Privacy Policy

1. Overview

This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you use Attoric Games services. It also explains your rights under the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the CPRA (collectively, "CCPA").

We do not sell or share personal information for cross-context behavioral advertising, targeted advertising, or profiling as defined under the CPRA.

2. Information We Collect

Notice at Collection: At or before the point of collection, we inform users of the categories of personal information collected and the purposes for which they are used, as described in this policy.

• Account Information: name, username, email, password (hashed), Discord handle, and organization details.
• Billing Information: payment method and transaction data processed by Stripe or PayPal; we only receive limited non-sensitive details such as transaction IDs and billing addresses.
• Service Data: server names, configurations, logs, and usage metrics generated by AMP (by CubeCoders).
• Support Data: messages, tickets, and attachments submitted to us by email, Discord, or through our support portal.
• Automatically Collected Data: IP address, browser type, device info, access times, pages viewed, and diagnostic logs.

3. How We Use Information

• Provide, maintain, and improve our Services.
• Authenticate users and manage accounts.
• Process payments and fulfill orders.
• Respond to inquiries and provide support.
• Prevent fraud and abuse, ensure network security, and comply with legal obligations.
• Analyze aggregated usage trends to enhance features.
• Send necessary service updates and maintenance alerts (marketing emails are optional).

Legal bases for processing (GDPR): contract performance, legitimate interests (security, service improvement), consent (where required), and legal obligation.

4. How We Share Information

We do not sell personal data. We may share limited information with trusted processors:

• Stripe, Inc. / PayPal, Inc. – payment processing.
• CubeCoders Limited (AMP) – game server orchestration and telemetry.
• Google LLC (Google Analytics) – website analytics and usage tracking. We configure Google Analytics to minimize data collection, including IP anonymization where supported, restricted data retention periods, and disabled advertising personalization features. We do not enable Google Signals, advertising personalization, or remarketing features in Google Analytics.
• Discord Inc. – community support and optional account linking.
• Authentik (self-hosted) – identity management and single sign-on authentication; this system is hosted on our own infrastructure and all authentication data is retained and controlled by Attoric Games.

Disclosures may also occur for legal compliance, fraud prevention, or business transfers (e.g., merger or acquisition). Each processor's privacy policy governs their independent data use.

5. Cookies and Tracking

We use essential cookies to operate the site and remember sessions. Disabling essential cookies may impair functionality.

Cookie Consent Banner: When you first visit our site, you will see a cookie consent banner asking you to accept or reject analytics cookies. Your choice is stored in a cookie called attoric_consent for one year.

• If you accept: Google Analytics will load and track your usage patterns, configured with IP anonymization and without advertising features.
• If you reject: Google Analytics will not load. We will still collect anonymized, aggregated server-side analytics (page views, device type, referrers) without cookies or personal identifiers.

Server-Side Analytics: Regardless of your cookie preferences, we collect basic, anonymized usage data on our servers to understand site traffic. This data includes page URLs, device types, browsers, and referrers. We do not store IP addresses or use cookies for this purpose. Visitor identifiers are hashed daily and cannot be used to track individuals across sessions.

Global Privacy Control (GPC): We automatically honor Global Privacy Control signals. If your browser sends a GPC signal, we treat it as a rejection of analytics cookies and will not load Google Analytics.

6. Data Retention

We retain personal data only for as long as necessary to provide services and comply with legal obligations.

• Account and billing data – kept while your account is active and for required legal/tax periods.
• Cloud backups – deleted upon cancellation or within seven (7) days after lapse, consistent with our Terms of Service.
• Support records – retained for troubleshooting and service continuity.
• Google Analytics data – retained for 14 months, after which it is automatically deleted or anonymized.
• Server-side analytics – retained for operational analysis; visitor hashes are regenerated daily and cannot be linked to individuals.

Cookies We Use:

7. Security

We implement technical and organizational measures to protect personal data, including encrypted transmission, access control, and audit logging. No system is completely secure; users must also protect their credentials and hosted content.

8. Your Rights and Choices

Depending on your jurisdiction, you have rights to:

• Access, correct, or delete your personal information.
• Receive a portable copy of your data.
• Restrict or object to certain processing activities.
• Withdraw consent (where processing is based on consent).

To exercise these rights, email support@attoric.net with the subject line "Privacy Request." We verify all requests before actioning.

California Residents: You may designate an authorized agent to make privacy requests on your behalf. We will not discriminate against any user for exercising their privacy rights.

EU/UK Residents: You have the right to lodge a complaint with your local Data Protection Authority if you believe your rights have been infringed.

Global Privacy Control: We honor Global Privacy Control (GPC) signals as required under California law. When detected, we treat such signals as a request to opt out of any processing that constitutes "selling" or "sharing" personal information under the CPRA.

9. International Data Transfers

We process data in the United States and other countries where our service providers operate. For cross-border transfers, we rely on Standard Contractual Clauses (SCCs) and equivalent safeguards. A Data Processing Addendum (DPA) is available upon request.

10. Changes to This Policy

We may revise this policy from time to time. For material updates, we'll notify you via email or client portal notice at least 30 days in advance. Continued use after the effective date signifies acceptance.

11. Contact Us

Questions or concerns? Email support@attoric.net or reach us via Discord.

Attoric, LLC (Attoric Games)

Privacy Contact: Privacy inquiries are handled by our designated privacy contact at support@attoric.net. We do not currently appoint a statutory Data Protection Officer, as our processing does not require one under GDPR Article 37.

Last updated: January 7, 2026