This notice explains the personal data handled when you visit Zyperax, create an account, play in a universe, contact support or make a purchase. Details marked for confirmation must be completed before this draft becomes the final notice.
Who is responsible
The controller is [CONFIRM: legal operator name and postal address]. Contact [CONFIRM: privacy email] about your data. Further operator information is in our imprint. [CONFIRM: data protection officer or representative details, where required.]
Data needed to provide the game
We process registration and account details, authentication information, universe membership, game progress, actions, inventories and communications you send through game features. We use this information to operate your account, run the game, deliver requested features and respond to support enquiries. Where necessary to provide the service you request, the legal basis is performance of a contract under Article 6(1)(b) GDPR.
Player names, rankings, alliance information and other game information may be visible to other players through the relevant features. Messages are made available to their intended recipients. Do not include sensitive personal information in public game content.
Security and fair play
Technical logs and account activity may be processed to investigate bugs, protect accounts, prevent fraud and enforce game rules. The proposed legal basis is our legitimate interest in a secure and fair service under Article 6(1)(f) GDPR, subject to a documented balancing assessment. We may also process information where necessary to meet a legal obligation under Article 6(1)(c).
[CONFIRM: security-log fields, moderation access controls, retention periods and whether any automated enforcement makes decisions with legal or similarly significant effects. Describe safeguards and review routes where applicable.]
Orders and payments
We process order references, purchased products, amounts, delivery status and payment or refund references to fulfil purchases, provide support, prevent fraud and meet applicable record-keeping duties. Contract performance, legal obligations and proportionate fraud-prevention interests provide the relevant legal bases.
The payment provider shown at checkout processes the payment information you submit through its service. [CONFIRM: providers actually enabled, their legal entities, roles, privacy links, processing locations and required retention periods before accepting live payments.]
Optional analytics and recordings
With your analytics consent, Google Analytics can receive page and feature usage, button and modal interactions, engagement and selected gameplay events, including fleet dispatches, commander actions, rewards and virtual-currency spending by purpose and amount. PostHog is planned for feature funnels and repeat usage but is not currently configured. It must also require analytics consent when enabled.
With your separate session-replay consent, Microsoft Clarity can record masked interactions and heatmaps on the public homepage and guide. The integration excludes game, account, login, payment and private-message pages from replay. Our feature events exclude message contents, passwords, form values, player names, account IDs, coordinates and raw URLs. Provider connections can still disclose technical information such as your IP address and browser details.
Consent under Article 6(1)(a) GDPR is the basis for optional analytics and replay, alongside applicable rules for browser storage. You can refuse them and still play. Use Cookie preferences to change or withdraw consent. Withdrawal stops future optional collection but does not make earlier consent-based processing unlawful or automatically erase data already held by providers.
Cookies and browser storage
Essential storage supports sign-in, security and privacy preferences. The consent cookie lasts 182 days and applies separately to each host. Optional storage includes analytics cookies and, when configured, a random browser identifier. Short-lived gameplay event cookies expire within 60 seconds. See Cookies and analytics for the individual purposes and controls.
Hosting, recipients and international transfers
Zyperax uses Hetzner hosting in Germany. Authorised service providers may process information to deliver hosting, communications, payments or the optional analytics you choose. We may disclose information where legally required or necessary to establish, exercise or defend legal claims.
German hosting does not mean every analytics or payment operation stays in Germany. [CONFIRM: processor legal entities, data-processing agreements, subprocessors, email delivery service, actual provider regions, international destinations and transfer safeguards. Identify any applicable adequacy decision or standard contractual clauses and explain how a copy can be requested.]
How long we keep data
Retention must depend on the purpose: operating your account, resolving a support issue, investigating a security incident or satisfying statutory record-keeping duties. Data no longer needed should be deleted or anonymised, subject to lawful exceptions.
[CONFIRM: actual periods or clear criteria for active and closed accounts, messages, game logs, support records, transaction records and backups; also confirm GA4 and Clarity dashboard retention settings and PostHog retention before activation. Browser-cookie expiry is not the same as server-side retention.]
Your rights
Subject to the relevant conditions, you may request access, correction, erasure, restriction or portability of your personal data. You can object to processing based on legitimate interests and withdraw consent at any time. Contact the privacy address above. We may request proportionate information to verify your identity.
We normally respond within one month. If a lawful extension is needed, we will explain it within that first month. You may complain to a supervisory authority, particularly in the EU country of your habitual residence, workplace or the alleged infringement. [CONFIRM: the operator's competent authority and contact link.]
Updates to this notice
We will update this notice when our practices change and give appropriate notice of material changes. New optional purposes require the appropriate choice before collection begins.