Privacy Policy (GDPR)
Last updated: 2026-03-04
This Privacy Policy explains how personal data is processed when you use Elevenfold Legacy on elevenfold-legacy.com.
1) Controller (Art. 4(7) GDPR)
Roman Moroz
Alpenstr. 12, 86159 Augsburg, Germany
Contact: support@elevenfold-legacy.com
2) Processing purposes and legal bases
Personal data is processed to provide and operate the Service, secure accounts, process purchases, handle support, and meet legal obligations.
Legal bases:
- Art. 6(1)(b) GDPR (performance of contract / providing the Service)
- Art. 6(1)(f) GDPR (legitimate interests: security, abuse prevention, service reliability)
- Art. 6(1)(c) GDPR (legal obligations such as accounting/tax retention)
- Art. 6(1)(a) GDPR (consent, where required)
3) Account and authentication data
Typical data: email address, user ID, sign-in metadata, and account-status data.
Purpose/legal basis: account creation, login, and account management (Art. 6(1)(b) GDPR).
Processor: Google Firebase / Google Cloud.
4) Gameplay and profile data
Typical data: team identity, lineup/squad state, matches/results, rankings/awards, economy and purchase entitlement state, manager profile information, and in-app preferences.
Purpose/legal basis: delivering gameplay features and storing progress (Art. 6(1)(b) GDPR).
5) Notification, support, and messaging data
Typical data: notification preferences, push token metadata, support email content/metadata, delivery and bounce events.
Purpose/legal basis: reliable account/service communication and support operations (Art. 6(1)(b), Art. 6(1)(f) GDPR).
Processor: Resend (email delivery and configured inbound support forwarding).
6) Payment and billing data
If paid features are used, payment details are processed by the active payment provider. Elevenfold does not store full card details.
Typical data: billing customer/subscription IDs, transaction status, entitlement metadata.
Purpose/legal basis: purchase processing and entitlement delivery (Art. 6(1)(b) GDPR); statutory retention where required (Art. 6(1)(c) GDPR).
Providers used by configuration: Stripe and/or Paddle.
7) Hosting, logs, and security
When the Service is accessed, infrastructure and application logs may include IP address, user-agent/device data, request timestamps, URLs, and error events.
Purpose/legal basis: security, abuse/fraud prevention, debugging, and stable operation (Art. 6(1)(f) GDPR).
Hosting and core infrastructure: Google Cloud / Firebase. Domain/network services may involve Cloudflare.
8) AI features
If assistant or AI-generated narrative/report features are used, selected gameplay/context data may be sent to an AI provider for response generation.
Purpose/legal basis: providing requested assistant/report features (Art. 6(1)(b) GDPR).
Provider: OpenAI (where such features are enabled).
9) Cookies and similar technologies
The Service uses technically required browser storage/cookies for core functionality (for example account/session persistence and security-related behavior).
As of the last updated date above, Elevenfold does not use separate marketing or analytics tracking cookies.
If non-essential tracking is introduced in future, it will require consent where legally required.
10) Recipients and international transfers
Data may be shared with processors needed for service operation (hosting/infrastructure, email, payment, AI where enabled) and with authorities if legally required.
Some processing may occur outside the EU/EEA. Where applicable, transfers rely on GDPR-compliant safeguards (for example SCCs and/or adequacy mechanisms).
11) Retention
Data is retained only as long as necessary for the purposes described or as legally required.
- Account/gameplay data: generally while account is active.
- Support communications: as needed for support and operational records.
- Billing records: according to tax/commercial retention obligations.
On account deletion, personal data is deleted while team history may remain in anonymous form for ranking/history integrity.
12) Your rights
Under GDPR, you have rights of access, rectification, erasure, restriction, data portability, objection, and consent withdrawal (where consent is the legal basis).
You can use in-app legal controls (when available) or contact support@elevenfold-legacy.com.
13) Right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).
You can contact your local supervisory authority, or (for the controller location in Bavaria) Bayerisches Landesamt fuer Datenschutzaufsicht (BayLDA): www.lda.bayern.de
14) Security
Appropriate technical and organizational safeguards are applied, including access controls, least-privilege principles, and encrypted transport where supported.
15) Children
The Service is not intended for children. If you believe a child provided personal data, contact support@elevenfold-legacy.com.
16) Changes to this policy
This Privacy Policy may be updated to reflect legal, technical, or product changes. The last-updated date above shows the current version.
17) Contact
Privacy requests and questions: support@elevenfold-legacy.com