Privacy Policy
This policy explains what personal data L2 OldWorld (“we”) collects when you use our website, account panel and game servers, why, and what rights you have. The data controller is L2 OldWorld, Argentina. Contact: [email protected].
1. Data we collect
- Account data: email address, a one-way hash of your password, language, and whether your email is verified.
- Security data: IP addresses and browser user-agent at sign-in and when you give or withdraw consent; a log of security events (sign-ins, password, email and 2FA changes); two-factor authentication secrets and hashed recovery codes if you enable 2FA.
- Game data: game account logins, their password hashes as required by the game servers, and your characters.
- Support data: tickets, messages and the images you attach.
- Payment data (when donations are enabled): amount, currency, status and the payment provider’s transaction reference. We never receive your card details.
- Consent records: what you agreed to, which version of the text, when, and from which IP address.
2. Why we use it (legal bases)
- To create and run your account and game accounts, and to answer support requests — performance of our agreement with you.
- To protect accounts, prevent fraud, cheating and abuse, and keep the Service secure — our legitimate interests.
- To send news, events and launch announcements by email — your consent, which you can withdraw at any time in Settings or through the unsubscribe link in any such email.
- To keep payment records — legal obligations.
Account emails you cannot opt out of (verification, password reset, security notices) are sent only when needed to run your account.
3. Who processes data for us
- Brevo — sends account and marketing emails.
- Cloudflare — hosting network, content delivery and protection against attacks.
- Google reCAPTCHA — distinguishes people from bots on sign-in and sign-up forms; Google’s privacy policy applies to that check.
- PayPal and MercadoPago — process donations when donations are enabled.
Some of these providers process data outside your country. We rely on their contractual safeguards for such transfers. We do not sell your personal data.
4. How long we keep it
- Accounts whose email is never verified are deleted automatically after 7 days.
- Account, game and support data are kept while your account exists.
- Consent records are kept while your account exists, as proof of what you agreed to.
- Payment records are kept for the period required by tax and accounting law.
5. Your rights
You can ask to access, correct, export or delete your personal data, object to or restrict certain processing, and withdraw consent at any time without affecting earlier processing. Write to [email protected] from the email address of your account. If you are unhappy with our answer you can complain to your data protection authority — in Argentina, the Agencia de Acceso a la Información Pública (AAIP); in the European Union, the authority of your country.
6. Children
The Service is not intended for anyone under 16. If we learn that an account belongs to someone younger, we will delete it.
7. Cookies
The account panel uses one strictly necessary session cookie to keep you signed in. reCAPTCHA may set its own cookies when the check runs. The website uses no advertising cookies and no third-party tracking; it stores small preferences (language, favourites) in your browser’s local storage and uses cookieless, aggregate analytics. See our Cookie Policy.
8. Security
Passwords are stored only as hashes, links in emails expire and work once, and optional two-factor authentication is available. No system is perfectly secure; we will notify you and the relevant authority of a breach where the law requires.
9. Changes
We will publish any update here with a new version and date, and ask for your consent again when the law requires it.