1. Controller

The controller responsible for the processing of personal data on bitmeup.com, the associated game sites and within the games and services is:

A data protection officer has not been appointed, as the legal requirements for a mandatory appointment are not met. For any questions regarding data protection you can reach us at the email address above or via our support form.

2. Why we process data (purposes and legal bases)

BitMeUp UG operates various games and services in which data must be processed in order to run the games and to ensure game fairness and security. We only process personal data where one of the following legal bases of the GDPR permits it:

• Art. 6 (1) (b) GDPR (contract): for everything required to provide your account, the games, the services and to process purchases (e.g. registration, login, game progress, payment processing, support).

• Art. 6 (1) (f) GDPR (legitimate interest): for the security of our systems, the prevention of abuse and fraud, multi-account and fairness checks as well as technical logs. Our legitimate interest is the stable, fair and secure operation of the games for all users.

• Art. 6 (1) (a) GDPR (consent): for everything that is not strictly required, in particular newsletters, personalised advertising, analytics cookies (see “Cookies & Consent”) and access to the messaging system (see “Private Messages”). You may revoke any consent given at any time with effect for the future.

• Art. 6 (1) (c) GDPR (legal obligation): e.g. for statutory retention obligations relating to payment transactions.

For individual features we specify below which data is stored and for how long. We cannot publish an exact description of all detection methods (e.g. for multi-account checks), as they could otherwise be circumvented — we ask our community for their understanding.

3. Recipients and transfers to third countries

Your data is only passed on to third parties where this is required for operation (described per service below), where we are legally obliged to do so, or where you have consented. Data processing agreements pursuant to Art. 28 GDPR are in place with service providers processing data on our behalf.

Some service providers (e.g. Cloudflare, Twilio SendGrid, Xsolla, Google, Atlassian, Valve/Steam, Apple, Epic Games) also process data in the USA. We base such transfers on the standard contractual clauses of the EU Commission (Art. 46 (2) (c) GDPR) and — where the respective provider is certified there — on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR).

4. Changes to this privacy policy

We update this policy whenever our processing changes. In the event of material changes we will inform you by means of a clear notice on our sites and/or in the games and ask you to take note of the updated version.

You have the following rights under the GDPR vis-à-vis BitMeUp UG:

• Access to the data stored about you (Art. 15 GDPR) — most easily via our data request tool;

• Rectification of inaccurate data (Art. 16 GDPR);

• Erasure (Art. 17 GDPR) — please note: for game-technical reasons it is not always possible to delete a game account immediately; in that case all personal data is removed from the game account unless it is legally required for billing or prosecution purposes;

• Restriction of processing (Art. 18 GDPR);

• Data portability (Art. 20 GDPR);

• Withdrawal of consent (Art. 7 (3) GDPR) — at any time with effect for the future, e.g. via the “privacy settings” in the portal or the settings of the respective game;

• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany, datenschutz-hamburg.de.

To exercise your rights, an informal message to [email protected] or via the support form is sufficient.

Our games and services run on servers operated in Germany.

Server logs: When you visit our sites and services, the web servers automatically record log files. This data includes e.g. browser type and version, operating system used, referrer URL (the previously visited page), IP address, date and time of access and the requested file/URL. The logs serve to ensure operation, analyse errors and defend against attacks (Art. 6 (1) (f) GDPR) and are not merged with other data sources for advertising purposes.

Cloudflare: All access to our public sites and games is routed through the content delivery network of Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, or Cloudflare Germany GmbH). Cloudflare thereby processes your IP address and connection data as technically required in order to deliver content quickly and to defend against attacks (e.g. DDoS) (Art. 6 (1) (f) GDPR). For transfers to the USA see section 3 of the basics. More information: cloudflare.com/privacypolicy.

Cloudflare Web Analytics: To measure page views and loading times in aggregate, your browser loads a script from static.cloudflareinsights.com on our pages. It sends Cloudflare the page address, the previous page, browser and device type, and loading and response times. It sets no cookies and stores nothing on your device; according to Cloudflare, visits are not attributed to individual persons and the IP address is not stored for this purpose. We only see totals (e.g. views per page, loading times). The legal basis is our legitimate interest in stable and fast pages (Art. 6 (1) (f) GDPR).

