1. Who is responsible
Vital ("we", "us") is the controller of the personal data described here, except payment data, where PayNow.gg is also a controller (section 8). Contact us on our Discord. A person reads every request.
2. What we collect and why
| Data | Why | Lawful basis (GDPR / UK GDPR) |
|---|---|---|
| Steam ID, Steam name and avatar, received from Steam when you sign in | Sign-in, showing who is signed in, linking purchases to your game account | Contract |
| Sign-in session: a random token, when it was made and last used | Keeping you signed in and the site secure | Contract |
| Orders: products, amounts, tax, currency, status and dates, the PayNow customer and subscription references, and the payment events PayNow sends us | Delivering and supporting what you bought, accounting | Contract, legal obligation |
| Name, email and billing details you give at checkout | Collected and held by PayNow, which shares with us only what delivery and support need | Contract |
| Gameplay statistics from our servers: kills, deaths, hits, playtime, clan membership | Leaderboards, public player and clan pages | Legitimate interest |
| IP address and connection logs of the site and the servers | Security, ban evasion, abuse prevention | Legitimate interest |
| Bans and warnings | Enforcing rules, handling appeals | Legitimate interest |
| Messages and files you send us on our Discord | Answering you, investigating reports | Legitimate interest |
Where we rely on legitimate interest we have weighed it against your rights. You can object (section 9).
Signing in with Steam is needed to buy from the store. Everything else is generated by using the site and the servers.
3. Public information
Your Steam name, avatar, playtime and gameplay statistics from our servers appear on public player, clan and leaderboard pages. There is no option to hide them. If you do not want this, do not play on our servers. There is no public ban list.
4. Fair play
We use automated systems against cheating.
5. Bans and appeals
How bans work and how to appeal one is set out on the Moderation page.
6. Where data goes (subprocessors and recipients)
| Recipient | Role | Purpose | Location |
|---|---|---|---|
| Valve (Steam) | Identity provider, source of Steam data | Sign-in, Steam name and avatar | USA, other Valve locations |
| PayNow.gg | Seller of record and payment processor, controller of buyer data | Payments, taxes, subscriptions, chargebacks | See PayNow's policy |
| Cloudflare | Network and security provider | Delivering the site and protecting it from attacks | USA and global |
| Discord Inc. | Community platform | Our community and the messages you send us there | USA |
| BattleMetrics | Server and ban-data service | Server listing, player and ban records shared on the service | USA |
| Hosting and infrastructure providers | Processors | Running the site, game servers, databases and backups | Listed on request |
We do not sell personal data. Staff and trusted moderators see data as needed for their role.
Steam data: under the Steam Web API terms we tell you what we keep. We store the Steam ID, Steam name and avatar we receive, on our servers in the countries above. We delete Steam data we no longer use and remove it on request.
Discord: messages you send us on Discord are also handled by Discord under its own policy.
BattleMetrics: bans we issue may be recorded on BattleMetrics with your Steam ID, ban reason and dates. That service handles that data under its own policy.
7. Transfers outside your country
Some recipients are in the USA or elsewhere. Where UK or EU data goes to a country without an adequacy decision we rely on standard contractual clauses, the UK addendum or the Data Privacy Framework where a recipient participates. Ask us for copies.
8. Payments
PayNow.gg is the seller of record. It collects your payment details and decides how they are used. We do not see your card number. PayNow shares with us your order, its status and the Steam ID it is for, and we handle them only under this policy. Read PayNow's Terms, Privacy Policy and Buyer Agreement.
9. Your rights
Depending on where you live you can ask us to: access your data; correct it; delete it; restrict or object to processing; receive it in a portable form; and withdraw consent. We answer within one month. We may need to confirm you own the Steam account first.
Contact us on our Discord to use any of these. If you are unhappy with our answer you can complain to your data protection authority (in the UK, the Information Commissioner's Office; in the EU, the authority in your country).
Deleting your data removes your sign-in record and Steam name and avatar from the site. We may keep what the law requires, such as order records, or what is needed to stop banned players returning (see retention).
10. US state privacy rights
If you live in a US state with a consumer privacy law you can ask to know what we collect, access or delete it, correct it, and opt out of sale and sharing for advertising. We do not sell personal data and do not share it for cross-context advertising. We will not treat you worse for using these rights. Contact us on our Discord; if we decline a request you can appeal the same way.
11. Retention
| Data | Kept for |
|---|---|
| Steam ID, Steam name and avatar | While you use the site, then up to 12 months |
| Sign-in sessions | Up to 30 days, ending sooner after 7 days without use or when you sign out |
| Public gameplay statistics | While they are shown on the site |
| Raw IP and connection logs | 90 days |
| IP and identifiers linked to a ban | While the ban stands, then up to 12 months |
| Bans and appeal records | While the ban stands, then up to 24 months |
| Order and billing records | 6 years (accounting law) |
| Messages to us on Discord | As long as needed to answer you, and as Discord keeps them |
12. Children
You must be at least 17 to use the services. We do not knowingly collect data from anyone under 13. If we learn we have, we delete it. A parent can contact us to request deletion.
13. Security
Access to personal data is limited by role and logged. No system is perfect. If a breach puts you at risk we will tell you and the authorities as the law requires.
14. Cookies
See the Cookie Policy. In short: only the cookies needed for sign-in and your language, and no analytics or advertising cookies.
15. Changes
Material changes are announced on the site and on our Discord at least 30 days before they apply. Past versions are in the Legal Changelog.