Privacy Policy

1. Data controller

The controller responsible for WOS Helper is [LEGAL NAME OR OPERATOR NAME], located at [REGISTERED ADDRESS OR COUNTRY].

Privacy contact: [PRIVACY CONTACT EMAIL]. Data Protection Officer, if appointed: [DPO NAME AND CONTACT OR NOT APPLICABLE].

2. Information we process

• Account information: username, email address, password hash, account status, assigned roles and linked player.
• Player information: player ID, current name, aliases, alliance, troop levels, heroes, power, kills, labyrinth level, labels and update timestamps.
• Event information: attendance assignments, planning positions, evaluations, presence status and optional excused-absence reasons.
• Administrative information: changes made through privileged accounts and security or audit records.
• Technical and session information: authentication-session timestamps, browser and device information reported by the browser, active State, open service tabs, their visible or hidden status, and the current service area and page path. Query strings and URL fragments are not stored by the session-presence feature. IP address, request metadata and server logs may also be processed where necessary to secure and operate the service.
• Preferences: the selected light or dark theme, stored locally in your browser.

3. Sources of information

Information may be provided directly by users; entered by administrators, R5s or R4s; imported from configured spreadsheets or Supabase tables; generated from event activity; or collected automatically when the service is accessed.

Where information is obtained from another source, the source categories are [LIST EXTERNAL DATA SOURCES].

4. Purposes and legal bases

• Providing accounts and requested features: performance of the service requested by the user.
• Alliance administration and legitimate community coordination: our legitimate interests and those of authorized alliance managers, balanced against user rights.
• Security, audit logs and abuse prevention: our legitimate interests in protecting the service and its users.
• Legal compliance and requests: compliance with applicable legal obligations.
• Optional analytics or communications, if introduced: consent where required.

The exact legal bases should be reviewed for the final operating model in [APPLICABLE COUNTRY].

5. Recipients and service providers

Information is visible to users according to their role and alliance permissions. Authorized System Managers can view retained account sessions, online status and current service pages, and can revoke individual or all sessions for an account. We may also use processors that provide hosting, database, backup, monitoring or security services.

• Hosting provider: [HOSTING PROVIDER AND LOCATION]
• Database provider: [DATABASE PROVIDER AND LOCATION]
• Backup or monitoring providers: [OTHER PROCESSORS OR NONE]

We do not sell personal information. We may disclose information where required by law or necessary to protect legal rights and service security.

6. International transfers

Data is primarily hosted in [DATA HOSTING REGION]. If information is transferred outside the European Economic Area, we will use an applicable adequacy decision, contractual safeguards or another lawful transfer mechanism. Details can be requested at [PRIVACY CONTACT EMAIL].

7. Retention

• Accounts: [ACCOUNT RETENTION PERIOD]
• Authentication sessions: active for up to 7 days, with an idle expiry currently set to 12 hours. Revoked or expired session metadata and associated page-presence records are retained for up to 30 further days for security and support, then deleted by the scheduled cleanup.
• Audit logs: [AUDIT LOG RETENTION PERIOD]
• Detailed player statistics history: currently 30 days, with retained daily history for up to 6 months.
• Attendance, planning and evaluations: [EVENT DATA RETENTION PERIOD]
• Backups: [BACKUP RETENTION PERIOD]

Information may be retained longer when required by law, necessary to resolve disputes or needed to protect the service.

8. Security

We use role-based access controls, hashed passwords and session tokens, restricted administrative functions and activity records. No system is completely secure; report suspected incidents to [SECURITY CONTACT EMAIL].

9. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability or objection to processing. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.

Send requests to [PRIVACY CONTACT EMAIL]. You may also lodge a complaint with the competent supervisory authority, including the Italian Garante per la protezione dei dati personali where applicable.

10. Automated decisions and children

WOS Helper does not currently make decisions producing legal or similarly significant effects solely through automated processing. The service is intended for users aged [MINIMUM AGE] or older. If a different age or parental-consent model applies, it should be stated here.

11. Changes

We may update this policy when our processing changes. Material updates will be communicated through [NOTICE METHOD]. The date at the top identifies the current version.