Cloudflare Turnstile (bot and abuse protection): In certain areas of our sites, games and services we use “Cloudflare Turnstile” to check whether a request comes from a human or from a bot. The check is not displayed permanently but only when there is a reason for it — in particular for actions that lend themselves to automation, or in the case of unusually high action rates (see e.g. SpaceInvasion).

For this purpose a script provided by Cloudflare (challenges.cloudflare.com) is loaded into the page. Cloudflare thereby processes your IP address, browser and device information (e.g. browser type and version, operating system, language setting, screen and time zone data) as well as technical signals about the behaviour in the browser, and stores or reads information on your device for this purpose. According to Cloudflare, Turnstile does not set any cookies for advertising or tracking purposes, and the data is not used for advertising or for cross-site profiling. We send the verification token generated by Turnstile back to Cloudflare together with your IP address for validation; we log the result (passed / not passed) together with your user ID and the time.

The legal basis is our legitimate interest in defending against bots, automation and abuse, and in fairness within our games (Art. 6 (1) (f) GDPR). Storing and reading the information required for this on your device is exempt from consent under Section 25 (2) of the German TDDDG, as it is strictly necessary for the use you have requested. For transfers to the USA see section 3 of the basics. More information: cloudflare.com/privacypolicy.

If Turnstile cannot be loaded (e.g. because scripts or Cloudflare are blocked in your browser), we generally show our own image captcha instead. It runs entirely on our servers; no data is generated at Cloudflare in that case.

Technically required cookies and local storage: We use cookies and comparable storage in the browser or app (e.g. localStorage, sessionStorage) that are required for operation — in particular session and login cookies (so that you stay logged in and can switch between the portal and the games) as well as preference cookies (e.g. language, app detection). These are exempt from consent under Section 25 (2) of the German TDDDG; the associated data processing is based on Art. 6 (1) (b) and (f) GDPR. The login does not work without these cookies. Storing and reading the information required by our bot and abuse protection is likewise exempt from consent under Section 25 (2) TDDDG (Cloudflare Turnstile, see Hosting, Cloudflare & Bot Protection).

Cookies requiring consent, and advertising: We only use cookies and comparable technologies for personalised advertising and analytics if you have consented via our consent banner (consent banner according to the IAB TCF standard, managed via Google’s consent platform) (Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR). The banner shows you the list of advertising partners and lets you make a granular choice.

Withdrawal: You can change or withdraw your consent at any time via the “privacy settings” item (linked at the bottom of the portal and within the games).

We use — in each case only with your consent given via the consent banner (Art. 6 (1) (a) GDPR) — services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”):

• Google Analytics for statistical analysis of the use of our sites. The information generated (including a truncated IP address) may be transferred to Google servers, including in the USA.

• Advertising services provided by Google and partners to finance the free-to-play operation of our games. Without consent, no personalised advertising is displayed.

For transfers to the USA see section 3 of the basics. Further information on how Google processes data: policies.google.com/technologies/partner-sites and policies.google.com/privacy. You can change your choice at any time via the “privacy settings”.

You can optionally link your BitMeUp account with external providers and log in through them: Google, Facebook, Apple, Steam, Epic Games, Twitch and — where offered — Discord. Their use is voluntary; logging in with email address and password is equally possible.

When you log in via a provider we receive from it — depending on the provider — your user ID there, your display name, possibly your profile picture and possibly your email address. For the link we store the external user ID, the date of linking and the date of later changes (Art. 6 (1) (b) GDPR). After unlinking, the external ID is retained for another 90 days for traceability and then deleted.

Apple: With "Sign in with Apple" we receive your Apple user ID and the email address you share with us. If you choose "Hide My Email", this is a forwarding address from Apple through which our emails reach you. Apple transmits your name only at the first login. In addition we store a token issued by Apple in encrypted form so that we can revoke the connection with Apple when you delete your account.

Steam and Epic Games do not transmit an email address. If you log in via one of these providers for the first time, your BitMeUp account may therefore initially be created without an email address. You can add it in the settings; without an email address, password login and password recovery are not possible. More about Steam and Epic Games in the section Steam, Epic Games & App Stores.

For the data processed by the respective provider itself, please refer to its privacy policy (Google, Meta/Facebook, Apple, Valve/Steam, Epic Games, Twitch, Discord).

For sending emails (e.g. registration, password and notification emails and — only with consent — newsletters) we use the SendGrid service of Twilio Inc., 101 Spear Street, San Francisco, CA 94105, USA, as a processor.

