KITSU1. Data controller
The data controller is [À COMPLÉTER : publisher’s full name or company name], [À COMPLÉTER : postal address]. Contact for any question about your data: [À COMPLÉTER : contact e-mail]. We have not appointed a data protection officer.
2. The data we process
Your Discord account
You log in with Discord, authorising only the reading of your profile (“identify” scope). We receive and keep: your Discord ID, your display name, your avatar (its address on Discord’s servers), the creation date of your Discord account (derived from the ID) and whether or not you display the KITSU Discord server tag. We also keep the Discord access tokens provided at login, to recheck this tag. We receive neither your password, nor your e-mail address, nor your Discord friends or servers.
Your profile and your game
Username and #tag, bio, any avatar you upload, showcase, cosmetic items and achievements; game save (collection, progress, Gems, quests, saved settings such as language); leaderboards, arena battles (teams and results), tournaments and seasons; trades, market listings, deliveries; rare pulls announced in the public feed.
Your interactions with other players
Friends list, private messages, guild (role, discussion, logo), global chat messages and attached cards, requested message translations.
Your purchases
Offer purchased, amount, currency, status (paid, refunded, disputed…), dates, and Stripe technical identifiers (checkout session, payment, customer, subscription, invoices). We never receive your card details. On its payment page, Stripe collects the data needed for payment (card, e-mail, country, fraud-prevention data…), under its own privacy policy.
Technical and security data
- Your IP address: used in memory to limit abuse (number of requests); stored only in hashed form (HMAC-SHA256 with a secret key), with the dates of first and last login, to fight referral fraud and multiple accounts.
- Your session token (login) and the date of your last activity.
- Anti-cheat signals: simulated clicks rejected by the browser, battle endings faster than a human, times of finished battles, status of the “I am not a robot” check.
- The server’s technical logs.
Referrals
Your referral code, the referrer–referee link, its status and the hashed IP address at sign-up.
Notifications
If you enable them on a device: the address provided by your browser’s notification service, its encryption keys, the device language and the sending dates.
Voice chat
During an arena battle, the server only relays the connection information between the two browsers (including your IP addresses), without recording anything. Sound never goes through our servers.
3. Why: purposes and legal bases
| Purpose | Legal basis (art. 6 GDPR) |
|---|---|
| Create and manage your account, run the game, the save, the leaderboards, the social features (friends, messages, guilds, chat, trades, market, arena, voice) | Performance of the contract (terms of use) |
| Check the KITSU Discord server tag (Pass reward) | Performance of the contract |
| Sell and deliver purchases, manage the subscription, refunds and disputes | Performance of the contract |
| Keep accounting records | Legal obligation |
| Translate a chat message when a player asks | Performance of the contract (for the player asking) and legitimate interest in a multilingual chat (for the message’s author) |
| Security, abuse limitation, fight against cheating, bots and referral fraud | Legitimate interest (protecting the service and fair play) |
| Moderation, handling reports, defending our rights | Legitimate interest and legal obligations |
| Send push notifications | Consent (which you can withdraw at any time) |
We do not sell your data, do not do targeted advertising and do not use any audience measurement tool.
4. How long: retention periods
- Account, profile, save, friends, private messages, guild, trades, market, game history: as long as your account exists, then deleted with it. Inactive account: [À COMPLÉTER : inactivity period after which an account is deleted (no automatic deletion today)].
- Global chat: the last 2,000 messages of each room; older ones and their translations are deleted automatically (checked every hour). After an account is deleted, its remaining messages are shown as “Deleted player” until they are erased; on request, we erase them at once.
- Session: until you log out.
- Discord tokens: as long as the account exists; erased as soon as Discord rejects them.
- Anti-cheat: battle times, 8 days; reports, 60 days; verification status, as long as the account exists.
- Hashed IP addresses and referrals: as long as the account exists.
- Notifications: until disabled, or until the notification service reports that the subscription is no longer valid (at most 8 devices per account).
- Purchases: the history is kept as long as the account exists; accounting records are kept for 10 years (article L123-22 of the French Commercial Code), in particular at Stripe.
- Rare pulls feed: the 500 most recent.
- Server technical logs: [À COMPLÉTER : retention period of the server’s technical logs (nginx, system)].
- Voice chat: nothing is kept.
5. With whom: recipients and processors
- Other players see your public profile (username, avatar, bio, showcase, guild, stats, online status) and the content you publish.
- Our team (administrators), for support, moderation and security.
- Hosting provider: [À COMPLÉTER : hosting provider (company name)] — hosts the server and the database.
- Discord (Discord Inc., United States) — login to the game; avatars displayed from its servers.
- Stripe (Stripe Payments Europe, Ltd., Ireland, and its group companies) — payments. For certain purposes (fraud prevention, legal obligations), Stripe acts as a separate controller.
- DeepL (DeepL SE, Germany) — translation: when a player clicks “Translate” or enables the chat’s automatic translation, the message text (without its author’s username) is sent to DeepL. Plan used: [À COMPLÉTER : DeepL plan used: API Pro (texts not stored) or API Free].
- Google (Google LLC / Google Ireland) — fonts loaded from fonts.googleapis.com and fonts.gstatic.com, and voice chat connection servers (“STUN”): your browser contacts them directly, which sends them your IP address and technical information about your browser.
- Cloudflare (Cloudflare Inc., United States) — only if you are asked for the “I am not a robot” check and it uses Cloudflare Turnstile.
- AniList and Fandom — some card images are loaded from their servers (s4.anilist.co, static.wikia.nocookie.net), which then receive your IP address.
- Your browser’s notification services (Google, Mozilla, Apple, Microsoft…) — deliver notifications if you enable them; their content is encrypted.
- Authorities — upon legal request.
6. Transfers outside the European Union
Some of these providers are established outside the European Union, notably in the United States (Discord, Google, Cloudflare, Fandom, part of the Stripe group). These transfers rely on the European Commission’s adequacy decision of 10 July 2023 (“EU-U.S. Data Privacy Framework”) for companies that have joined it, or otherwise on the standard contractual clauses adopted by the European Commission.
7. Your rights
You have the right of access, rectification, erasure, restriction, portability, and to object to processing based on our legitimate interest. You can withdraw your consent to notifications at any time (game Settings or browser settings). You can also set instructions regarding your data after your death.
To exercise these rights, write to [À COMPLÉTER : contact e-mail] or [À COMPLÉTER : postal address]. To prevent someone from impersonating you, we may ask you to confirm the request from your account. We reply within one month (extendable by two months for a complex request).
8. Complaint to the CNIL
If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr, or with the data protection authority of your country of residence.
9. Security
We protect your data: encrypted connections (HTTPS), no stored password (Discord login), random session tokens, login protection against request forgery, IP addresses stored only in hashed form, card data processed only by Stripe, administration access restricted to a few accounts. As no system is infallible, we will inform you and the CNIL of any data breach presenting a risk, as required by law.
10. Minors
The game is open from age 13 (see the terms of use). In France, a minor under 15 cannot alone consent to processing based on consent (push notifications): their parents’ consent is then required. Parents can exercise their child’s rights and request deletion of their account at [À COMPLÉTER : contact e-mail].
11. Automated decisions
Anti-cheat checks are automatic: they can temporarily block certain actions until an “I am not a robot” check. No decision producing legal effects or significantly affecting you (such as a ban) is taken solely on the basis of automated processing; you can ask for human intervention and challenge the decision.
13. Changes
We may update this policy, for example if the game evolves or if we change provider. The date of the last update appears at the top of the page; for any significant change, we will inform you in the game.