1. Data controller
The data controller for the processing described in this policy is Haxverse, operated by Ares, through the website https://api.haxverse.it.
For privacy-related requests, contact us via our Discord HUB.
2. Scope
This policy applies to:
- Visitors and registered users of the Haxverse website
- Players linked through Discord and/or HaxBall nicknames
- Users of H.U.C., inventory, marketplace, competitions, and related features
For information about cookies and similar technologies, see our Cookie Policy.
3. Personal data we collect
Depending on how you use the service, we may process:
- Account and identity data: Discord ID, username, display name, avatar, and linked HaxBall nicknames
- Gameplay and profile data: statistics, rankings, roles, inventory, cards, teams, quests, rewards, and competition participation
- Technical data: browser type, device information, approximate connection data, and server logs used for security and troubleshooting
- Authentication data: session tokens stored in cookies when you log in
- Communications: messages or requests you send through supported channels (e.g. in-game mail or support via Discord)
We do not intentionally collect special categories of personal data (e.g. health, political opinions). Please do not share such information through the service.
4. How we collect data
- Directly from you when you register, log in, update your profile, or use site features
- Automatically when you access the website or interact with integrated game rooms
- Through Discord OAuth when you choose to authenticate with Discord
- From optional analytics tools, only if you accept analytics cookies
5. Purposes and legal bases
We process personal data for the following purposes:
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the service, account management, and gameplay features | Art. 6(1)(b) — performance of a contract / steps prior to contract |
| Security, fraud prevention, abuse detection, and system integrity | Art. 6(1)(f) — legitimate interests |
| Service communications and support | Art. 6(1)(b) and/or Art. 6(1)(f) |
| Website analytics and usage measurement | Art. 6(1)(a) — consent (analytics cookies only load after acceptance) |
| Compliance with legal obligations | Art. 6(1)(c) — legal obligation |
6. Data sharing and processors
We do not sell your personal data. We may share data only when necessary:
- With infrastructure and hosting providers that help us operate the website and APIs
- With Discord, when you use Discord login or linked Discord features
- With Google (Google Analytics), only if you accept analytics cookies
- With authorities or third parties when required by law or to protect rights, safety, and security
Where processors are used, we require appropriate safeguards consistent with applicable data protection law.
7. International transfers
Some providers may process data outside the European Economic Area (EEA). Where this occurs, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms, where applicable.
8. Data retention
We keep personal data only for as long as necessary for the purposes described in this policy, including:
- For the lifetime of your account and linked gameplay profile
- For a limited period after account inactivity, where needed for security, dispute resolution, or legal compliance
- For analytics data, according to the retention settings of the analytics provider and your cookie choice
When data is no longer required, we delete or anonymise it where reasonably possible.
9. Your rights
If you are in the EEA, UK, or another jurisdiction with similar protections, you may have the right to:
- Access your personal data
- Request rectification of inaccurate data
- Request erasure in certain circumstances
- Restrict or object to certain processing
- Data portability, where applicable
- Withdraw consent at any time (without affecting prior lawful processing)
- Lodge a complaint with your local supervisory authority
In Italy, you may contact the Garante per la protezione dei dati personali.
To exercise your rights, contact us through our Discord HUB. We may need to verify your identity before responding.
10. Security
We implement appropriate technical and organisational measures to protect personal data, including access controls, secure authentication, and limiting exposure of sensitive information in public APIs. No method of transmission or storage is completely secure; we cannot guarantee absolute security.
11. Children
The service is not directed at children under 16. If you believe a minor has provided personal data without appropriate consent, please contact us and we will take reasonable steps to delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates when it was last revised. Material changes will be communicated through reasonable means, such as a notice on the website.