For this purpose we transmit the email address as well as the subject and content of the respective email to the SendGrid servers via an encrypted connection. Using a specialised delivery provider ensures that our emails are delivered reliably and are not lost in spam filters (Art. 6 (1) (b) and (f) GDPR; newsletters only under Art. 6 (1) (a) GDPR — you can unsubscribe via the link in every mail or the portal settings).

For transfers to the USA see section 3 of the basics. More information: twilio.com/legal/privacy.

BitMeUp UG uses the forum software of WoltLab GmbH (woltlab.com), which maintains and further develops the software. We adopt the default settings of the WoltLab software for data collection and deletion and make no changes to them.

When a BitMeUp account is created, a forum account is created automatically (Art. 6 (1) (b) GDPR). These accounts are set up in such a way that all data can continue to be lawfully used, changed or deleted by the automatic tasks and processes of the WoltLab software.

Please note the privacy policy of the forum software: forum software privacy policy

BitMeUp UG engages Xsolla (USA) Inc., 15260 Ventura Blvd, Sherman Oaks, CA 91403, USA, to carry out and manage the payment transactions in all games. Xsolla acts as the provider of the purchase processing.

For these purposes we transmit the following data to Xsolla via encrypted connections (Art. 6 (1) (b) GDPR):

Important: We ourselves do not store any payment information (no credit card or bank details) — the actual payment takes place directly with Xsolla or the chosen payment provider. Questions and concerns before, during and after a purchase are handled by the Xsolla support, which you can reach at any time via the “Pay Station”.

For transfers to the USA see section 3 of the basics. More information: xsolla.com/privacypolicy.

Some of our games are also available via Steam, the Epic Games Store, the Apple App Store or Google Play. The respective provider is itself responsible for your account there, the purchase or download of the game and the functions of its platform; its privacy policy applies. We only receive the data listed here. For transfers to the USA, see section 3 of the basics.

Steam (Valve Corporation, 10400 NE 4th Street, Bellevue, WA 98004, USA)

Epic Games (Epic Games, Inc., Box 254, 2474 Walnut Street, Cary, NC 27518, USA)

Apple (Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA, in the EU Apple Distribution International Ltd., Cork, Ireland)

Google Play (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland)

The iOS and Android versions of District Null currently offer no purchases via Apple or Google.

An email written by the user or a request created via bitmeup.com/support/ is subsequently processed by the “Jira Service Desk” software of Atlassian Pty Ltd or Atlassian, Inc. This software categorises and manages requests so that the team can find the best possible way to solve a problem (Art. 6 (1) (b) GDPR). We use the retention and deletion settings recommended by Atlassian. All data entered here is treated strictly confidentially and is not passed on to third parties by either BitMeUp or Atlassian. For possible transfers to the USA see section 3 of the basics.

More information on Atlassian's privacy practices: atlassian.com/legal/privacy-policy

SpaceInvasion Classic uses an in-game ticket system. An in-game message is created which a team member can then assign to themselves. The problem is resolved exclusively via the in-game messaging system. This function is also available if the user has not consented to the in-game messaging function. In that case the user only sees in-game messages written by or to team members.

SpaceInvasion 2 uses an in-game ticket system. This is a ticket system separate from the in-game messages in which the player can open tickets (problems, requests or bug reports). The player can reply to these tickets without consenting to access to the in-game messaging or chat system.

In Damoria, requests may occasionally be resolved further in the game via the in-game messaging system. There may be cases in which the team contacts the player, e.g. when a special castle has been won/acquired.
In Damoria too, the player can write to all team members, even if they have not consented to the in-game messaging rules.

BitMeUp UG expressly points out that no support is offered via TS3, forum, IRC, telephone or other channels. We reserve the right to use one or more of these platforms if it supports finding a solution.

Our desktop app is a shell around the BitMeUp portal; the same sections as for the website apply. In addition:

• Persistent login: If you stay logged in within the app, a device token is stored on your device — where possible in the keychain/password store of your operating system. On our servers, only a verification value (hash) of the token is stored together with the device name and the time of last use (Art. 6 (1) (b) and (f) GDPR). The token is rotated on every use; it is deleted when you log out.

• Browser hand-off: If you launch a game in the browser from within the app, a one-time, short-lived and IP-bound hand-off code is used which expires after one minute.

