1. Who is responsible
The controller responsible for processing personal data in BadForge is the founder of BadForge. Contact: Signal (https://signal.me/#eu/uJChipIZT4fZAiAK_FFiv8EOP8qS8InHFGouQZIzQvx8cgxO6MBDTrapAc-yGnzD). We have not appointed a data protection officer, because the law does not require one for us.
2. What we process and why
Your login
Your name, email address, password (stored only as a secure hash), passkeys, two-step settings, language and display settings. We need them to give you your login and to perform our contract with you (Art. 6(1)(b) GDPR).
Invitations and referrals
Who invited you, the invitations you create and the rewards they earn. We use them to run invitations and referral rewards (Art. 6(1)(b) GDPR) and to prevent abuse, which is our legitimate interest (Art. 6(1)(f) GDPR).
Game accounts
The login details of the game accounts and lobbies you add, the game's session cookies, and the game data your tasks read, such as cities, resources, units and reports. We store login details and session data encrypted. We need them to run the tasks you ask for (Art. 6(1)(b) GDPR).
Other players
Game data about other players that the game shows you, such as player names, alliances, islands, cities and attacks. We process it for monitoring, maps and history. Our legitimate interest, and yours, is to see and keep the information the game itself shows (Art. 6(1)(f) GDPR). We delete attack monitoring history after 1,825 days.
Connections and captcha services
The connections (proxies) and captcha service keys you add, stored encrypted, and which connection and network address each account used. We need them to run tasks over the route you chose and to keep each account's route consistent (Art. 6(1)(b) GDPR).
Notifications
The Telegram or Discord channels you connect and the messages we send there (Art. 6(1)(b) GDPR). We keep the delivery history for 30 days.
Credits, plans and payments
Your wallet and its history, your plans, orders and redeemed codes, and the payment details we receive, such as the amount, date and payment reference. We need them to perform the contract (Art. 6(1)(b) GDPR) and to meet our accounting and tax obligations (Art. 6(1)(c) GDPR).
Technical and security data
When you use the service, we process your IP address, browser details and the times of your requests and sign-ins, and we log the requests that tasks send to the games. We use this to run the service securely, find faults and prevent misuse. Our legitimate interest is a secure, working service (Art. 6(1)(f) GDPR). We delete task request logs after 30 days.
Messages to us
When you contact us, we process your message and contact details to answer you (Art. 6(1)(b) or (f) GDPR).
3. Cookies
We use only the cookies the service needs to work: a session cookie that keeps you signed in, a security cookie that protects forms, and, if you choose it, a cookie that remembers your sign-in on this device. Your browser also stores your display settings, such as light or dark mode.
There is no tracking, analytics or advertising in the service, so we do not ask for consent to cookies.
4. Who receives data
We share personal data only where it is needed for the purposes above:
- our hosting provider, which runs our servers and databases for us under a data processing agreement;
- our email provider, for sign-in, confirmation and notification emails;
- the game publishers whose servers your tasks sign in to, on your instruction; they process the data under their own privacy policies;
- the captcha solving services and connection providers you choose; they receive only what they need, such as the puzzle to solve or the request to pass on;
- Telegram or Discord, for the notifications you set up;
- payment providers and resellers, when you pay through them;
- authorities, where the law requires it.
We do not sell personal data.
5. Transfers outside the European Union
Some services you choose, such as captcha services, Telegram or Discord, may process data outside the European Economic Area. Where the European Commission has not decided that a country protects data adequately, the transfer is based on the provider's standard contractual clauses, or it is necessary to provide the function you asked for (Art. 49(1)(b) GDPR).
6. How long we keep data
We keep personal data only as long as the purposes above require. When you delete your login, we delete your data, including your game accounts, login details and connections, unless the law requires us to keep it.
We keep accounting records, such as orders and credit history, as long as tax and commercial law require, usually up to 10 years.
The periods in this policy apply to our live systems. We also keep backups for up to 30 days, so that we can restore the service after a fault. Data deleted from our live systems remains in the backups until they are overwritten, and we do not use it for anything else.
7. Your rights
You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18), and to receive it in a portable format (Art. 20). Where we rely on your consent, you can withdraw it at any time with effect for the future.
Right to object: where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We then stop, unless we have compelling legitimate grounds or need the data to establish, exercise or defend legal claims.
To use your rights, contact us: Signal (https://signal.me/#eu/uJChipIZT4fZAiAK_FFiv8EOP8qS8InHFGouQZIzQvx8cgxO6MBDTrapAc-yGnzD). You can also change or delete much of your data yourself under Settings.
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work or where you believe the infringement took place (Art. 77 GDPR).
8. Other things you should know
- You need to give us the data a form marks as required to create a login and use the service; without it, we cannot provide the service.
- We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR).
- We protect data with technical and organisational measures, such as encrypting login details, two-step sign-in, and access only for authorised staff.
- If you add data about other people, such as another person's game account with their permission, make sure you are allowed to share it with us.
9. Changes to this policy
We update this policy when our processing changes. The date at the top shows the current version.