Nexdus.net Privacy Policy

1. Controller and contact

The controller is Arkadiusz Blizna, Poland, operating Nexdus.net. For personal data, account and support matters, contact support@nexdus.net. Signed-in players can also use account support tickets.

Do not send your game password, recovery key, authentication codes or full card details. A character name and a description of the problem will usually be enough to locate the issue.

2. Data we process

• Account: account ID and name, email, the password record used for verification, authentication and recovery settings, registration date and connection records including IP address and time.
• Game: character names and IDs, progress, skills, inventory, position, balances, VIP, rewards, guilds, activity, in-game transactions and events needed to operate the game world. This also includes feature status reported by the client, such as the built-in bot status used to calculate the manual-play bonus.
• Support and moderation: tickets, correspondence, submitted attachments and evidence, administrative decisions, violations and bans. Evidence may also come from other players reporting an incident.
• Purchases: account association, package and Coins quantity, amount, currency, status, time and Stripe transaction identifiers.
• Website and client: technical request data such as IP address, time, requested URL and browser or client information, cookies and settings stored on your device. Avoid putting private information in public character descriptions.

3. Purposes and legal bases

• Creating and maintaining an account, gameplay, purchases and related support: performance of a contract or steps before entering one, under GDPR Article 6(1)(b).
• Account and server protection, fraud prevention, moderation, disputes, diagnostics and legal claims: the controller’s legitimate interests in safe and reliable operation of Nexdus, under Article 6(1)(f).
• Records required by applicable law: compliance with a legal obligation under Article 6(1)(c), where relevant to the particular matter.
• If an additional feature requires consent, its purpose is explained before consent is requested. Consent can be withdrawn without affecting earlier lawful processing. Reading this policy or accepting the game rules does not constitute marketing consent.

Required account fields are necessary to create an account; without them we cannot provide that feature. Purchases and additional support materials are optional. Only submit information relevant to your request.

4. Information visible to other players

Character names, selected statistics, online status, guilds, rankings, death and PvP history, public offers and descriptions may appear on the website or in the game. A profile may show other non-hidden characters on the same account. Available hiding settings limit particular elements, not all visibility within the game world.

Email addresses, IP addresses, login information and private tickets are not public ranking fields. Other users may copy public content and search engines may index it.

5. Providers and payments

Data may be accessed by authorised Nexdus staff and providers needed to deliver the service:

• Contabo: VPS infrastructure hosting the website, game server, database and Nexdus mail. Contabo privacy information.
• Stripe: payment processing. Checkout receives your account ID, email, package details, Coins quantity, amount and currency. You enter payment instrument data in Stripe Checkout. Our payment table stores confirmations and transaction IDs, not full card numbers or BLIK codes. Stripe may also act as an independent controller, including for fraud prevention and its legal obligations. Stripe privacy policy.
• Google reCAPTCHA: protection of account registration against automated abuse. On the registration page, Google may receive connection, browser and interaction data and use its own identifiers. See Google privacy information and Google terms.
• Mail providers involved in delivering messages and competent authorities where disclosure is required by law.

Discord, Twitch, YouTube and Kick links lead to separate services. Their providers’ privacy rules also apply after you open those services.

6. Transfers outside the EEA

International providers, particularly Google and Stripe, may access data outside the European Economic Area. Depending on the recipient, transfers may rely on an adequacy decision of the European Commission or appropriate safeguards such as standard contractual clauses. See Google’s transfer information and Stripe’s data protection documentation. You can ask the controller about recipients and safeguards relevant to your data.

7. Retention

• Accounts and characters: while the service is provided and the account maintained. Logging out or uninstalling the client does not delete server data. You may request deletion using the contact above.
• Purchases and records: for settlement, complaints and disputes, and for periods required by applicable law. Not all transaction records can be deleted immediately when an account closes.
• Support and moderation: while handling the case, enforcing an applicable sanction and where evidence is reasonably needed for a related dispute.
• Technical logs: rotation depends on the log type and server settings. Web logs rotate daily with up to 14 archives; empty periods may not create a new archive. Evidence of a specific incident may be retained until it is resolved.
• Account recovery: links work once and expire after 30 minutes. Token hashes are removed 24 hours after expiry; pseudonymised request-limit records after 24 hours. The encrypted mail queue is cleared after delivery or message expiry.
• Backups: may contain earlier data and support recovery after failures or updates. Handling deletion includes considering backups and reapplying deletions if a backup is restored. Timing depends on recovery needs and obligations concerning retained records.

Retention depends on the purpose and case, not merely on possessing the data. In response to a request we will explain what remains, why, and the criteria used to determine when it can be removed.

8. Cookies and device storage

• PHPSESSID: a session cookie for sessions, sign-in and form protection. It expires according to the browser’s session handling; restoring a session may preserve it.
• sv_lang: remembers the selected Polish or English language for up to 365 days after selection.
• bounceFire: may remember dismissal of a website notice for 1 day to avoid showing it again.
• reCAPTCHA: Google cookies or identifiers may operate on the registration form to protect it. Google provides details and retention information in the notices linked above.

You may delete or block cookies in your browser. Blocking session cookies can prevent sign-in or form submission. The game client stores configuration, preferences and, when you choose to remember them, information used to sign in locally on your device. Manage these settings in the client and on your device.

9. Your rights and requests

Subject to GDPR conditions, you may request access and a copy, rectification, erasure, restriction and portability of your data. You may object to processing based on legitimate interests and withdraw consent. Erasure is not unconditional, for example where particular records are needed for a legal obligation or legal claims.

Email support@nexdus.net with your request and the relevant account. We may seek proportionate verification of your entitlement to the account. Do not send an identity document without first clarifying whether it is needed. We normally respond within one month; any legally permitted extension and its reason will be explained within that period.

You may complain to a data protection authority, including the President of the Polish Personal Data Protection Office (UODO). You do not have to exhaust contact with Nexdus first.

10. Automation and policy updates

Game mechanics, rewards and basic protection may operate automatically. These are not used to make decisions with legal or similarly significant effects on you within GDPR Article 22. You can challenge a moderation decision through a support ticket.

Changes to features, providers or processing may require policy updates. The current version and its date are available at this address. We will communicate significant changes affecting accounts through the website or an account contact channel.