To offer you suitable defaults (e.g. language and currency) and for fairness checks, we determine the approximate country of origin from your IP address (Art. 6 (1) (b) and (f) GDPR). For this purpose your IP address may be transmitted to one of the following services, which return the corresponding country to us:

• FreeIPAPI (freeipapi.com)
• ipwho.is (ipwho.is)

Only the IP address is transmitted; no reference to your account is passed to these services. The determined country is stored with your account. Alternatively, we evaluate the language settings of your browser.

For machine translations, BitMeUp UG uses the "Azure AI Translator" service of Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (processor under Art. 28 GDPR on the basis of the Microsoft Product Terms including the Data Protection Addendum). The resource we use is located in the Azure region "Germany West Central" (Frankfurt am Main) and is addressed via the European endpoint; processing takes place on servers within the European Union.

Support and feedback: If you write to us via the support system or the feedback function in a language the team member handling your request does not speak, they can have your text translated into German or English in our internal support tool. Only the text of your request or feedback is transmitted – no names, account identifiers, email addresses or IP addresses. We store the translation together with the request so that it does not have to be requested again for every team member; it is visible to the team only and is deleted together with the request. The legal basis is Art. 6 (1) (b) GDPR (handling your request) and Art. 6 (1) (f) GDPR (our legitimate interest in being able to answer requests in any language).

Mebula Legends – chat and mailbox: In Mebula Legends you can have chat and mailbox messages translated into your game language with a click. Only the message text is transmitted, no player ID. Details, including how translations are stored, are in the Mebula Legends section.

According to Microsoft, texts submitted for translation are not stored ("No-Trace"): they are held in memory only for the duration of processing and are used neither to train translation models nor for any other purpose. More information: learn.microsoft.com – Data, privacy and security for Azure AI Translator and privacy.microsoft.com.

A BitMeUp account is also required to participate in Nexus. Registration, administration, login and deletion are handled via the BitMeUp portal (see above); the sections BitMeUp Portal, BitMeUp Payment and BitMeUp Chat apply accordingly.

In Nexus too, game-relevant actions (e.g. purchases and the use of premium features, combat and progression actions) are logged with a timestamp in order to be able to trace purchases and for abuse and fairness checks (Art. 6 (1) (b) and (f) GDPR). For multi-account checks, the IP address as well as browser and system information may be collected and evaluated.

A BitMeUp account is also required to participate in Mebula Legends. Registration, administration and login are handled via the BitMeUp portal (see above); the sections BitMeUp Portal and BitMeUp Payment apply accordingly. Mebula Legends has its own in-game chat and mailbox; for these the information below applies instead of the section BitMeUp Chat Software.

You delete your Mebula Legends game account in the game under Settings. Deleting your BitMeUp account does not yet automatically cover the game account; please delete it in the game beforehand or contact support.

Operation of the game

Mebula Legends runs on servers of BitMeUp UG within the infrastructure described under Hosting, Cloudflare & Bot Protection. Development, maintenance and technical operation of the game are carried out by a developer commissioned by BitMeUp UG, who acts solely on behalf of and under the instructions of BitMeUp UG (Art. 28 GDPR). There is no separate database outside this infrastructure.

What data the game processes

In addition to the account data described in BitMeUp Portal: Data, Mebula Legends processes:

This processing takes place in order to provide the game, store your progress, enable play with other players and make purchases traceable (Art. 6 (1) (b) GDPR), to keep our systems secure, prevent abuse and ensure fair play (Art. 6 (1) (f) GDPR), and to meet commercial and tax retention obligations for real-money purchases (Art. 6 (1) (c) GDPR). You use the guild chat and the mailbox only after giving your consent in the settings under "Account & Help" (Art. 6 (1) (a) GDPR); you can withdraw that consent there at any time. The global chat can be used without consent.

Logged game actions

The following game actions are logged with a timestamp. The retention period is stated for each item.

Messages in the global chat and the guild chat are deleted after 14 days. A reported message is kept until the report has been handled and is deleted together with the report 90 days after handling. Mailbox messages are deleted 90 days after sending unless a reward attachment is still unclaimed. Reports about player profiles and feedback to the team are kept until the account is deleted.

