudflare: Turnstile bot check at checkout.
• Discord: new-order notifications reach our team through a Discord channel, and optional sign-in.
• Google: optional sign-in only.
• Our booster assigned to your order sees the character details needed to play it.

Some of these process data outside the EEA under the European Commission’s standard contractual clauses.

Cookies

Only what the site needs to work: a signed session cookie so you stay logged in, and a chat identity cookie so a support thread survives a page reload. No advertising or analytics cookies, which is why there is no cookie banner.

How long we keep it

Order and invoice records are kept as long as tax law requires (typically 7–8 years). Support chats are kept for 12 months. Delete your account and everything not covered by that legal obligation goes with it.

Your rights

You can ask for a copy of your data, correct it, delete it, restrict or object to processing, or receive it in a portable format. You can delete your account yourself from your profile page, or email us and we will answer within 30 days. You may also complain to your national data protection authority.

Security

The site is served over TLS. Passwords are scrypt-hashed and never stored in plain text. Sessions are signed cookies. The database is not reachable from the public internet.

Children

The service is for adults. We do not knowingly collect data from anyone under 18.