Privacy Policy
Last updated: 2026-10-18
This Policy explains which data Vaelenor collects, why, who it is shared with and what your rights are, under the Brazilian General Data Protection Law (Law 13,709/2018, "LGPD"). The data controller is Vaelenor. Privacy contact: the game support channel.
1. What we collect
Data you provide
- Sign-up: name, e-mail and password (stored only as an irreversible hash).
- Profile and gameplay: character names and looks, messages in the Plaza and guild chats, friends list, blocks, reports and support requests.
Data generated while playing
- Progress: levels, items, battles, quests, achievements, guilds, auction listings and everything that makes up your character.
- Purchases: orders placed in the Premium Shop (product, amount, date, status) and the payment identifier at Mercado Pago. Card details never pass through us — they are handled by Mercado Pago.
- Preferences: language, audio and vibration. Audio and vibration stay only in your browser (
localStorage).
Technical data
- IP address, browser, operating system and access times, in security and error logs.
- Strictly necessary cookies: login session and cross-site request forgery (CSRF) protection. We use no advertising or cross-site tracking cookies.
2. Why we use it
| Purpose | Legal basis (LGPD) |
|---|---|
| Keep your account and make the game work (progress, chat, guilds, auctions) | Performance of the contract (art. 7, V) |
| Process purchases, credit diamonds and VIP, handle refund requests | Performance of the contract and legal obligation (art. 7, II and V) |
| Security: prevent fraud, bots, abuse and multiple accounts; enforce the rules of conduct | Legitimate interest (art. 7, IX) |
| Measure game usage in aggregate (how many play, what is viewed most) | Legitimate interest (art. 7, IX) |
| Send account e-mails (password recovery, purchase notices) | Performance of the contract |
| Meet tax obligations and keep access logs | Legal obligation (art. 7, II) |
We do not sell your data and we do not send third-party advertising.
3. Who we share it with
Only with those needed to run the game, and only what is necessary:
- Mercado Pago — payment processing (receives the purchase data; we receive only the confirmation and the identifier).
- Hosting and infrastructure providers — where the game and the database are stored.
- E-mail delivery service — for account e-mails.
- Authorities, when there is a legal obligation or court order.
Other players see what is public in the game: character name and looks, guild, level, ranking position and what you write in chat. You can limit your profile's visibility in Settings.
These providers may be located outside Brazil. When that is the case, we require protections compatible with the LGPD.
4. How long we keep it
- While the account exists: all data above.
- When you delete the account: name, e-mail and password are erased or anonymized immediately; characters, items, chat, friends and progress are deleted.
- Payment records: kept for 5 years after the purchase, as required by tax and consumer law, without any link to your identifying data.
- Access logs (IP and time): 6 months, under the Brazilian Internet Framework (art. 15).
- Reports and moderation records: kept as long as needed to apply and review penalties, anonymized when the account is deleted.
5. Your rights
The LGPD (art. 18) grants you, among others, the right to access, correct, anonymize, port and delete your data, to know who we share it with and to withdraw consent.
- Delete your account: in Settings → Delete account, at any time, without contacting us.
- Correct your name or e-mail and other requests: write to the game support channel. We reply within 15 days.
- You may also file a complaint with the Brazilian National Data Protection Authority (ANPD).
6. Children and teenagers
The game is for people aged 13 or older. Those under 18 need permission from a guardian. We do not knowingly collect data from children; if you know of a child's account, tell us and we will remove it.
7. Security
Passwords are stored with an irreversible hash, database access is restricted and all traffic uses HTTPS. No system is infallible: if an incident affects your data, we will notify you and the ANPD as the law requires.
8. Changes to this Policy
We may update this Policy. The date of the current version is at the top of the page, and relevant changes will be announced in the game.