Privacy Notice

1Who we are

The data user is [REGISTERED BUSINESS NAME], registration number [REGISTRATION NUMBER], [TRADE ADDRESS]. Contact: [SUPPORT EMAIL].

2What we collect

• Account: your username, email address and password (we store only a one-way hash of it), and the versions of our terms and this notice you accepted.
• Sign-in and security: your IP address, and your browser and device information in your sign-in sessions.
• Game: your game account and character ids, and your characters' names and levels as the game server holds them.
• Top-ups: your orders, the payer name you declare (yours, or your parent's or guardian's), the payer name and bank reference on our bank statement for your payment, and the payment-proof images you upload.
• Support: your support tickets and messages. For an account recovery request: the contact email address and username you give us.

3Where we get it

From you, from your use of this website and the game, and from our bank statement (the payer name and reference of your payment).

4Why we use it

• to create and run your account and your game account, and to let you play;
• to verify your email address and keep your account secure;
• to process your top-ups, match payments on our bank statement, credit your Diamonds, handle refunds, prevent fraud, and keep the records the law requires;
• to answer your support requests and account recovery requests;
• to enforce our Terms of Service and keep the service running and safe.

5Who we share it with

• our email provider, to send you emails;
• Cloudflare, which protects and delivers this website;
• our bank, for payments and refunds;
• authorities, when the law requires us to.

We do not sell your personal data.

6Transfers outside Malaysia

Cloudflare processes website traffic in data centres outside Malaysia. [EMAIL PROVIDER AND ITS COUNTRY]: to be confirmed before launch.

7Payment proofs

Payment-proof images contain names and bank details. We store them privately, never publicly. Only the staff who credit orders can see them, and every view is logged. Before you upload, please hide your balance and any other transactions.

8How long we keep it

• Payment-proof images: deleted 36 months after the order's last update.
• Money records (orders, payer names, bank references, proof hashes and consent records): kept as long as the law requires.
• Scheduled deletion is paused while a dispute, a legal notice or a legal request is open.
• Sessions: deleted 30 days after they expire.
• Accounts that are never verified: deleted after 7 days.
• Sign-in and play audit records: 13 months.
• Support and community audit records: 2 years.
• Money, reward and staff audit records: 7 years.

9Deleting your account

You can ask us to delete your account. We then anonymize it: we remove your username, email address and other personal details. Order and payment records are kept, because the law requires it.

10Your rights

You have the right to access your personal data, to correct it, to withdraw your consent, and to limit how we process it. To use these rights, open a support ticket with the category Account, or email [SUPPORT EMAIL]. We may ask you to confirm who you are. We answer an access or correction request within 21 days.

11Must you give us this data?

Your username, email address and password are needed to create an account. The payer name and payment details are needed to buy Diamonds. Without them we cannot provide those services. Everything else is optional.

12Security

We protect your data with access controls, encryption of sensitive fields, hashed passwords and logged staff access.

13Changes

We may update this notice. This page shows the date and version of the text in force, and earlier versions stay listed below it.