Gaming Multiverse - Privacy Policy

This Privacy Policy explains how Gaming Multiverse (“Gaming Multiverse”, “we”, “our”, “us”) collects, uses, shares, and protects your personal data when you browse our website, interact with our store, and purchase digital scripts or services.

1) Who we are

Legal entity: Gaming Multiverse
Contact (privacy): support@gamingmultiverse.gr

We are not affiliated with Rockstar Games, Take-Two, Cfx.re, Discord, Tebex, Twitch, Kick, or other third parties.

2) Scope

This policy applies to our website, store, and related services. It does not cover third-party websites or services that we do not control (e.g., payment processors, Discord, Cfx.re, Twitch, Kick).

3) Data we collect

Account data: username, email, password hash, profile settings.
Connections: linked accounts/identifiers used for entitlements/licensing and profile features, including your Discord ID, CFX identity, and if you choose to link Twitch, your Twitch user ID, username/login, display name, avatar, and the OAuth access/refresh tokens needed to maintain the connection.
Streamer/livestream data: for our community "Streamers" feature we retrieve public channel information (e.g., display name, avatar, live status, stream title, viewer count) from Twitch and Kick for the channels listed on the site. This concerns the listed creators' public profiles, not site visitors.
Purchase data: order IDs, product details, amounts, currency, timestamps (processed via Tebex; we do not store full payment card data).
Uploaded images: images you upload via the Image Manager, including the image file itself and basic file metadata (e.g., filename, format, size, upload time).
Boards data: content you create or contribute in the Boards feature (board, list, card and tag names and descriptions, checklist items, card comments, @mentions of other members, and images attached to cards) together with related metadata (board ownership and membership, card assignments, creation and edit timestamps, and which cards you have viewed).
Support data: messages, tickets, logs necessary to diagnose issues.
Technical data: IP address, device/browser info, timestamps, pages visited, referral URL, error logs.
Cookies & local storage: session tokens, preferences, cart contents, analytics identifiers.

4) Sources of data

You: when you register, link accounts, make purchases, or contact support.
Automated: via cookies, logs, and analytics.
Third parties: Tebex (payments/entitlements), Discord (account linkage), Cfx.re (account linkage), Twitch (optional account linkage and public livestream data), Kick (public livestream data), analytics providers, hosting.

5) How we use data

Provide, operate, and secure our website and store.
Process purchases and deliver digital entitlements (via Tebex integration).
Link your CFX/Discord identity to licenses and access control.
Link your Twitch account (if you choose) to display it on your profile and recognize it across the community, and to keep that connection working.
Show public livestream information (e.g., live status) for community creators featured on the site.
Store and serve images you upload so you can view, share, and manage them.
Operate the Boards feature: store and display boards you create or are a member of, attribute cards and comments to their authors, assign cards, notify you of @mentions and unread activity, and show which members currently have a board open.
Offer support, diagnose problems, and improve product quality.
Prevent fraud, abuse, and violations of our Terms.
Comply with legal obligations (tax, accounting, regulatory requests).
Send service messages and (if you consent) optional marketing updates.

6) Legal bases (GDPR)

Contract (Art. 6(1)(b)): to provide the store, fulfill orders, deliver entitlements.
Legitimate interests (Art. 6(1)(f)): security, fraud prevention, product improvement, minimal analytics.
Legal obligation (Art. 6(1)(c)): tax/accounting, responding to lawful requests.
Consent (Art. 6(1)(a)): optional marketing, certain cookies/analytics where required.

We may share personal data with:

Tebex (payments/entitlements): acts as an independent controller for payment processing and fraud checks.
Cfx.re (linkage/licensing): to associate purchases to your server identity when required.
Discord (optional linkage): to manage roles, access, or support flows.
Twitch (optional linkage): when you link your Twitch account, we exchange data with Twitch to retrieve your public profile and maintain the connection. We also retrieve public livestream data for featured channels.
Kick (public data): we retrieve public livestream data for featured channels; no account linkage or login is involved.
Hosting & infrastructure (e.g., database, CDN): to operate our Services.
Analytics providers (if used): aggregated usage statistics; configured to minimize data where possible.
Professional advisors (legal/accounting) and authorities where required by law.

