1. Who we are
Aindor ("we", "us") operates the website aindor.to, the Aindor game server and the related community channels (Discord, social media). This policy explains what personal data we process when you visit the website or play on the server, and which rights you have under the General Data Protection Regulation (GDPR).
Data controller contact: [email protected].
2. Data we collect
When you visit the website
- Technical data sent by your browser: IP address, browser type and version, operating system, language, referring page, pages visited and time of visit.
- Server logs kept for security and error diagnosis.
- With your consent, data collected by marketing cookies and pixels (see section 4).
When you create a game account (once registrations open)
- Username, e-mail address, password (stored hashed), delete code, registration date and IP address.
- Game data: characters, items, progress, playtime, chat logs and moderation records.
- If you make a purchase: the transaction ID, amount and payment method. Card details are handled only by the payment provider and never reach our servers.
When you click "Join our Discord"
- We record that the button was clicked, together with the time, IP address, browser, the page you came from and the advertising campaign that brought you to the site (UTM parameters, Meta or TikTok click IDs). This lets us measure which campaigns work.
- What happens on Discord is governed by Discord's privacy policy.
3. Why we use it and on what legal basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Running the website and the game server, creating and managing your account | Performance of a contract (6.1.b) |
| Security, fraud and cheat prevention, enforcing the game rules | Legitimate interest (6.1.f) |
| Processing payments and keeping accounting records | Contract (6.1.b) and legal obligation (6.1.c) |
| Measuring advertising campaigns and showing you relevant ads on Meta and TikTok | Your consent (6.1.a), given through the cookie banner. You can withdraw it at any time. |
| Answering support requests | Legitimate interest (6.1.f) |
4. Cookies & tracking technologies
Cookies are small files stored in your browser. We split them into two groups. Necessary cookies are always on because the site does not work without them. Marketing cookies are set only after you click Accept all in the cookie banner.
| Name | Provider | Group | Purpose | Duration |
|---|---|---|---|---|
aindor_consent | Aindor | Necessary | Remembers your cookie choice | 6 months |
XSRF-TOKEN, laravel_session | Aindor | Necessary | Security and login session on account pages | Session |
ad_params (session storage) | Aindor | Necessary | Keeps the campaign parameters from the link you arrived with, for the duration of the visit only | Until the tab closes |
_fbp, _fbc | Meta Platforms Ireland Ltd. | Marketing | Meta Pixel: measures visits and Discord clicks coming from Facebook and Instagram ads, builds ad audiences | 90 days |
_ttp, _tt_enable_cookie | TikTok Technology Ltd. | Marketing | TikTok Pixel: measures visits and Discord clicks coming from TikTok ads, builds ad audiences | 13 months |
__cf_bm, cf_clearance | Cloudflare Inc. | Necessary | Bot protection and content delivery | Up to 1 year |
aindor_ref | Aindor | Necessary | Remembers which referral link brought you to the site, so we can see which of our own links work | 30 days |
| Visit counter (no cookie) | Aindor | Necessary | Each page view sends the page name and the referral to our own server. Your IP address and browser are hashed with a key that changes daily; the result cannot be turned back into an IP. Kept for 90 days. | — |
When you accept marketing cookies, we also send the same events (page view, Discord click, account registration) from our server to Meta and TikTok through their Conversions APIs. Your IP address and browser identifier are included so the event can be matched to the ad you saw. E-mail addresses, when sent, are hashed first.
You can change your choice at any time:
You can also delete cookies from your browser settings and opt out of interest-based advertising at Facebook Ad Preferences and in the TikTok app under Settings > Privacy > Ads.
5. Who receives your data
- Hosting and infrastructure providers that run the website and the game server, under data processing agreements.
- Cloudflare (content delivery and protection against attacks).
- Meta Platforms Ireland and TikTok Technology Ltd., only with your consent, for advertising measurement. These companies may transfer data outside the EU under the EU-US Data Privacy Framework or standard contractual clauses.
- Payment providers (for example PayPal, Stripe or voucher services) when you buy something. Each provider processes your payment data under its own policy.
- Discord Inc. when you join our community server.
- Authorities, when the law requires it.
We never sell your personal data.
6. How long we keep data
- Server and security logs: up to 12 months.
- Advertising click records: up to 24 months, then deleted or anonymised.
- Account and game data: for as long as the account exists. After deletion we keep only what is needed for payment and fraud records (usually up to 5 years, as required by accounting law).
- Support messages: up to 2 years after the request is closed.
7. Your rights
Under the GDPR you can ask us to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate data;
- delete your data ("right to be forgotten"), including your game account;
- restrict or object to processing based on legitimate interest;
- receive your data in a portable format;
- withdraw consent at any time, without affecting processing done before the withdrawal.
Write to [email protected] from the e-mail address linked to your account. We answer within 30 days. You also have the right to lodge a complaint with your national data protection authority; in Romania this is the ANSPDCP.
8. Security
Passwords are stored hashed, connections are encrypted (HTTPS), access to databases is restricted to the administrators who need it, and account logins can be protected with additional verification. No system is perfectly secure, so please use a unique password and never share your delete code.
9. Minors
The website and the game server are intended for players aged 16 and over. We do not knowingly collect data from younger children. If you believe a child has provided us with personal data, contact us and we will delete it.
10. Changes to this policy
We may update this policy when the website or the law changes. The date at the top shows the latest version. Significant changes will be announced on the website or on Discord.
11. Contact
Aindor team, [email protected], our Discord server.
← Back to aindor.to