Third-party services used

Mebula Legends does not integrate any third-party analytics, telemetry, crash reporting, push, map, font or advertising services. Fonts and game content are served from the BitMeUp infrastructure. The bot protection Cloudflare Turnstile is described under Hosting, Cloudflare & Bot Protection, login via Google and Steam under Login via Third-Party Providers and payments under BitMeUp Payment. Beyond that, the game uses the following services:

No data leaves the EU/EEA from the browser or Android game. When you use the Steam version, your Steam ID and order data are transmitted to Valve in the USA; Valve is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission).

Storage on your device

Mebula Legends does not set any cookies of its own. Only technically necessary entries and your own settings are stored in the local storage of your browser or the app; no consent is required for this (Section 25 (2) TDDDG). No tracking takes place.

Multi-account and abuse checks

For bot and abuse detection we evaluate the behaviour of your account on the server (type and time of game actions, 60 days, see above) and the results of bot protection checks (8 days). On request of the server, your browser may report whether foreign scripts interfere with the game; these reports are stored for 60 days. When referring players, an irreversible hash of your IP address is stored in order to detect referrals between accounts on the same connection; it is kept until the referral code or the account is deleted. The IP address itself is not stored by the game. The legal basis is our legitimate interest in fair and secure game operation (Art. 6 (1) (f) GDPR). The exact detection methods are deliberately not published. Bans are imposed manually by the team only, never automatically.

Content created by players

Your display name, avatar, profile motto, showcase, guild name and guild tag are visible to all logged-in players. Messages in the global chat are visible to all players, messages in the guild chat only to the members of your guild, mailbox messages only to sender and recipient. Team members with a moderation role can view and delete chat messages and profile texts. Chat messages, profile mottos and guild names pass through a word and link filter when saved; players can report messages and profiles. Mailbox messages are not filtered and are not read by the team unless you disclose them yourself as part of a report or support request. For retention periods see "Logged game actions".

Visible to all logged-in players are the game's rankings (display name, guild tag, position and values), the guild ranking and the guild list (guild name, tag, member count, level), your player profile (name, avatar, motto, showcase, combat power, progress, guild; without time information such as join date or last activity), marketplace listings (seller name, highest bidder) and, in the arena report, the name of the attacker. The top positions of the rankings are also shown on the Mebula Legends portal page at BitMeUp. What is shown is always the current state; after an account is deleted these entries disappear immediately.

Deletion and inactivity

You can delete your game account at any time in the game under Settings. When the game account is deleted, game state, items, settings, avatar, profile, expeditions, arena and tournament entries, guild membership (for leaders with handover to a member), friendships, gifts, co-op pact, loans, referral code, marketplace bids, bonus code traces and all telemetry and check logs are deleted immediately and permanently; you thereby disappear from all rankings. Your chat and mailbox messages, reports and open feedback remain readable for the other parties involved, with your name replaced by "deleted player"; handled feedback and all screenshots are deleted. Receipts for real-money purchases (Mebulit top-ups via Xsolla or Steam) are kept without any link to the game state for the statutory retention period of ten years (Art. 6 (1) (c) GDPR in conjunction with Section 147 of the German Fiscal Code and Section 257 of the German Commercial Code). Inactive game accounts are not deleted automatically.

Mebula Legends does not collect a date of birth and does not perform its own age verification; the age rules of the BitMeUp account apply. The game contains no third-party advertising and no tracking. Real-money purchases are only possible via the BitMeUp account.

A BitMeUp account is required for District Null. Registration, administration and login are handled via the BitMeUp portal; the sections BitMeUp Portal, Third-Party Logins and BitMeUp Payment apply. Depending on the version, District Null runs in the browser, as an app (Windows, macOS, Linux, iOS, Android) or via Steam or the Epic Games Store; for these the section Steam, Epic Games & App Stores also applies.

Login in the game: In the browser the game uses your login in the portal. In the apps you log in with email address and password or via a provider (Google, Facebook, Apple, Steam, Epic Games). The portal checks the credentials. To protect against attacks on passwords, your IP address is also transmitted and briefly used in memory for a login throttle, but not stored.

If you stay logged in to an app, a login token is kept on your device in the keychain or password store of the operating system. On our server we only store a check value (hash) of the token, the device label (name of the device and platform) and the times of login and last use. The token is valid for 90 days from its last use and is deleted when you log out (Art. 6 (1) (b) and (f) GDPR).

Data stored in the game:

We need this data for the game (Art. 6 (1) (b) GDPR). It is stored until your account is deleted; records of purchases are kept for the statutory periods (Art. 6 (1) (c) GDPR).