We do not sell your personal data.

8) User-uploaded content (images)

The Image Manager lets you upload images. The images you upload, and basic file metadata, are stored on our hosting/infrastructure and served to your browser (and, where applicable, via a CDN).

Public access: uploaded images are served from publicly accessible URLs, so anyone with the link may be able to view an image. Please do not upload private, sensitive, or personal information.
Your control: you can view and permanently delete your uploaded images at any time from the Image Manager. Deletion is immediate and the image cannot be recovered.
Retention: images are retained until you delete them or your account is removed, except where we must remove content earlier (e.g., to comply with the law or our Terms).
Responsibility: you are responsible for the content you upload, as described in our Terms of Service.

9) Boards (collaborative task boards)

Boards is an optional feature that lets signed-in members create shared task boards (lists, cards, checklists, comments, and tags) and invite other members to collaborate.

Board content: the text you and other members write (board, list, card and tag names and descriptions, checklist items, and card comments) and any images you attach to a card are stored on our hosting/infrastructure.
Membership & attribution: we record which users own or are members of a board, who created or is assigned to each card, who authored each comment, and @mentions of other board members.
Activity data: creation and edit timestamps, and which cards you have opened, so we can show unread-comment and mention counts. We also show live presence (which members currently have the board open); presence is derived from active connections and is not retained after you close the board.
Visibility: board content is visible only to that board's members and is not public. Anyone added to a board can see all content on it, so only invite people you trust with that content. Images attached to cards are served from publicly accessible URLs, so anyone with an image link may be able to view it (see “User-uploaded content”).
Your control: you can leave a board, remove cards and comments you have permission to delete, and a board owner can delete an entire board. Deleting a board also deletes its lists, cards, checklists, comments, and tags.
Retention: board content is kept until you or a board owner deletes it, the board is deleted, or your account is removed, except where we must remove content earlier (e.g., to comply with the law or our Terms).

10) Data retention

We retain personal data only as long as needed for the purposes above:

Account & purchases: for the life of your account and thereafter per legal retention (e.g., tax records).
Support/logs: typically short periods necessary to diagnose and resolve issues.
Marketing consent: until you withdraw consent.
Uploaded images: until you delete them or your account is removed (see “User-uploaded content”).
Boards content: until you or a board owner deletes it, the board is deleted, or your account is removed (see “Boards”).
Cookies: per their configured lifetime (see “Cookies”).

11) Your rights (EU/EEA)

You have the right to request:

Access to your personal data.
Rectification of inaccurate data.
Erasure (in certain cases).
Restriction of processing (in certain cases).
Data portability (where applicable).
Objection to processing based on legitimate interests and to direct marketing.
Withdrawal of consent at any time (does not affect prior processing).

To exercise your rights, contact us at dpo@gamingmultiverse.gr.

12) Cookies & local storage

We use strictly necessary cookies (e.g., session, cart) to operate the store, and may use optional analytics cookies with your consent. Local storage may be used for preferences and cart items. You can manage preferences via your browser.

Essential: session, authentication, basket IDs, CSRF.
Preferences: UI/theme settings.

13) Security

We implement administrative, technical, and organizational measures to protect personal data. No system is perfectly secure; please use unique, strong passwords and keep them confidential.

14) Children

Our Services are not directed to children under the age required by applicable law. If you believe we have collected personal data from a child, contact us and we will take appropriate steps to delete it.

15) Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be indicated by updating the “Last updated” date and reasonable notices where appropriate. Your continued use of the Services indicates acceptance of the updated policy.

16) Contact

Email (privacy): dpo@gamingmultiverse.gr
Support: support@gamingmultiverse.gr

17) Controller & complaints

The data controller is Gaming Multiverse. If you have concerns, please contact us first. You also have the right to lodge a complaint with your local authority. In Greece:

Hellenic Data Protection Authority (HDPA)
Kifissias 1-3, 115 23 Athens, Greece (www.dpa.gr)